Rapid7 InsightIDR MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to Rapid7 InsightIDR, a cloud-native SIEM for modern detection and response. Query investigations, search logs with LEQL, analyze alerts, track assets, monitor user behavior, and manage threat intelligence.

Features

Investigations

• Search and filter investigations by status, priority, assignee, date range
• Create, update, and manage investigation lifecycle
• Add comments and retrieve associated alerts
• Build investigation timelines

Log Search (LEQL)

• Execute LEQL (Log Entry Query Language) queries across log sets
• List available log sets (Firewall, DNS, DHCP, Endpoint, Cloud, Active Directory)
• Retrieve individual log entries and aggregate statistics
• LEQL syntax reference and examples

Alerts

• List and filter alerts by severity, type, status, date
• Get full alert details with evidence and indicators
• Update alert status (open, investigating, closed)
• Evidence extraction for investigation

Assets

• Search endpoints by hostname, IP, OS, agent status
• Full asset details: software inventory, vulnerabilities, agent info
• Recent activity: logins, processes, network connections

User Behavior Analytics (UBA)

• Search user accounts across the organization
• Activity analysis: login patterns, locations, accessed assets
• Risky user identification with behavior scoring
• Anomaly detection and alert correlation

Threat Intelligence

• IOC management: IPs, domains, file hashes
• Add indicators to threat library
• Search for threat indicator matches across logs

Saved Queries

• List and manage saved LEQL queries
• Create reusable queries with descriptions
• LEQL syntax helper with examples

Architecture

┌────────────────────────────────────────┐
│           MCP Client (LLM)             │
└──────────────┬─────────────────────────┘
               │ MCP Protocol (stdio)
┌──────────────▼─────────────────────────┐
│         rapid7-mcp server              │
│                                        │
│  ┌──────────┐  ┌────────────────────┐  │
│  │ Prompts  │  │    Resources       │  │
│  │ 4 guides │  │ templates, LEQL,   │  │
│  │          │  │ detection rules    │  │
│  └──────────┘  └────────────────────┘  │
│                                        │
│  ┌──────────────────────────────────┐  │
│  │            Tools                  │  │
│  │  investigations │ logs │ alerts   │  │
│  │  assets │ users │ threats│queries │  │
│  └──────────────┬───────────────────┘  │
│                 │                       │
│  ┌──────────────▼───────────────────┐  │
│  │      InsightIDR REST Client      │  │
│  │      (client.ts + config.ts)     │  │
│  └──────────────┬───────────────────┘  │
└──────────────────┼─────────────────────┘
                   │ HTTPS
┌──────────────────▼─────────────────────┐
│      Rapid7 InsightIDR Platform API    │
│      https://<region>.api.insight.rapid7│
└────────────────────────────────────────┘

Installation

git clone https://github.com/solomonneas/rapid7-mcp.git
cd rapid7-mcp
npm install
npm run build

Configuration

Set environment variables:

export RAPID7_API_KEY="your-api-key"
export RAPID7_REGION="us"          # us, eu, ca, au, ap
export RAPID7_ORG_ID="your-org-id" # optional

Or use a .env file:

RAPID7_API_KEY=your-api-key
RAPID7_REGION=us
RAPID7_ORG_ID=your-org-id

MCP Client Configuration

Claude Desktop

{
  "mcpServers": {
    "rapid7": {
      "command": "node",
      "args": ["path/to/rapid7-mcp/dist/index.js"],
      "env": {
        "RAPID7_API_KEY": "your-api-key",
        "RAPID7_REGION": "us"
      }
    }
  }
}

OpenClaw

Add to your openclaw.json:

{
  "mcp": {
    "servers": {
      "rapid7": {
        "type": "stdio",
        "command": "node",
        "args": ["/path/to/rapid7-mcp/dist/index.js"],
        "env": {
          "RAPID7_API_KEY": "your-api-key",
          "RAPID7_REGION": "us"
        }
      }
    }
  }
}

Tool Reference

LEQL Query Examples

-- Find all blocked traffic from a source
where(source_address = 10.0.0.1 AND action = BLOCK)

-- Top talkers by connection count
groupby(source_address) calculate(count) sort(desc)

-- Failed logins for a specific user
where(user = "admin" AND result = FAILED_LOGIN)

-- HTTP errors by URL
where(status >= 400) groupby(url) calculate(count)

-- DNS queries to suspicious domains
where(query CONTAINS "malware") groupby(query) calculate(count)

-- Outbound connections on non-standard ports
where(destination_port != 80 AND destination_port != 443 AND direction = OUTBOUND)

Prompts

Resources

Development

npm run build    # Compile TypeScript
npm run dev      # Watch mode
npm run test     # Run tests
npm run lint     # Lint check

License

MIT