Close the Zero-Day Content Gap Yourself with the HCL BigFix

Your team no longer has to wait on published content to respond to a new zero-day vulnerability. The HCL BigFix MCP Server for Vulnerability Remediation lets you point the AI client you already use at a disclosed CVE and get back a reviewable, ready-to-deploy BigFix Fixlet in minutes, not hours or days.

As part of the HCL BigFix vulnerability remediation platform, the MCP Server streamlines the process of researching, validating, and generating remediation content for newly disclosed vulnerabilities while keeping security teams in control of review and deployment. 

Why Zero-Day Remediation Can't Wait

AI-assisted vulnerability research is finding zero-days faster than the security industry can author remediation content for them. Disclosure cadence has moved from quarterly, to monthly, to out-of-band, to weekly-and-faster. Every hour your team waits on published content is an hour of added exposure, often against regulatory expectations of remediating critical CVEs within 24–72 hours¹. Authoring a Fixlet for a brand-new CVE has always been a careful, human-driven process, and that doesn't change here. What changes is that your team doesn't have to wait for HCL to run that process for you before you can act.

How the HCL BigFix MCP Server Works

The MCP Server for Vulnerability Remediation sits between your AI client and HCL BigFix over the Model Context Protocol (MCP), and it does three things:

1. Retrieves CVE patch data: KB articles, affected products, CPE data, patch availability, and any selection warnings for the CVE you give it.
2. Retrieves the patch files: filename, download URL, size, hash, and architecture from the relevant vendor source (Microsoft Update Catalog, Google Chrome, or WinGet).
3. Generates the Fixlet: selects the matching embedded BigFix template and produces reviewable BES Fixlet XML.

Every request carries your BigFix REST API bearer token, so the server always acts with your permissions, gated behind the HCL BigFix Remediate entitlement you've already licensed. Nothing is imported into HCL BigFix or deployed to an endpoint automatically. The generated Fixlet comes back to you for review, the same as any Fixlet you'd author yourself.

Reliable Fixlets, Not Guesswork

The reason a generated Fixlet is trustworthy isn't that an LLM is freehand-writing BES XML. The MCP Server hands the AI client the retrieved CVE and patch context, then constrains generation to the same embedded Fixlet templates HCL's patch content team has refined over more than a decade of authoring official HCL BigFix content. That's deterministic, template-based output with mandatory hash, size, and URL validation on every patch file, rather than open-ended AI improvisation.

Supported Patch Types Today

Version 1.0.0 supports:

• Windows cumulative updates, including updates with checkpoint prerequisites
• .NET Framework cumulative updates
• .NET / KB-based executable updates
• MSI-based application updates, including Google Chrome
• WinGet-based application updates

Getting Started with the MCP Server for Vulnerability Remediation

Install the MCP Server for Vulnerability Remediation using the Fixlet from the MCP Fixlet Engine site. Once installed, configure your AI client, generate a user-scoped bearer token from your BigFix Root Server, and ask your AI client to generate a Fixlet for a CVE or KB article. From there, review the generated Fixlet and deploy it through your existing HCL BigFix workflow, exactly as you would with any other content.

See how the MCP Server fits into automated vulnerability remediation with HCL BigFix Remediate.

Have questions about getting started? Contact us to learn more.

Sources

1. Cybersecurity and Infrastructure Security Agency (CISA), Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.