Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

mcp_listening_servers

Lists processes with listening ports that are responding as Model Context Protocol (MCP) servers via HTTP (Many MCP servers use stdio and will not be detected by this table). This table queries the listening_ports and processes tables to find listening ports, then probes each port to identify active MCP servers.

Column	Type	Description
address	text	The network address on which the MCP server is listening (e.g., "127.0.0.1", "0.0.0.0", "::1").
cmdline	text	The full command line of the process running the MCP server.
has_completions	integer	Indicates if the MCP server supports completion capabilities (1 = true, 0 = false).
has_logging	integer	Indicates if the MCP server supports logging capabilities (1 = true, 0 = false).
instructions	text	Instructions or description text provided by the MCP server about its purpose and usage.
name	text	The name of the process running the MCP server.
pid	bigint	The process ID of the process running the MCP server.
port	integer	The port number on which the MCP server is listening.
prompts	text	JSON array of prompts provided by the MCP server, including their names and descriptions.
protocol_version	text	The MCP protocol version supported by the server (e.g., "2025-06-18").
resources	text	JSON array of resources provided by the MCP server, including their URIs, names, and descriptions.
server_name	text	The name identifier of the MCP server.
server_title	text	The human-readable title of the MCP server.
server_version	text	The version of the MCP server implementation.
tools	text	JSON array of tools provided by the MCP server, including their names and descriptions.