lumu-mcp-server
MCP server for Lumu Defender API integration with Claude Desktop
Ask AI about lumu-mcp-server
Powered by Claude Β· Grounded in docs
I know everything about lumu-mcp-server. Ask me about installation, configuration, usage, or troubleshooting.
0/500
Reviews
Documentation
π‘οΈ Lumu MCP Server
Supercharge Claude Desktop with Lumu Defender security incident analysis
An MCP (Model Context Protocol) server that seamlessly integrates Claude Desktop with the Lumu Defender API, enabling AI-powered security incident analysis and management.
β¨ Features
- π Incident Retrieval: Get security incidents with advanced filtering
- π― Smart Analysis: AI-powered incident analysis through Claude
- π Full Management: Mark as read, mute, unmute, and close incidents
- π₯οΈ Endpoint Insights: Analyze affected endpoints and network contacts
- π Real-time Monitoring: Track incident updates and activity
- π Secure Integration: Environment-based API key management
- β‘ Easy Setup: One-command installation with pip
π Quick Start
1. Install
pip install lumu-mcp-server
2. Configure Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"lumu-mcp-server": {
"command": "lumu-mcp-server",
"env": {
"LUMU_DEFENDER_API_KEY": "your-api-key-here"
}
}
}
}
3. Start Using
Ask Claude: "Get security incidents from Lumu Defender"
π‘ Need help finding your config file? See Configuration Locations below.
π§ Configuration
Get Your Lumu Defender API Key
- Log in to your Lumu Defender account
- Navigate to Settings β API Keys
- Generate or copy your API key
Configuration File Locations
- π macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - πͺ Windows:
%APPDATA%\Claude\claude_desktop_config.json - π§ Linux:
~/.config/Claude/claude_desktop_config.json
Configuration Options
Standard Configuration (Recommended)
{
"mcpServers": {
"lumu-mcp-server": {
"command": "lumu-mcp-server",
"env": {
"LUMU_DEFENDER_API_KEY": "your-api-key-here"
}
}
}
}
Alternative Configuration
If the command isn't found, use the Python module directly:
{
"mcpServers": {
"lumu-mcp-server": {
"command": "python",
"args": ["-m", "lumu_mcp_server.server"],
"env": {
"LUMU_DEFENDER_API_KEY": "your-api-key-here"
}
}
}
}
Activate the Integration
- Restart Claude Desktop completely
- Look for the π MCP icon in Claude Desktop
- Test with: "Check the health of the lumu-mcp-server"
π¬ Usage Examples
Once configured, you can interact with Lumu Defender through natural language:
π©Ί Health & Status
- "Check the health of the lumu-mcp-server"
- "Is the Lumu integration working?"
π Incident Discovery
- "Get security incidents from Lumu Defender"
- "Show me open security incidents from the last 30 days"
- "Find all C2C and Malware incidents"
- "Get incidents with status 'open' or 'muted'"
π Incident Analysis
- "Get details for incident [UUID]"
- "Show me the full information about incident abc-123-def"
- "Get the context for incident [UUID]"
- "Show me related incidents and affected assets"
π Incident Management
- "Add a comment to incident [UUID]: 'Investigating with network team'"
- "Mark incident [UUID] as read"
- "Mute incident [UUID] with comment 'False positive'"
- "Close incident [UUID] with comment 'Threat resolved'"
π₯οΈ Network Analysis
- "Get endpoints for incident [UUID]"
- "Show me which endpoints were affected by this incident"
- "Analyze the network impact of incident abc-123-def"
π Real-time Monitoring
- "Get incident updates from the last 10 minutes"
- "Show me what happened in the last hour with incidents"
- "Check for recent incident activity"
π Advanced Workflows
- "Get all open Malware incidents, then show details for the most recent one"
- "Find critical incidents that are still open and summarize their impact"
- "List all muted C2C incidents and help me decide which to unmute"
- "Get incident endpoints and mark the incident as read when done"
Available Tools
1. health_check
Returns the server status and API key configuration status.
2. get_incidents
Retrieves security incidents with optional filters.
Parameters:
from_date(optional): Start date in ISO format (default: 7 days ago)to_date(optional): End date in ISO format (default: now)status(optional): Array of statuses ["open", "muted", "closed"]adversary_types(optional): Array of types ["C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"]labels(optional): Array of label IDs
3. get_incident_details
Get detailed information about a specific security incident.
Parameters:
incident_id(required): The UUID of the incident
Returns: Detailed incident information including status, IOCs, recommended actions, and more.
4. get_incident_context
Get context information for a specific security incident.
