1. Conduid
  2. Security
  3. Hotwash
MCP server · Security

Hotwash

· github.com/lidless-labs/hotwash

Interactive incident-response runbooks: build IR playbooks as visual flowcharts, run them step-by-step, and drive runs from an LLM via MCP.

Unclaimed ai-agentsautomationblue-teamcybersecurityfastapiincident-responsemcpmodel-context-protocolplaybooksreactsecuritysecurity-operationssoarsoc
InstallView source
34Low

Scored a month ago · breakdown

About Hotwash

Hotwash is an MCP server in the Security category: interactive incident-response runbooks: build IR playbooks as visual flowcharts, run them step-by-step, and drive runs from an LLM via MCP.

Install

From source
git clone https://github.com/lidless-labs/hotwash

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (10)

hotwash_accept_suggestionPromote a pending suggestion into a real execution, carrying its Wazuh alert as context. Destructive; requires `confirm: true`.

Parameters not published.

hotwash_advance_stepUpdate a single step: change status, assign an analyst, append a note, or record a decision.

Parameters not published.

hotwash_attach_artifactAttach a text or base64 binary artifact (log snippet, screenshot, hash list) to a step.

Parameters not published.

hotwash_cancel_runAbandon an in-progress run (stays queryable for the audit log). Destructive; requires `confirm: true`.

Parameters not published.

hotwash_dismiss_suggestionDismiss a pending suggestion as noise and anchor the mapping cooldown. Destructive; requires `confirm: true`.

Parameters not published.

hotwash_get_playbookFetch the full graph (nodes + edges) and metadata for one playbook by id.

Parameters not published.

hotwash_list_playbooksList playbooks in the library with optional category/tag/search filters; returns id, title, category, tags, and node count.

Parameters not published.

hotwash_list_suggestionsList ingest suggestions queued from `mode=suggest` Wazuh mappings (the analyst review queue).

Parameters not published.

hotwash_query_runGet current execution state: status, the full step list with statuses/evidence/notes, and optionally the timeline.

Parameters not published.

hotwash_start_runStart a new execution of a playbook against an incident; clones nodes into per-step state and returns the execution id.

Parameters not published.

Ask AI

✦

Ask AI about Hotwash

Powered by Claude · Grounded in docs

I know everything about Hotwash. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Hotwash

How do I install Hotwash?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Hotwash safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Hotwash still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.