edge-soc-mcp

A Cloudflare Workers MCP server that puts a SOC analyst's enrichment, investigation, and detection-context workflow behind a single endpoint, and runs on a free Cloudflare account.

Why it's built this way

• One tool per task, not one tool per vendor. ip_lookup fans out across AbuseIPDB, GreyNoise, Shodan, IPinfo, and more, then returns a single verdict instead of five raw API payloads for you to reconcile.

• Free by default. Runs entirely on Cloudflare's free tier (Workers, Durable Objects, KV, D1, R2, cron). Every paid or keyed source is optional.

• Degrades cleanly. A missing API key just marks that source auth_missing; the tool still answers with whatever is available.

• Verdict separated from evidence. Every tool returns the same normalized envelope, so an agent gets a clear answer and the operational notes behind it.

Under the hood it aggregates 20+ threat-intel and detection sources plus bundled corpora (ATT&CK, Sigma, LOLBAS, GTFOBins, HijackLibs, WADComs, D3FEND) into 18 MCP tools.

Related MCP server: Cyberbro MCP Server

Tools

Observables

Corpora-backed

Identity & extras

What a tool returns

Each tool emits the same normalized envelope, keeping the verdict separate from the evidence behind it:

Quickstart

New to Cloudflare? Follow SETUP.md for a step-by-step walkthrough covering account creation, resource provisioning, and client configuration.

The condensed path for developers already familiar with Wrangler:

# 1. Install
bun install

# 2. Log in and create backing resources
bun x wrangler login
bun x wrangler kv namespace create CACHE
bun x wrangler kv namespace create OAUTH_KV
bun x wrangler d1 create edge-soc-mcp-db
bun x wrangler r2 bucket create edge-soc-mcp-corpora

# 3. Create your local config from the template (wrangler.jsonc is gitignored),
#    paste the returned IDs into it, then generate types.
# wrangler types generates worker-configuration.d.ts from your bindings.
# Re-run it any time wrangler.jsonc changes.
cp wrangler.jsonc.example wrangler.jsonc
bun x wrangler types

# 4. Seed corpora into R2 and deploy
bun run seed
bun x wrangler deploy

R2 must be enabled in the Cloudflare dashboard before uploads will work.

Required secret

Set MCP_AUTH_TOKEN to a secret string of your choice. This becomes the password you paste on the OAuth consent screen when connecting a client for the first time. Without it the server will refuse all authorization attempts.

bun x wrangler secret put MCP_AUTH_TOKEN

Optional API secrets

Each key unlocks additional threat-intel sources. The server degrades cleanly without them.

bun x wrangler secret put ABUSEIPDB_API_KEY
bun x wrangler secret put ABUSE_CH_AUTH_KEY   # URLhaus, ThreatFox, MalwareBazaar, YARAify
bun x wrangler secret put GREYNOISE_API_KEY
bun x wrangler secret put IPINFO_TOKEN
bun x wrangler secret put URLSCAN_API_KEY
bun x wrangler secret put PULSEDIVE_API_KEY
bun x wrangler secret put OTX_API_KEY
bun x wrangler secret put NVD_API_KEY
bun x wrangler secret put HUDSONROCK_API_KEY
bun x wrangler secret put HIBP_API_KEY
bun x wrangler secret put SPUR_TOKEN
bun x wrangler secret put VT_API_KEY

Connecting an MCP client

ChatGPT / Claude custom connectors (OAuth 2.1)

ChatGPT (Actions) and Claude (custom connectors) support OAuth 2.1 + PKCE natively. Point them at the worker URL and they will walk through the consent flow automatically:

1. In the connector settings, enter your worker URL as the server URL (e.g. https://edge-soc-mcp.<your-subdomain>.workers.dev).

2. The client will redirect you to /authorize, which shows a password prompt.

3. Paste your MCP_AUTH_TOKEN value and click Authorize.

4. The client receives an OAuth access token and connects.

Dynamic client registration is supported at /register, so no manual client setup is required.

API clients (Bearer token)

Clients that support Bearer tokens can use the OAuth-issued access token directly, or go through the authorization code flow programmatically. For quick CLI testing, initiate the OAuth flow manually to obtain a token.

Legacy SSE clients can use /sse instead of /mcp.

Local development

This project uses Wrangler-generated runtime types (wrangler types) rather than @cloudflare/workers-types. The generated worker-configuration.d.ts is gitignored, so you must generate it before running type checks or tests.

bun install
bun x wrangler types
bun test
bun run typecheck
bun x wrangler dev

The worker exposes GET /health, POST /mcp, and GET /sse.

Full verification before deploy:

bun run typecheck && bun test && bun x wrangler deploy --dry-run --outdir dist

Sources & restrictions

• AbuseIPDB: register

• abuse.ch auth bundle for URLhaus, ThreatFox, MalwareBazaar, YARAify: register

• GreyNoise Community: signup

• IPinfo Lite: signup

• urlscan.io: signup

• NVD API key: request

• OTX: signup

• Pulsedive: signup

• Shodan InternetDB

• OpenPhish feed

• PhishTank best-effort URL check

• crt.sh

• RDAP via rdap.org

• EPSS

• CISA KEV

• Hudson Rock Cavalier OSINT

• HIBP Pwned Passwords

• Cloudflare DoH

• Google DoH

• SSLBL cached feeds

• Have I Been Pwned breach API: key purchase

• Spur Context: pricing

• VirusTotal Public API (signup): non-commercial and rate-limited

• Shodan InternetDB: non-commercial

Most lookups are passive and low-volume, but public and community APIs still carry rate limits, and some free sources are non-commercial only.

Scheduled refresh

A cron-triggered job keeps fast-moving feeds current:

• CISA KEV → KV

• OpenPhish → R2

• SSLBL IP, JA3, and certificate feeds → R2

Larger corpora are loaded with bun run seed. Re-run it to refresh ATT&CK, Sigma, LOLBAS, GTFOBins, HijackLibs, WADComs, or D3FEND data.

Implementation notes

• McpAgent is bound to a SQLite Durable Object via new_sqlite_classes, the state path that stays free-plan compatible.

• The Cloudflare free tier currently supports Durable Objects, KV, D1, R2, and cron, which is everything this server needs.

Non-goals

• No detonation or sandbox execution

• No public submission workflows for urlscan, VirusTotal, or YARAify

• No Sigma query-language translation

• No Threat Jammer integration