ManySignal MCP Server
Bring your SOC data into any MCP-compatible AI assistant
The ManySignal MCP server exposes findings, entity graph queries, case timelines, and threat intelligence as Model Context Protocol tools. Any MCP client — Claude Desktop, Cursor, or a custom AI agent — can query your SOC data directly.
MCP tool call — JSON-RPC 2.0
Standard MCP protocol, ManySignal data
The MCP server implements the Model Context Protocol specification. Any client that supports MCP tool calling — including Claude Desktop and the Claude API — can use it without modification.
Tool call from MCP client
{
"jsonrpc": "2.0",
"method": "tools/call",
"id": 1,
"params": {
"name": "manysignal_query_entity",
"arguments": {
"entity_id": "ent_user_alice",
"include": ["blast_radius", "open_findings", "recent_activity"],
"time_range_hours": 24
}
}
}MCP server response
{
"jsonrpc": "2.0",
"id": 1,
"result": {
"content": [{
"type": "text",
"text": {
"entity_id": "ent_user_alice",
"display_name": "[email protected]",
"blast_radius": 72,
"open_findings": [
{
"id": "fnd_01HXYZ1234ABCDEF",
"title": "Console login without MFA",
"severity": "high",
"triage_verdict": "true_positive"
}
],
"recent_activity": {
"auth_events_24h": 14,
"api_calls_24h": 203,
"geo_anomaly": true,
"anomaly_geo": "GB",
"baseline_geo": ["US", "CA"]
}
}
}]
}
}Available MCP tools
manysignal_list_findings
List open findings filtered by severity, status, entity, or detection rule
manysignal_get_finding
Get a single finding with triage verdict, reasoning trace, and entity context
manysignal_query_entity
Query entity profile: blast radius, open findings, behavioral scores, recent activity
manysignal_get_case
Get a full case with timeline, evidence, and correlated findings
manysignal_search_events
Natural language or structured query against the 180-day event store
manysignal_get_attack_chain
Get the reconstructed attack chain for a case or finding
manysignal_check_intel
Check an IP, domain, or hash against the active threat intel set
What the MCP server enables
Investigate from your IDE
Add the MCP server to Cursor or VS Code Copilot. Ask 'what is the blast radius of the entity in this finding?' without opening the ManySignal UI.
AI agent integration
Custom AI agents built with the Anthropic API or LangChain can call ManySignal tools directly as part of a multi-step investigation workflow.
Claude Desktop SOC workflows
Add the ManySignal MCP server to Claude Desktop and investigate findings, query entities, and review cases in a conversational interface.
No additional auth tokens
The MCP server uses your existing ManySignal API key. No separate credential set, no additional OAuth configuration.
Read-only by default
The MCP server exposes only read and query tools. Write operations (creating cases, triggering workflows) require explicit opt-in at server configuration time.
Self-hosted and cloud
The MCP server runs as a sidecar in self-hosted deployments or as a cloud-hosted endpoint for SaaS tenants. Configuration is a single JSON block in your MCP client config.
MCP Server — FAQ
How do I add the MCP server to Claude Desktop?
Add a server entry to your Claude Desktop MCP configuration file pointing to the ManySignal MCP server URL (cloud) or localhost port (self-hosted), with your API key as the bearer token. The server implements the standard MCP discovery protocol — tools appear automatically.
Is the MCP server available for self-hosted deployments?
Yes. The MCP server runs as a Kubernetes sidecar alongside the platform API server. It binds to a configurable port accessible from your network. No internet connectivity required for self-hosted MCP operation.
Can MCP tool calls trigger response actions?
Not by default. The MCP server is read-only unless you explicitly enable write tools in the server configuration. Write tools (triggering workflows, updating case status) are available as opt-in and subject to the same guardrail framework as direct API calls.
Is there a rate limit on MCP tool calls?
MCP tool calls consume from the same API rate limit pool as direct API calls. For high-frequency AI agent usage, a dedicated API key with a higher rate limit tier is recommended.
What MCP tools are exposed by the ManySignal MCP server?
Read tools include: search_events (natural-language event search), get_entity (entity profile and graph neighbours), list_findings (alert queue with filters), get_case (case detail with evidence), get_verdict (triage verdict with reasoning chain), and get_coverage (ATT&CK coverage map). Write tools (opt-in) include: update_case_status, trigger_workflow, and add_case_note.
Which MCP clients are supported?
ManySignal's MCP server is compatible with any MCP 1.0 compliant client: Claude Desktop, Cursor, Continue, and any client built with the Anthropic or OpenAI MCP SDK. The protocol is open — any tool that implements MCP discovery can use the server.
How does MCP integration improve investigation workflow compared to the UI?
MCP allows analysts to query ManySignal's entity graph, event search, and case data directly from their AI assistant without switching tools. Investigations that previously required 5–10 UI context switches can be conducted in a single AI conversation, with tool results appearing inline in the investigator's chat context.
Is MCP access governed by the same RBAC as the REST API?
Yes. MCP tool calls are authenticated with the same API key mechanism as the REST API. The API key's permission scope determines which tools are accessible — a read-only key can only call read tools, regardless of server configuration.
What data is sent to the AI model when using MCP tools?
Only the data you explicitly include in your MCP conversation context is sent to the AI model. ManySignal tool results are returned to the MCP client as structured text; the client then decides what to include in the next model request. ManySignal does not see or store the AI model conversation.
Investigate from wherever you already work
The MCP server is available in preview. Request access and connect your MCP client in under 10 minutes.