RocketCyber
Connects to RocketCyber's Managed SOC platform with read-only access to security telemetry. You get 10 tools covering incidents, alerts, agents, events, firewalls, and Windows Defender status, plus three MCP resources for quick data queries. The server lazy-loads the SDK on first call and routes all logging to stderr to keep Claude's stdio transport clean. Use it when you need Claude to query security events, triage incidents, or pull endpoint data from RocketCyber without building custom API clients. Ships with both stdio and HTTP transports, though stdio is the default for Claude Desktop integration.
- tools
- 10
- auth
- Secret needed
- transport
- STDIO
- env vars
- 6
- last updated
- Aug 13, 2026
Tools
10 toolsPublic tool metadata for what this MCP can expose to an agent.
rocketcyber_test_connectionTest the connection to RocketCyber API
Test the connection to RocketCyber API
No parameter schema in public metadata yet.
rocketcyber_get_accountGet account information
Get account information
No parameter schema in public metadata yet.
rocketcyber_list_agentsList monitored agents/endpoints
List monitored agents/endpoints
No parameter schema in public metadata yet.
rocketcyber_list_incidentsList security incidents
List security incidents
No parameter schema in public metadata yet.
rocketcyber_list_eventsList security events
List security events
No parameter schema in public metadata yet.
rocketcyber_get_event_summaryGet event summary/statistics
Get event summary/statistics
No parameter schema in public metadata yet.
rocketcyber_list_firewallsList firewall devices
List firewall devices
No parameter schema in public metadata yet.
rocketcyber_list_appsList managed apps
List managed apps
No parameter schema in public metadata yet.
rocketcyber_get_defenderGet Windows Defender status
Get Windows Defender status
No parameter schema in public metadata yet.
rocketcyber_get_officeGet Office 365 status
Get Office 365 status
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ROCKETCYBER_API_KEY*secretRocketCyber API key for authenticating to the Managed SOC API
ROCKETCYBER_CUSTOMER_ID*RocketCyber customer (tenant) identifier
ROCKETCYBER_API_URLRocketCyber API base URL — override only if using a non-default region
MCP_TRANSPORTdefault: stdioTransport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
AUTH_MODEdefault: envCredential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.
LOG_LEVELdefault: infoLog verbosity: debug, info, warn, error
Readme
rocketcyber-mcp
MCP (Model Context Protocol) server for the RocketCyber Managed SOC platform. Provides read-only access to RocketCyber security data through 10 tools and 3 resources.
Features
- 10 read-only tools covering all RocketCyber API resources, each annotated
readOnlyHint: trueso MCP clients (e.g. Microsoft 365 Copilot) can skip per-call confirmation prompts - 3 MCP resources for quick data access
- Dual transport: stdio (default) and HTTP Streamable
- Lazy SDK initialization on first tool call
- Winston logger with all output routed to stderr
- Connection test tool for validating credentials
One-Click Deployment
Details
- Repository
- github.com/wyre-technology/rocketcyber-mcp
- Website
- github.com/wyre-technology/rocketcyber-mcp
- Package
ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active