Alertlogic MCP

Alert Logic MCP Server

Bring the full Alert Logic MDR platform into your AI assistant.

A Model Context Protocol server that exposes the complete Alert Logic API surface as structured tools any MCP-compatible client (Claude Desktop, Claude Code, Cursor, …) can call directly — enabling AI-powered security operations, incident response, and threat hunting at MSSP scale.

For incident responders: Query Alert Logic MDR incidents, elaborate raw log evidence, kick off SOAR playbooks, and search logs with SQL — all through Claude. Designed for MSSP-scale multi-account operations.

---

Table of Contents

• Overview
• Features
• Architecture
• Prerequisites
• Installation
• Configuration
• Claude Code Integration
• Claude Desktop Integration
• Module Overview
• SOC Quick Start
• Built-in SOC Playbooks
• Multi-Account MSSP Usage
• Security Notes
• Testing
• Troubleshooting
• Contributing
• License

---

Overview

This MCP server wraps the Alert Logic MDR platform API and exposes it as 473+ structured tools that any MCP-compatible AI client can call directly. It covers the full Alert Logic API surface — incident response, SQL-based log search, SOAR playbook automation, asset management, vulnerability analysis, user and credential management, billing, and more — organized into 46 domain modules. Auth, retries, pagination, token management, and JSON shaping are handled server-side; your AI client simply calls the tool by name.

---

Features

• Incident Response — List, get, elaborate (raw log evidence), complete, reopen, add notes, and add feedback to incidents. Friendly-ID lookup included.
• SQL Log Search — Submit Alert Logic log search queries in SQL, poll status, retrieve results, and release sessions.
• SOAR Playbook Automation — List, get, execute, and monitor SOAR playbooks; manage inquiries, triggers, and execution state.
• Asset Topology — Query the full asset inventory, declare and remove assets, set properties, and retrieve topology graphs for any deployment.
• Vulnerability Management — List exposures by severity, retrieve per-asset vulnerabilities, search the vulnerability knowledge base, and manage remediation items.
• User & Access Key Management — Full CRUD on users, roles, access keys, MFA settings, and password resets across accounts.
• Multi-Account MSSP Support — Per-tool account_id override and bulk cross-account operations (bulk deployments, bulk health checks, partner incidents).
• Built-in SOC Playbooks — Six tools that surface pre-written IR guides, threat-hunt workflows, MITRE ATT&CK mappings, and tool reference guides directly in-context.
• Tickets & Watchlist — Create, update, and close tickets; manage the alerting watchlist.
• Cloud & Azure Explorer — Browse cloud resource topology across AWS and Azure environments.
• Analytics Engine — Access AE content, rules, analytics, tags, tuning, and publication across multiple AE subsystems.
• Infrastructure Operations — Manage environments, scan schedules, scan results, network controls, ingest sources, and log integrations.

---

Architecture

+--------------------+      stdio / streamable-HTTP (MCP)     +--------------------------------+

| MCP Client | <-------------------------------------> | AlertLogic MCP Server | | (Claude Desktop, | | (this repo, main.py) | | Claude Code, …) | | | +--------------------+ | 46 modules (~473 tools): | | incidents, soc, soar, | | assets, vuln, users, … | | | | | base.py (HTTP, AIMS auth, | | token cache, retries) | +----------+---------------------+ | v HTTPS + AIMS Bearer token +-----------------------------+ | AlertLogic MDR Platform | | api.cloudinsight....com | +-----------------------------+

Transport: The server supports three MCP transports selectable via MCP_TRANSPORT:

• stdio (default) — launched on demand by your MCP client; no network port opened.
• streamable-http — persistent HTTP server; suitable for Claude Code and remote clients.
• sse — Server-Sent Events transport for SSE-capable clients.

Authentication: Alert Logic uses AIMS Bearer token auth. The server exchanges your access_key_id:secret_key API key for a short-lived Bearer token on first use, caches it, and re-authenticates automatically when the token expires — no manual token rotation required.

`base.py` centralizes HTTP method helpers (_get, _post, _put, _delete), per-service URL routing (Account-Topology service, global service, _at-prefixed routes), error translation, and the AIMS token cache.

---

Prerequisites

• Python 3.10 or newer
• uv (recommended) or pip
• An Alert Logic account with API access enabled
• An Alert Logic API key (access key ID + secret key; see Configuration)

---

Installation

# 1. Clone the repository

git clone https://github.com/rijul170/alertlogic-mcp.git cd alertlogic-mcp

2. Create a virtual environment and install dependencies

python -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\activate pip install -r requirements.txt

Or with uv (faster):

uv venv uv pip install -r requirements.txt

3. Configure credentials

cp .env.example .env $EDITOR .env # fill in the required variables (see below)

---

Configuration

All configuration is via environment variables, loaded from .env at startup.

Required variables

Optional variables

Optional service URL overrides

These default to Alert Logic's standard endpoints. Override only if you have a custom deployment:

ALERTLOGIC_GLOBAL_BASE_URL=https://api.global-services.global.alertlogic.com

ALERTLOGIC_AETUNER_BASE_URL=https://aetuner.mdr.global.alertlogic.com ALERTLOGIC_CONNECTORS_BASE_URL=https://connectors.mdr.global.alertlogic.com ALERTLOGIC_RESPONDER_BASE_URL=https://api.responder.alertlogic.com

Creating an API key

1. Sign in to the Alert Logic console.
2. Navigate to Manage → Users, select your user, then open Access Keys → Create.
3. Copy the Access Key ID and Secret Key.
4. Combine them as access_key_id:secret_key (with the colon) and set that as ALERTLOGIC_API_KEY.

---

Claude Code Integration (HTTP mode)

Start the server in HTTP mode:

MCP_TRANSPORT=streamable-http python main.py

Then register it in your Claude Code project or user MCP config (.claude/settings.json or ~/.claude/settings.json):

{

"mcpServers": { "alertlogic-mcp": { "type": "http", "url": "http://localhost:8000/mcp" } } }

Or via the CLI:

claude mcp add --transport http alertlogic-mcp http://localhost:8000/mcp

---

Claude Desktop Integration (stdio mode)

Edit claude_desktop_config.json:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %AppData%\Claude\claude_desktop_config.json

{

"mcpServers": { "alertlogic-mcp": { "command": "/absolute/path/to/.venv/bin/python", "args": ["/absolute/path/to/alertlogic-mcp/main.py"] } } }

Use absolute paths. Tilde (~) is not expanded by Claude Desktop. Point command at the venv Python, not the system Python.

Restart Claude Desktop. Alert Logic tools will appear in the tool picker.

---

Module Overview

46 modules, ~473 tools, organized by domain:

Incident Response

| soc_playbooks | 6 | Built-in IR guide, threat-hunt workflow, MITRE mapping, to