Netwrix Access Analyzer

You run a Netwrix Access Analyzer MCP Server to integrate Netwrix data with Claude Desktop, enabling dynamic AD and File System investigations through MCP-enabled clients. This server connects to SQL Server, exposes a range of Netwrix tools, and works with the Claude Desktop MCP flow to perform scans, queries, and data discovery across your environment.

How to use

Launch Claude Desktop and connect to the Netwrix Access Analyzer MCP Server to begin querying Active Directory and File System data. You will access a set of tools that let you explore effective memberships, permissions, domain controllers, certificate vulnerabilities, AD rights, and more. You can also run database connections and schema queries against your MSSQL database, and perform file system data discovery and access checks. Use the MCP to execute operations from your client, then inspect results and logs to verify outcomes.

How to install

Prerequisites you must have before running the MCP server. Install these components on your host machine or server:

• Python 3.12 or higher

• MCP SDK

• pyodbc 4.0.39 or higher for SQL Server connectivity

• python-dotenv 1.0.0 or higher for environment variable management

• ODBC Driver 17 for SQL Server or later (must be installed on your system)

1. Install Claude Desktop on your system from the official source for your OS. 2) Prepare the Netwrix Data Source by ensuring MSSQL is running and accessible, and that required Netwrix data scans (NAA) are available. 3) Obtain the MCP configuration snippet shown below for Claude Desktop and paste it into your MCP configuration. 4) Start Claude Desktop and ensure it connects to the Netwrix MCP Server.

Configuration and execution notes

The MCP is designed to be run from Claude Desktop using a local/runtime command path. A typical runtime configuration uses a wrapper command that launches the MCP server via a local runner, with environment variables supplying the SQL connection details.

{
  "NAA_AD": {
    "command": "/path/to/uv",
    "args": [
      "run",
      "--with",
      "pyodbc",
      "fastmcp",
      "run",
      "/path/to/mcp-server-naa/run.py"
    ],
    "env": {
      "DB_SERVER": "HOST OR IP",
      "DB_NAME": "DATABASENAME",
      "DB_USER": "USERNAME",
      "DB_PASSWORD": "PASSWORD",
      "DB_USE_WINDOWS_AUTH": "FALSE|TRUE"
    }
  }
}

Troubleshooting and integration tips

If you encounter issues connecting to your SQL Server or accessing Netwrix data, verify the following: that your SQL Server is running and reachable, that your credentials are correct, and that the ODBC driver is installed properly. Review logs for specific error messages and validate the environment variables are passed to the MCP runner.

Available tools

Get-ADEffectiveMembership

Discovers effective group membership in Active Directory with optional filters.

Get-ADExceptions

Retrieves AD exceptions with optional filters.

Get-ADPermissions

Retrieves AD permissions from the permissions view with filters.

Get-DomainControllers

Lists domain controllers.

Get-CertificateVulnerabilities

Lists certificate vulnerabilities.

Get-ADCARights

Lists AD CA rights.

Get-ADSecurityAssessment

Retrieves AD security assessment results.

Get-ADUsers

Retrieves AD user details with filters.

Get-ADGroups

Retrieves AD group details with filters.

Get-ADComputers

Retrieves AD computer details with filters.

Connect-Database

Connects to a specified MSSQL database.

Show-ConnectionStatus

Shows the current DB connection status.

Show-TableSchema

Shows the schema for a given table.

Discover-SensitiveData

Discovers where sensitive data exists (DLP matches).

Get-OpenShares

Finds open shares accessible to broad groups.

Get-TrusteeAccess

Finds resources where a trustee has access.

Get-TrusteePermissionSource

Finds the source of access for a trustee/resource.

Get-ResourceAccess

Gets effective access for a resource path.

Get-UnusedAccess

Finds users with unused access to a share.

Get-RunningJobs

Lists running Netwrix Access Auditor jobs.

Get-ShadowAccess

Retrieves details about shadow access.