MCP servers tagged soc
46 live MCP servers tagged "soc", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with soc.
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Argus Agentic SOC Platform
An open source AI-native agentic SOC platform
Vigil
Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
Wazuh MCP Server
Wazuh MCP Server: AI-Driven SOC Automation
Sigil
Fleet AI Security Posture Management (AI-SPM): client agents on each developer machine score their AI coding agents' guard surfaces (Claude Code, Cursor, Codex, Gemini CLI — permi…
Wazuh Openclaw Autopilot
🤖 Automate SOC alert triage and incident response in Wazuh with OpenClaw agents and MCP for efficient security operations.
Wazuh Autopilot
Autonomous AI SOC for Wazuh SIEM — 11 security-expert agents triage, correlate, investigate and plan responses 24/7, every action gated by two-tier human approval. Runs on OpenCla…
Example MCP App Security
Reference MCP App for Elastic Security — interactive SOC dashboards inside Claude, Cursor, and other MCP hosts.
Sophos Central MCP Server
MCP server for the Sophos Fusion (formerly Sophos Central) APIs - SOC monitoring, endpoint management, admin automation, XDR investigation, and Fusion GraphQL cases
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Huntdeck
Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Defender Xdr MCP
Self-hosted, strictly read-only MCP server for Microsoft Defender XDR. Bring your own AI to your Defender telemetry — delegated per-user auth, no write path, production guardrails.
SOC Sentinel Splunk
Agentic SOC analyst for Splunk — Claude investigates via the Splunk MCP Server; a deterministic 3-layer validator verifies every finding against real data. An anti-hallucination t…
ThreatIntelMCP
A production-oriented Threat Intelligence platform that collects, enriches, and serves cybersecurity intelligence using Python, PostgreSQL, AI, and the Model Context Protocol (MCP…
Otx
MCP server for AlienVault OTX / LevelBlue Open Threat Exchange — complete DirectConnect API coverage (29 tools), stdio + streamable HTTP transports, read-only by default. Built on…
Splunkology
Autonomous SOC triage agent for Splunk — live SPL, MITRE ATT&CK verdicts, tamper-evident audit log, pluggable orchestration over a Splunk MCP server.
SOCLOOM
SOC operations woven with 800+ security skills, ML detection & MITRE ATT&CK — open-source AI-native SOC platform
Darktrace MCP
Unofficial Darktrace MCP server for SOC investigations and incident response in Claude, Cursor, Codex and VS Code.
Security
Open-source Bacen Evidence Engine for Brazilian fintechs — citable, exportable evidence pipeline for BCB 85/2021, ANPD 24h, Open Finance. Replaces consultant + spreadsheet workflo…
Hayabusa
MCP server wrapping the Hayabusa Windows event log forensic analysis CLI for AI-assisted threat hunting.
Server
CYBERDUDEBIVASH Autonomous Zero-Trust AI Cybersecurity Command Center (MCP Server)
Vo Soc Harness
Harness de operaciones de ciberseguridad sobre Trend Micro Vision One: agentes de IA que hacen triage, investigan IOCs, ejecutan la contención y documentan la alerta. Incluye el s…
Microsoft Security Agent Toolkit
Action layer for Microsoft Security AI agents - MCP servers, KQL snippets, Logic Apps templates, and end-to-end demos that pair with microsoft-security-skills
Phishforge
Open-source phishing simulation — campaigns, templates, training
Hotwash
Interactive incident-response runbooks: build IR playbooks as visual flowcharts, run them step-by-step, and drive runs from an LLM via MCP.
Tdp MCP
Model Context Protocol (MCP) server in Go for ThreatBook TDP (微步在线威胁检测平台): 105 OpenAPI endpoints + 4 diagnostics as typed MCP tools - alert triage, incident forensics, log hunting…
Detection Lab
Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).
Soc Stack
One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.
Wazuh SIEM
Monitor Wazuh SIEM with threat intel, network device logs, custom rules, active response, and Dockerized syslog collection
Daylight
Daylight — independent third-party profile of a public API surface, by API Evangelist. Daylight (Daylight Security) is an AI-native Managed Detection and Response (MDR) provider d…
Agentic Misp MCP
Workflow-first MCP server for MISP threat intelligence, with agentic IOC investigation, pivoting, reporting, and policy-gated write workflows.
AI Agent MCP Lab
Learning lab for AI Agents, MCP (Model Context Protocol), and AI-assisted SOC workflows using Python, Cursor, and custom security-focused MCP tools.
Copilot MCP Soc Pack
Community SOC Pack for Microsoft Security Copilot. Free-API MCP server and OpenAPI plugin bundle (KEV, EPSS, MITRE ATTACK, Abuse.ch, GreyNoise, AbuseIPDB, crt.sh, ransomware.live,…
CyberFortressX
Enterprise Agentic AI SIEM & SOC platform for Palo Alto Firewall analytics, threat intelligence, risk scoring, and automated incident response using FastAPI, IBM Agent Studio and…
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Zerosoc MCP
MCP servers, and the typed tool clients they wrap, for security operations
Edrgap
EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories
Architecture Diagrams Skill
Diagrams for software and chip design as one interactive offline HTML page: block diagrams, clock trees, pin-level schematics, WaveDrom timing, register maps, pinouts. Opens and s…
Mike
A Splunk-native agent that turns SOC analyst reasoning into a queryable institutional knowledge graph, accessible from SPL, a Python CLI, and a Model Context Protocol server.
Upf Insight
Deterministic power-intent intelligence for IEEE 1801 (UPF): validate, model, analyze and diff UPF before power-aware implementation. 77 rules, cross-file scope modeling, a CI qua…
Elastic Genai Secops
Open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: SIEM, detection rules, alert correlation, PII masking, LLM triage with human review, and a read-only MCP ser…
Soc Cmm System
Self-hosted web app for running SOC-CMM® 2.4.2 maturity assessments: 649 questions, official workbook scoring, progress tracking, EN/PT-BR, MCP server. Independent; not affiliated…
Meridian
Context-aware incident intelligence. Turns SIEM detections into source-bound incident narratives via a Gemini-3 reasoning agent on the MetisOS protocol stack.
SOC AutoPilot
SOC AutoPilot — Autonomous AI security agent that reduces Splunk alert triage from 45 minutes to under 2 minutes. Uses Splunk MCP Server, Foundation-sec hosted model, and a self-l…
Soc Watchfloor
No description published.