- Conduid
- Marketplace
- #incident-response
MCP servers tagged incident-response
146 live MCP servers tagged "incident-response", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with incident-response.
Anthropic Cybersecurity Skills
Accelerate AI security workflows with 817 open-source skills across 29 domains for six leading agent frameworks.
Volatility3
Volatility 3.0 development
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tail…
Sift MCP
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
Coroot MCP
Community MCP server that exposes Coroot incidents and health summaries as read-only tools for AI assistants (not an official Coroot product).
Vigil
Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
RocketplaneIO
Self-hosted AI SRE for Kubernetes — zero-instrumentation eBPF observability plus a copilot that fixes issues through guardrailed, self-verifying actions. BYO-LLM, air-gapped capab…
AI Runbooks
No description published.
Saki Panel
Next-gen AI-native server ops panel with an in-workspace SRE agent. Crash self-healing, safe rollbacks, Docker/game servers, and local Ollama support.
AI Reliability Copilot
Turn a production incident into a structured 9-section LLM response (severity, root cause, mitigation, postmortem). Ships with a 5-scenario regression suite + LLM-as-judge eval pi…
Mulder
Agentic DFIR
Deepticket
支持对接内部系统的 AI 排障工作台：通过 HTTP API / Webhook 接入工单与告警系统，串联代码、日志、配置和 Agent，并提供面向产品、运营、客服的 Web 自助分析页面。
Awesome AI Agent Attacks
A curated timeline of real AI agent security incidents, breaches, and vulnerabilities (2024-2026). Every entry sourced and dated.
Adk Runbooks
No description published.
AI Dfir Toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider t…
Sift MCP
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
Chronos
⏳ CHRONOS — Autonomous Data Incident Root Cause Analysis Agent. Triple-graph architecture (OpenMetadata + Graphiti + GitNexus) powered by LangGraph. Travels through metadata time…
Falconeye
Free self-hosted OSINT investigator's toolkit with an MCP server for Claude Code and Claude Desktop. Eighteen tools in one interface: crypto tracing, phishing fingerprinting, doma…
Unpage
Unpage is the open source framework for building SRE agents with infrastructure context and secure access to any dev tool.
Valhuntir
Valhuntir CLI — AI-augmented incident response platform
Awesome Agentic Devops
Curated + scored map of official MCP servers and agents for DevOps, Cloud, SRE, and Platform Engineering — every entry rated on production access, approval gates, and audit eviden…
Wazuh Autopilot
Autonomous AI SOC for Wazuh SIEM — 11 security-expert agents triage, correlate, investigate and plan responses 24/7, every action gated by two-tier human approval. Runs on OpenCla…
Flarevm MCP
MCP server bridging Kali and FlareVM for automated Windows malware analysis. 48 tools, 5 prompts, 5 resources, composite playbooks (triage, behavioral, unpack, persistence audit).
Wordpress Malware Removal
Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware — cloaking, backdoors, database injection…
Vigia Intent Analysis
DFIR intentionality engine for SIFT. Verdicts sealed before any LLM sees the evidence. Detects fabricated artifacts and false flags — not just what happened, but who benefits f…
Tares
The open-source platform for always-on AI agents. Connect anything that emits events; Tares puts every event on one timeline per thing, wakes an agent the moment it matters, and k…
Verdict Dfir
VERDICT — a DFIR agent (Claude Code as the engine) that produces a signed, offline-verifiable verdict. SANS Find Evil! 2026.
Agent Runbook
MCP server for agent-runbook-generator — Model Context Protocol tool registry
culprit
Report the symptom. Culprit names the cause - a Slack agent that triages incidents into a root-cause hypothesis, suspected owner, and a draft GitHub issue, built on MCP.
Wintools MCP
Valhuntir Windows forensic tool execution via MCP
Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
nimbus-agent/Nimbus
stdio`.
Naso
Self-hosted breach and dark-web exposure monitoring: ingest leaks, correlate identities, triage with a local LLM. Your infrastructure, your data.
Cairn
Agentic incident-analysis copilot: MCP tool servers, a cost-aware model router, an approval-gated write path, and a companion npm CLI for platform analysis, a live dashboard, and…
Vigilo
🤖 Self-hosted AI on-call engineer — uptime monitoring that investigates incidents with local LLMs. Zero dependencies, MCP-native, status page included.
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Huntdeck
Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.
Blackbox Datahub
BlackBox, Grand Prize winner of the Build with DataHub Agent Hackathon 2026. Autonomous data incident response with an evidence gate, verified repair, real PRs, and DataHub write-…
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
ContextOps
AI-powered incident response engine for automated triage and runbook-grounded resolution.
Awesome Agentic Devops
AI SRE and incident agents, infrastructure agents, CI/CD agents and the tools that let agents run operations.
Agentic Dart
Automate digital forensics and incident response tasks using an autonomous agent aligned with MITRE ATT&CK frameworks.
Verdict
Autonomous DFIR agent for SIFT - cited findings, audited actions, zero hallucinated evil.
Ops Incident Core
Collector-first engineering evidence backend for deterministic ingestion, Qdrant retrieval, cited investigation, readiness reports, workflows, evals, and Core MCP. Azure deploymen…
Defender Xdr MCP
Self-hosted, strictly read-only MCP server for Microsoft Defender XDR. Bring your own AI to your Defender telemetry — delegated per-user auth, no write path, production guardrails.
LogPoseSIFT
An autonomous, multi-agent DFIR orchestrator. LogPose utilizes custom MCP boundaries to safely execute SIFT tools and synthesize breach data into actionable timelines at machine s…
Tares Cookbooks
Companion cookbooks that take a provider's agent, swap only its read path for one NavFlow query, and measure the difference on a real running system. Includes a self-contained SRE…
Concord
An open-source AI-native platform that connects your existing DevSecOps tools through intelligent MCP agents — turning fragmented signals into instant root cause, fixes, and compl…
DevGuard Enterprise
DevGuard Enterprise — AI Security Platform powered by DataHub. Autonomous AI agents for security analysis, graph reasoning, evidence-driven remediation, and enterprise governance.