- Conduid
- Marketplace
- #incident-response
MCP servers tagged incident-response
146 live MCP servers tagged "incident-response", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with incident-response.
Snappcloud Bot
ChatOps SRE assistant for Kubernetes/OpenShift. Answers questions and investigates Alertmanager alerts over MCP servers — strictly inside each user's own RBAC, read-only, with no…
Xdr MCP
MCP server for the F6 XDR platform — gives AI assistants access to alerts, incidents, mail, files and hosts
EDB FILE EXPLORER
Cross-platform GUI, CLI and MCP server for Microsoft ESE databases (ntds.dit, SRUDB.dat, Exchange .edb, WebCacheV01.dat, Windows.edb) - digital forensics tool with multi-format ex…
Memory Blackbox
Agent memory forensics — trace a bad agent action back to the exact poisoned memory, see the blast radius, roll it back
Otx
MCP server for AlienVault OTX / LevelBlue Open Threat Exchange — complete DirectConnect API coverage (29 tools), stdio + streamable HTTP transports, read-only by default. Built on…
Rubixkube For AI
Investigate incidents, review evidence-backed root cause analyses, and track remediation across Kubernetes, AWS, GCP, Linux VMs, and hybrid platforms without leaving your editor.
Darktrace MCP
Unofficial Darktrace MCP server for SOC investigations and incident response in Claude, Cursor, Codex and VS Code.
Mac Lookup
Resolves a MAC address or BSSID to its manufacturer (CLI + MCP) — offline longest-prefix match (36/28/24-bit) against a cached copy of the IEEE registries, classifying the address…
IncidentPilot
基于真实 OpenTelemetry 遥测的多 Agent AIOps 事故诊断与安全处置平台
Pypi
Python packages for the ResQ disaster response platform: resq-mcp (FastMCP server connecting AI agents to drone fleets and simulations) and resq-dsa (zero-dependency data structur…
Chronos
⏳ CHRONOS — Autonomous Data Incident Root Cause Analysis Agent. Triple-graph architecture (OpenMetadata + Graphiti + GitNexus) powered by LangGraph. Travels through metadata time…
Sentinel Autogen Hunter
🛡️ Autonomous Multi-Agent Threat Hunting & Incident Response Swarm engineered with AutoGen, Azure Sentinel, and Model Context Protocol (MCP). Sub-second Netfilter isolation & real…
Dfireballz
AI-native digital forensics & cybercrime investigation platform. 7 MCP servers (Volatility3, Ghidra, Wireshark, OSINT, threat-intel & more) orchestrated by Claude, ChatGPT, or Oll…
Acornops
Open-source, self-hosted AI-assisted operations for Kubernetes and Linux. Start here for source, architecture, deployment, and contributions.
Vo Soc Harness
Harness de operaciones de ciberseguridad sobre Trend Micro Vision One: agentes de IA que hacen triage, investigan IOCs, ejecutan la contención y documentan la alerta. Incluye el s…
Debug Runbook
Give your AI Agent a senior engineer's debugging brain. Runbook-driven incident investigation via MCP — evidence collection, decision rules, structured reports. No more hallucinat…
Icinga
Model Context Protocol (MCP) server for Icinga 2 Core, Icinga Web, Icinga Director and the Linuxfabrik monitoring-plugins catalog.
OmniSec
O OmniSec é um SOC autônomo orquestrado por IA (Swarm). Integra agentes especializados, detecção, sandbox, inteligência de ameaças, playbooks de resposta a incidentes, ferramentas…
Notes Recover
Copy-first Apple Notes recovery and review toolkit for macOS, with AI-assisted triage, evidence-backed case Q&A, and a read-mostly MCP server for Codex / Claude Code style local a…
Rescueloop
Local-first observability and safe recovery for macOS and Windows. See what broke, review the fix, verify the result, and roll back safely.
AI Sre
🤖 AI SRE - Intelligent Site Reliability Engineering Toolbox. Lean containerized CLI toolbox for AI-powered Kubernetes cluster remediation via MCP Server API. Perfect for N8N workf…
Harrier Emr MCP
Evidence-backed EMR, Spark, and Kubernetes diagnosis MCP server for AWS DevOps Agent
Runbook Exec
https://github.com/giridharpandurangi/runbook-exec
ProcWitness
Passive process forensics for Windows, Linux and macOS. Records process behavior locally and produces an AI-ready evidence bundle.
