Logpoint MCP Server

This repository implements production-ready MCP server endpoints for Logpoint SIEM with support for n8n and Claude integrations.

Features

• POST /getalloweddata for allowed configuration data

• POST /getsearchlogs to start and fetch search results

• Incident API endpoints for retrieving, updating, and closing incidents

• Alert Rule API endpoints with JWT bearer authentication

• Repo and user-defined list endpoints

• HTTP and email notification settings endpoints

• n8n webhook integration endpoint

• Claude incident summary integration endpoint

• MCP server (app/mcp_server.py) exposing the incident/search actions, threat intel lookups, MITRE ATT&CK reference, and Jira/email tools as MCP tools for an LLM triage agent (see MCP Server below)

Related MCP server: wazuh-mcp

Run locally

1. Create a Python environment:

   python3 -m venv .venv
   source .venv/bin/activate
   pip install -r requirements.txt

2. Copy env example and customize production settings:

   cp .env.example .env

3. Configure your .env values before starting the server.

4. Start the server:

   uvicorn app.main:app --host 0.0.0.0 --port 8000 --log-level info

5. Example credentials:

   • username: John

   • secret_key: a1b2c3d4e5f6g7h8i9j0k1

Production and Integration Ready

• Environment-driven configuration via .env

• CORS enabled for allowed origins

• /health status endpoint

• /integration/n8n/alert for n8n webhooks

• /integration/claude/incident-summary for Claude prompt-ready incident summaries

Environment variables

The server loads configuration from .env or environment variables using Pydantic.

JWT_SECRET=a1b2c3d4e5f6g7h8i9j0k1
JWT_ALGORITHM=HS256
ALLOWED_ORIGINS=["*"]
ENVIRONMENT=production
ALLOWED_USERS=John:a1b2c3d4e5f6g7h8i9j0k1

Integration examples

n8n webhook payload example:

curl -X POST http://localhost:8000/integration/n8n/alert \
  -H "Content-Type: application/json" \
  -d '{"alert_id":"abc123","severity":"high"}'

Claude incident summary example:

curl -X POST http://localhost:8000/integration/claude/incident-summary \
  -H "Content-Type: application/json" \
  -d '{"incident_id":"abc123","name":"Suspicious login","risk_level":"high","status":"unresolved","assigned_to":"admin"}'

MCP Server

app/mcp_server.py exposes the Guardsix triage actions as MCP tools, so an LLM (Claude/OpenAI via n8n's AI Agent + MCP Client Tool node, or Claude Desktop) can call them directly instead of n8n hardcoding the request sequence.

Tools exposed:

Run it:

# stdio - Claude Desktop / MCP CLI clients
python -m app.mcp_server

# SSE - n8n's MCP Client Tool node
python -m app.mcp_server --transport sse

# Streamable HTTP
python -m app.mcp_server --transport streamable-http

Incident/search tools require the same username/secret_key credentials as the REST API (see example credentials above). Threat intel, Jira, and email tools are mocked (app/integrations.py) — swap those function bodies for real VirusTotal/AbuseIPDB/MISP/Jira/SMTP calls once API keys are available.

JWT Token Generator

python token_generator.py --sub admin --scope "user:read alertrules:write logsources:read alertrules:read search:read search:write" --secret a1b2c3d4e5f6g7h8i9j0k1