incident-response MCP servers & tools

22 Model Context Protocol servers tagged “incident-response”, ranked by usage. Connect any of them to Claude Desktop, Cursor or Windsurf in one step.

Search “incident-response” with filters

DebugBundle
DebugBundle MCP server for incidents, bundles, reproductions, health checks, probes, and ops.
Developer Tools
Upvotes: 0Installs: 0GitHub stars: 7
Observability MCP
Unified observability gateway for AI agents — Prometheus, Loki & more, with anomaly detection.
Monitoring
Upvotes: 0Installs: 0GitHub stars: 7
MCP Server Wazuh
gbrigandi
A Rust-based MCP server bridging Wazuh SIEM with AI assistants, providing real-time security alerts and event data for enhanced contextual understanding.
Security
Upvotes: 0Installs: 0GitHub stars: 239
Crowdsentinel MCP Server
AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch
Developer Tools
Upvotes: 0Installs: 0GitHub stars: 209
FaultKey · CausalLayer
Deterministic AI-liability attribution: signed, Bitcoin-anchored vendor/deployer/user fault split.
Legal
Upvotes: 0Installs: 0GitHub stars: 2
Cybersec MCP
Cybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.
Security
Upvotes: 0Installs: 0GitHub stars: 1
MCP Server Thehive
gbrigandi
A Rust-based MCP server to integrate TheHive, facilitating collaborative security incident response and case management via AI.
Security
Upvotes: 0Installs: 0GitHub stars: 15
Nimbus
nimbus-agent
Read-only search over a local index of your engineering stack (GitHub, Jira, Slack, PagerDuty, Datadog and more): incidents, PRs, deployments and DORA metrics.
Aggregators
Upvotes: 0Installs: 0GitHub stars: 7
Rlg
sebastienrousseau
Log-stream tools for on-call / SRE agent workflows — expose rlg (RustLogs) log files as MCP tools. Three tools: taillog (last N events, filtered by level/target), filterlog (JSON-path-style predicates), summarizeerrors (grouped error taxonomy). Speaks JSON-RPC 2.0 over stdio; near-lock-free structured logging engine underneath (65k-slot ring buffer, 14 output formats, oslog/journald sinks). Install cargo install rlg-mcp or docker run -i ghcr.io/sebastienrousseau/rlg-mcp. Dual-licensed MIT OR Apache-2.0.
Cloud Platforms
Upvotes: 0Installs: 0GitHub stars: 6
Devops MCP
Unified MCP server for Kubernetes, ArgoCD, Prometheus, and PagerDuty
Cloud Platforms
Upvotes: 0Installs: 0GitHub stars: 3
Devops Status MCP Server
Vendor status pages, TLS cert inspection, DNS propagation checks, and incident-response playbooks.
Developer Tools
Upvotes: 0Installs: 0GitHub stars: 2
Incident Response MCP for Apache Airflow
Diagnose Airflow failures from UI links with bounded logs and optional recovery actions.
Developer Tools
Upvotes: 0Installs: 0GitHub stars: 2
VMware Debug
Read-only VMware incident correlation: timeline, spikes, root-cause routing. 2 MCP tools.
Monitoring
Upvotes: 0Installs: 0GitHub stars: 1
VMware Debug
Read-only VMware incident correlation: timeline, spikes, root-cause routing. 2 MCP tools.
Monitoring
Upvotes: 0Installs: 0GitHub stars: 1
U
Unchore Defend
Grade a site's security headers with fixes and a badge; read logs or code for the defender.
Security
Upvotes: 0Installs: 0GitHub stars: 1
Sregymgate MCP
A paid remote MCP for SREGym, built to return verdicts, receipts, usage logs, and audit-ready JSON.
Security
Upvotes: 0Installs: 0GitHub stars: —
C
Controldrill MCP
List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises.
Security
Upvotes: 0Installs: 0GitHub stars: —
Alertlogic MCP
MCP server for Alert Logic MDR — incident response, log search, SOAR, and SOC workflows
Security
Upvotes: 0Installs: 0GitHub stars: —
Zabbix AI CLI
Task-shaped Zabbix access for AI agents: problems, host triage, metrics, maintenance windows.
Monitoring
Upvotes: 0Installs: 0GitHub stars: —
Ironscales
MCP server for Ironscales phishing incident management — incidents, mailboxes, and reporting.
Security
Upvotes: 0Installs: 0GitHub stars: —
A
ARBITER
Decision arbitration, action routing, state-machine control, incident response, persistent memory.
Knowledge & Memory
Upvotes: 0Installs: 0GitHub stars: —
Abnormal MCP Server
Abnormal Security MCP: threats, search, remediation, ATO cases, vendor/BEC, and evidence download.
Security
Upvotes: 0Installs: 0GitHub stars: —