For incident responders: Query Alert Logic MDR incidents, elaborate raw log evidence, kick off SOAR playbooks, and search logs with SQL — all through Claude. Designed for MSSP-scale multi-account operations.

Table of Contents

• Overview
• Features
• Architecture
• Prerequisites
• Installation
• Configuration
• Claude Code Integration
• Claude Desktop Integration
• Module Overview
• SOC Quick Start
• Built-in SOC Playbooks
• Multi-Account MSSP Usage
• Security Notes
• Testing
• Troubleshooting
• Contributing
• License

Overview

This MCP server wraps the Alert Logic MDR platform API and exposes it as 473+ structured tools that any MCP-compatible AI client can call directly. It covers the full Alert Logic API surface — incident response, SQL-based log search, SOAR playbook automation, asset management, vulnerability analysis, user and credential management, billing, and more — organized into 46 domain modules. Auth, retries, pagination, token management, and JSON shaping are handled server-side; your AI client simply calls the tool by name.

Features

• Incident Response — List, get, elaborate (raw log evidence), complete, reopen, add notes, and add feedback to incidents. Friendly-ID lookup included.
• SQL Log Search — Submit Alert Logic log search queries in SQL, poll status, retrieve results, and release sessions.
• SOAR Playbook Automation — List, get, execute, and monitor SOAR playbooks; manage inquiries, triggers, and execution state.
• Asset Topology — Query the full asset inventory, declare and remove assets, set properties, and retrieve topology graphs for any deployment.
• Vulnerability Management — List exposures by severity, retrieve per-asset vulnerabilities, search the vulnerability knowledge base, and manage remediation items.
• User & Access Key Management — Full CRUD on users, roles, access keys, MFA settings, and password resets across accounts.
• Multi-Account MSSP Support — Per-tool account_id override and bulk cross-account operations (bulk deployments, bulk health checks, partner incidents).
• Built-in SOC Playbooks — Six tools that surface pre-written IR guides, threat-hunt workflows, MITRE ATT&CK mappings, and tool reference guides directly in-context.
• Tickets & Watchlist — Create, update, and close tickets; manage the alerting watchlist.
• Cloud & Azure Explorer — Browse cloud resource topology across AWS and Azure environments.
• Analytics Engine — Access AE content, rules, analytics, tags, tuning, and publication across multiple AE subsystems.
• Infrastructure Operations — Manage environments, scan schedules, scan results, network controls, ingest sources, and log integrations.

Architecture

+--------------------+      stdio / streamable-HTTP (MCP)     +--------------------------------+
|   MCP Client       | <-------------------------------------> |   AlertLogic MCP Server        |
| (Claude Desktop,   |                                        |   (this repo, main.py)         |
|  Claude Code, …)   |                                        |                                |
+--------------------+                                        |  46 modules (~473 tools):      |
                                                              |  incidents, soc, soar,         |
                                                              |  assets, vuln, users, …        |
                                                              |         |                      |
                                                              |   base.py (HTTP, AIMS auth,    |
                                                              |   token cache, retries)        |
                                                              +----------+---------------------+
                                                                         |
                                                                         v  HTTPS + AIMS Bearer token
                                                              +-----------------------------+
                                                              |   AlertLogic MDR Platform   |
                                                              |   api.cloudinsight....com   |
                                                              +-----------------------------+

Transport: The server supports three MCP transports selectable via MCP_TRANSPORT:

• stdio (default) — launched on demand by your MCP client; no network port opened.
• streamable-http — persistent HTTP server; suitable for Claude Code and remote clients.
• sse — Server-Sent Events transport for SSE-capable clients.

Authentication: Alert Logic uses AIMS Bearer token auth. The server exchanges your access_key_id:secret_key API key for a short-lived Bearer token on first use, caches it, and re-authenticates automatically when the token expires — no manual token rotation required.

base.py centralizes HTTP method helpers (_get, _post, _put, _delete), per-service URL routing (Account-Topology service, global service, _at-prefixed routes), error translation, and the AIMS token cache.

Prerequisites

• Python 3.10 or newer
• uv (recommended) or pip
• An Alert Logic account with API access enabled
• An Alert Logic API key (access key ID + secret key; see Configuration)

Installation

# 1. Clone the repository
git clone https://github.com/rijul170/alertlogic-mcp.git
cd alertlogic-mcp

# 2. Create a virtual environment and install dependencies
python -m venv .venv
source .venv/bin/activate          # Windows: .venv\Scripts\activate
pip install -r requirements.txt

# Or with uv (faster):
uv venv
uv pip install -r requirements.txt

# 3. Configure credentials
cp .env.example .env
$EDITOR .env                        # fill in the required variables (see below)

Configuration

All configuration is via environment variables, loaded from .env at startup.

Required variables

Optional variables

Optional service URL overrides

These default to Alert Logic's standard endpoints. Override only if you have a custom deployment:

ALERTLOGIC_GLOBAL_BASE_URL=https://api.global-services.global.alertlogic.com
ALERTLOGIC_AETUNER_BASE_URL=https://aetuner.mdr.global.alertlogic.com
ALERTLOGIC_CONNECTORS_BASE_URL=https://connectors.mdr.global.alertlogic.com
ALERTLOGIC_RESPONDER_BASE_URL=https://api.responder.alertlogic.com

Creating an API key