<!-- content-guard: allow private-ipv4 file -->

Rapid7 InsightIDR MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with access to Rapid7 InsightIDR, a cloud-native SIEM for modern detection and response. Query investigations, search logs with LEQL, analyze alerts, track assets, monitor user behavior, and manage threat intelligence.

Features

Investigations

• Search and filter investigations by status, priority, assignee, date range
• Create, update, and manage investigation lifecycle
• Add comments and retrieve associated alerts
• Build investigation timelines

Log Search (LEQL)

• Execute LEQL (Log Entry Query Language) queries across log sets
• List available log sets (Firewall, DNS, DHCP, Endpoint, Cloud, Active Directory)
• Retrieve individual log entries and aggregate statistics
• LEQL syntax reference and examples

Alerts

• List and filter alerts by severity, type, status, date
• Get full alert details with evidence and indicators
• Update alert status (open, investigating, closed)
• Evidence extraction for investigation

Assets

• Search endpoints by hostname, IP, OS, agent status
• Full asset details: software inventory, vulnerabilities, agent info
• Recent activity: logins, processes, network connections

User Behavior Analytics (UBA)

• Search user accounts across the organization
• Activity analysis: login patterns, locations, accessed assets
• Risky user identification with behavior scoring
• Anomaly detection and alert correlation

Threat Intelligence

• IOC management: IPs, domains, file hashes
• Add indicators to threat library
• Search for threat indicator matches across logs

Saved Queries

• List and manage saved LEQL queries
• Create reusable queries with descriptions
• LEQL syntax helper with examples

Architecture

┌────────────────────────────────────────┐
│           MCP Client (LLM)             │
└──────────────┬─────────────────────────┘
               │ MCP Protocol (stdio)
┌──────────────▼─────────────────────────┐
│         rapid7-mcp server              │
│                                        │
│  ┌──────────┐  ┌────────────────────┐  │
│  │ Prompts  │  │    Resources       │  │
│  │ 4 guides │  │ templates, LEQL,   │  │
│  │          │  │ detection rules    │  │
│  └──────────┘  └────────────────────┘  │
│                                        │
│  ┌──────────────────────────────────┐  │
│  │            Tools                  │  │
│  │  investigations │ logs │ alerts   │  │
│  │  assets │ users │ threats│queries │  │
│  └──────────────┬───────────────────┘  │
│                 │                       │
│  ┌──────────────▼───────────────────┐  │
│  │      InsightIDR REST Client      │  │
│  │      (client.ts + config.ts)     │  │
│  └──────────────┬───────────────────┘  │
└──────────────────┼─────────────────────┘
                   │ HTTPS
┌──────────────────▼─────────────────────┐
│      Rapid7 InsightIDR Platform API    │
│      https://<region>.api.insight.rapid7│
└────────────────────────────────────────┘

Installation

git clone https://github.com/solomonneas/rapid7-mcp.git
cd rapid7-mcp
npm install
npm run build

Configuration

Set environment variables:

export RAPID7_API_KEY="your-api-key"
export RAPID7_REGION="us"          # us, eu, ca, au, ap
export RAPID7_ORG_ID="your-org-id" # optional

Or use a .env file:

RAPID7_API_KEY=your-api-key
RAPID7_REGION=us
RAPID7_ORG_ID=your-org-id

MCP Client Configuration

Claude Desktop

{
  "mcpServers": {
    "rapid7": {
      "command": "node",
      "args": ["path/to/rapid7-mcp/dist/index.js"],
      "env": {
        "RAPID7_API_KEY": "your-api-key",
        "RAPID7_REGION": "us"
      }
    }
  }
}

OpenClaw

Add to your openclaw.json:

{
  "mcp": {
    "servers": {
      "rapid7": {
        "type": "stdio",
        "command": "node",
        "args": ["/path/to/rapid7-mcp/dist/index.js"],
        "env": {
          "RAPID7_API_KEY": "your-api-key",
          "RAPID7_REGION": "us"
        }
      }
    }
  }
}

Tool Reference

Tool	Description
search_investigations	List/filter investigations by status, priority, assignee
get_investigation	Get full investigation details with timeline
create_investigation	Create new investigation
update_investigation	Update status, assignee, disposition
add_investigation_comment	Add comment/note to investigation
get_investigation_alerts	Get alerts linked to an investigation
search_logs	Execute LEQL queries against log sets
list_log_sets	List available log sets
get_log_entry	Get specific log entry by ID
get_log_stats	Aggregate statistics for a time range
list_alerts	Get alerts with severity/type/status filters
get_alert	Full alert details with evidence
update_alert_status	Update alert status
get_alert_evidence	Get evidence/indicators from an alert
search_assets	Search endpoints by hostname, IP, OS
get_asset	Full asset details with software/vulns
get_asset_activity	Recent activity for an asset
search_users	Search user accounts
get_user_activity	User behavior analytics
get_risky_users	Users with abnormal behavior scores
list_threat_indicators	List IOCs in threat library
add_threat_indicator	Add new IOC
search_threat_activity	Search for IOC matches in logs
list_saved_queries	List saved LEQL queries
create_saved_query	Save a LEQL query for reuse
leql_help	LEQL syntax reference and examples

LEQL Query Examples

-- Find all blocked traffic from a source
where(source_address = 10.0.0.1 AND action = BLOCK)

-- Top talkers by connection count
groupby(source_address) calculate(count) sort(desc)

-- Failed logins for a specific user
where(user = "admin" AND result = FAILED_LOGIN)

-- HTTP errors by URL
where(status >= 400) groupby(url) calculate(count)

-- DNS queries to suspicious domains
where(query CONTAINS "malware") groupby(query) calculate(count)

-- Outbound connections on non-standard ports
where(destination_port != 80 AND destination_port != 443 AND direction = OUTBOUND)

Prompts

Prompt	Description
investigate-alert	Guided alert investigation workflow
hunt-ioc	Search for IOC across all log sources
user-behavior-review	Analyze user activity for anomalies
incident-timeline	Build chronological incident timeline

Resources

URI	Description
rapid7://investigation-templates	Common investigation templates
rapid7://leql-reference	LEQL syntax and examples
rapid7://detection-rules	Built-in detection rule catalog

Development

npm run build    # Compile TypeScript
npm run dev      # Watch mode
npm run test     # Run tests
npm run lint     # Lint check

License

MIT