Incident Timeline MCP
A simple MCP (Model Context Protocol) server that extracts structured information from incident response logs. Built to help analyze chat-based incident communications (Slack, Dis…
A10 Guardian
🛡️ REST API + MCP Server for A10 Networks Thunder TPS DDoS mitigation - Automate zone management, monitor attacks in real-time, and integrate with AI agents
Aient MCP
Aient AI — MCP server for AI SRE: ask what's broken in production, get a reviewed GitHub fix PR. Remote HTTP MCP over OAuth (+ x402 wallet transport).
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
Aura Tracker Gcp
The self-hosted GCP intelligence engine that explains architecture, investigates failures, and predicts change blast radius—with every conclusion tied to inspectable evidence.
SAVVYDFIR MCP
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a determinis…
Firefight
Agent ready incident management built for Slack
Incident Investigator
Stateful MCP server for incident investigation: dynamic evidence planning, competing hypotheses, confidence scoring, timelines, blast radius, and postmortems. Works with Cursor, C…
Stella Incident Profiler
Open-source JavaFX desktop and MCP-enabled incident profiler for AWS-hosted Java web applications using JFR, OpenTelemetry, CloudWatch, ALB logs, and Aurora metrics.
Hotwash
Interactive incident-response runbooks: build IR playbooks as visual flowcharts, run them step-by-step, and drive runs from an LLM via MCP.
Evidencegene Court
Adversarial autonomous DFIR: Prosecutor/Defender/Arbiter AI court over a typed read-only MCP server. Findings without real evidence refs are structurally rejected. SANS FIND EVIL!…
Cyber Incident Investigation And Triage MCP Server
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount…
Froggy Sre
MCP-based SRE incident response agent for macOS. Feed a Kubernetes alert → get root cause, fix, and risk in one tool call. Native Swift, on-device LLM by default.
Loomdb
An agent-native database. Sessions are branches an agent can fork, merge, and rewind; every write records what it was derived from; and taint-and-recall tells you exactly what a p…
Secops Agent Triage
Tool-calling SOC triage agent with multi-format alert ingestion, threat-intelligence enrichment, and structured NIST/MITRE assessments.
Agent Ops Operator
A Kubernetes operator for agents you can address. Alerts, schedules, cluster events and chat messages start Conversations — each in its own isolated agent pod, answering in a thre…
Opencode Anthropic Oauth
Restore Claude access in OpenCode with OAuth for Pro/Max logins, token refresh, and Anthropic model support
Synapcores Soar
Open-core SOAR platform for the autonomous SOC. Tier-1 triage agents, immutable audit, MCP portal for examiners. Built on SynapCores.
Soc Stack
One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.
Sre Investigation Agent
Incident-investigation chat agent on Amazon Bedrock AgentCore Runtime, with a live-streaming UI and its own MCP server for per-prompt cost/token/tool-call metrics
Protocol SIFT Async Bridge
Type-safe async MCP server for LLM-assisted memory forensics via Volatility 3: closes the 60-second attacker breakout window without LLM timeouts or evidence spoliation.
Bayescausal
Calibrated incident root cause inference for TypeScript: declarative Bayesian networks with exact and approximate inference and the do-operator, zero runtime dependencies.
Datahub Data Engineer Agent
On-call data engineer agent for DataHub: finds a data incident's root cause via column-level lineage, ranks the blast radius, files incidents/tags/owner notifications, and writes…
ChronoLens
Closed-loop predictive SRE control plane built on SigNoz. Forecasts SLO breaches from real p99 traces, takes a reversible action, then proves from measured telemetry that the outa…
Daylight
Daylight — independent third-party profile of a public API surface, by API Evangelist. Daylight (Daylight Security) is an AI-native Managed Detection and Response (MDR) provider d…
Software Builder
Portable Cursor/Claude agent skills for GitLab MR review, incident RCA, Kubernetes rightsizing, squad ownership, and org rollups — registry-driven install, behavioral evals, compo…