RocketCyber MCP Server

An MCP server for the RocketCyber customer API (v3). RocketCyber is a managed SOC for MSPs: agents on endpoints and firewall log collectors feed detection apps, and threats the SOC confirms become incidents. This server lets an AI agent read incidents, app events and event summaries, the agent and firewall inventory, the detection apps, the account hierarchy, and Microsoft Defender and Microsoft 365 status. Every tool is read-only.

• Transport: MCP Streamable HTTP at POST /mcp, health probe at GET /health

• Stateless and multi-tenant: the API key arrives on every request as an HTTP header and is never stored; every tool is listed from the first tools/list

• Python 3.12, uv, FastMCP, httpx

• License: Apache-2.0, Copyright 2026 MSPbots.ai

Authentication headers

Where to get it: in the RocketCyber console, an administrator copies the customer API access token from the provider account's settings (the API reference links to the step-by-step help article). The token reads every customer account under that provider account.

How the key is sent to RocketCyber: as Authorization: Bearer <token> on every call to https://api-us.rocketcyber.com/v3/... (region us) or https://api-eu.rocketcyber.com/v3/... (region eu).

A request to /mcp without the key gets HTTP 401; a region other than us / eu gets HTTP 400.

Related MCP server: Auvik MCP Server

Tools

All tools return a JSON string. Paged lists keep the API's {totalCount, currentPage, totalPages, dataCount, data} and add summary {count, total, page, total_pages, has_more, next_page}. accountId scopes a tool to one customer account; without it the tool covers every account the token can see. dates filters take start|end (ISO dates, either side may be empty; a single date means "from that date on"). sort takes field, field:asc or field:desc. pageSize defaults to 25 (the API's own default is 1000), max 1000.

Errors come back as a JSON envelope instead of an exception:

{"error": {"code": "unauthorized", "message": "RocketCyber returned HTTP 401 for account: Authentication failed. Please provide valid credentials.", "retryable": false}}

code is one of not_configured, unauthorized, not_found, invalid_argument, rate_limited, upstream_error. Calls are retried with backoff on 429 (honouring Retry-After), 5xx and network errors.

Run locally

uv sync
uv run python -m rocketcyber_mcp          # listens on 0.0.0.0:8080

or with Docker:

docker build --platform linux/amd64 -t rocketcyber-mcp:dev .
docker run --rm -p 8080:8080 rocketcyber-mcp:dev

Configuration (environment variables, all optional): MCP_HTTP_HOST (default 0.0.0.0), MCP_HTTP_PORT (default 8080), LOG_LEVEL (default INFO). The token is never read from the environment.

Testing example

# list tools
curl -s http://localhost:8080/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-Rocketcyber-Api-Key: your-api-key" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

# open incidents created this year
curl -s http://localhost:8080/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "X-Rocketcyber-Api-Key: your-api-key" \
  -H "X-Rocketcyber-Region: us" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"rocketcyber_list_incidents","arguments":{"status":"open","dates":"2026-01-01|"}}}'

Unit tests (no network access needed):

uv run pytest

Delivery notes

• Tool count (10). Kept as is because the tool names and camelCase parameter names are an existing contract.

• API contract. Requests follow RocketCyber's published customer API reference (https://api-doc.rocketcyber.com, v3). Older versions passed some filters through under names the API does not have; they now map to the documented query parameters: agents platform -> os, agents dates -> created, incidents dates -> createdAt, events severity -> verdict, firewalls vendor -> type, apps sort -> sort + order.

• Removed parameters with no API filter: incidents severity; events eventType and hostname (use deviceId or details instead); firewalls connectivity and hostname; apps page and pageSize (the apps endpoint is not paged). Apps name filters the returned list locally.

• Event summary. dates is passed through as in earlier versions; the API reference lists only accountId for this endpoint.

License

Apache License 2.0 - see LICENSE and NOTICE.