Parameters:
incident_id(required): The UUID of the incidenthash_type(optional): Hash type for filtering context
Returns: Context including related incidents, affected assets, threat intelligence, and timeline.
5. comment_incident
Add a comment to a specific security incident.
Parameters:
incident_id(required): The UUID of the incidentcomment(required): The comment text to add
Returns: Confirmation of the comment being added.
6. get_open_incidents
Retrieve only open security incidents.
Parameters:
adversary_types(optional): Array of types ["C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"]labels(optional): Array of label IDs
Returns: List of open incidents with filtering options.
7. get_muted_incidents
Retrieve only muted security incidents.
Parameters:
adversary_types(optional): Array of types ["C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"]labels(optional): Array of label IDs
Returns: List of muted incidents with filtering options.
8. get_closed_incidents
Retrieve only closed security incidents.
Parameters:
adversary_types(optional): Array of types ["C2C", "Malware", "DGA", "Mining", "Spam", "Phishing"]labels(optional): Array of label IDs
Returns: List of closed incidents with filtering options.
9. get_incident_endpoints
Retrieve endpoints and contacts for a specific security incident.
Parameters:
incident_id(required): The UUID of the incidentendpoints(optional): Filter by specific endpoint IPs or nameslabels(optional): Array of label IDs
Returns: Detailed endpoint and contact information for the incident.
10. mark_incident_as_read
Mark a security incident as read.
Parameters:
incident_id(required): The UUID of the incident to mark as read
Returns: Confirmation that the incident was marked as read.
11. mute_incident
Mute a security incident.
Parameters:
incident_id(required): The UUID of the incident to mutecomment(optional): Comment explaining why the incident was muted
Returns: Confirmation that the incident was muted.
12. unmute_incident
Unmute a security incident.
Parameters:
incident_id(required): The UUID of the incident to unmutecomment(optional): Comment explaining why the incident was unmuted
Returns: Confirmation that the incident was unmuted.
13. get_incident_updates
Get real-time updates on incident operations (alternative to WebSocket).
Parameters:
offset(optional): Starting offset for pagination (default: 0)items(optional): Number of items to return, 1-100 (default: 50)time(optional): Time window in minutes for updates (default: 5)
Returns: List of incident updates with timestamps in UTC (RFC 3339/ISO 8601 format).
14. close_incident
Close a security incident.
Parameters:
incident_id(required): The UUID of the incident to closecomment(optional): Comment explaining why the incident was closed
Returns: Confirmation that the incident was closed.
π§ Troubleshooting
Server Not Appearing in Claude Desktop
- Check Claude Desktop logs: Help β Show Logs
- Verify installation:
pip list | grep lumu-mcp-server - Test command: Run
lumu-mcp-server --helpin terminal - Restart Claude Desktop completely
API Key Issues
- β
Ensure API key is correctly set in
claude_desktop_config.json - β Verify API key is valid in Lumu Defender portal
- β Check Claude Desktop logs for authentication errors
- β Test with: "Check the health of the lumu-mcp-server"
No Incidents Returned
- π Date Range: Try broader date ranges (e.g., last 30 days)
- π Filters: Remove status/type filters to see all incidents
- π Permissions: Ensure API key has proper incident access
- π‘ Tip: Ask Claude "Get incidents from the last 30 days"
Connection Issues
- π Network: Verify internet connection to
defender.lumu.io - π Firewall: Ensure HTTPS traffic is allowed
- π Proxy: Configure proxy settings if needed
Need More Help?
- π Check QUICK_START.md for simplified setup
- π Report issues on GitHub
- π¬ Ask questions in discussions
π Security & Privacy
- π API keys stored in environment variables, never in code
- π HTTPS encryption for all API communications
- π« No data storage - all data fetched in real-time from Lumu
- π‘οΈ Error sanitization prevents sensitive information leakage
- π Audit trail through Lumu Defender's native logging
π€ Contributing
We welcome contributions! Please see our contribution guidelines:
Quick Development Setup
git clone https://github.com/jpyoda/lumu-mcp.git
cd lumu-mcp-server
python -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -e .
Adding New Features
- API Methods: Add to
lumu_mcp_server/lumu_client.py - Tool Registration: Update
handle_list_tools()inserver.py - Handler Implementation: Add to
handle_call_tool()inserver.py - Testing: Ensure functionality works with real API
π License
MIT License - see LICENSE file for details.
π Support
Get Help
- π Quick Setup: QUICK_START.md
- π Bug Reports: GitHub Issues
- π¬ Questions: GitHub Discussions
- π§ Lumu API Issues: Contact Lumu Support
Project Stats
Built with β€οΈ for the cybersecurity community
Enhance your security operations with AI-powered incident analysis
