OpenCDR MCP
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENCDR_API_KEY | No | A scoped API key for the OpenCDR API. The key scopes enforce authorization and should match the selected profile. | |
| OPENCDR_API_URL | No | The endpoint of the already deployed OpenCDR Core API, e.g. https://example.execute-api.us-east-2.amazonaws.com/dev | |
| OPENCDR_CONFIG_FILE | No | Path to an optional JSON configuration file (default ~/.config/opencdr/mcp.json) containing the API url and key. Environment variables take precedence over this file. | |
| OPENCDR_MCP_PROFILE | No | Capability profile: observer, operator, or responder. Defaults to observer. | observer |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| opencdr_statusA | Check OpenCDR API health. Read-only. |
| opencdr_rules_listA | List detection/correlation rules. Read-only. kind: "signal" or "correlation" (omit for both; detection lists use opencdr_lists_list). Paginated: pass the returned next_token to continue. |
| opencdr_rules_getC | Get a rule by id. Read-only. kind must be "signal" or "correlation". |
| opencdr_lists_listB | List all detection lists. Read-only. |
| opencdr_lists_showC | Show a list's values. Read-only. |
| opencdr_signals_searchA | Search detection signals. Read-only. Provide exactly ONE selector: severity, event_id, category, or integration_id (the backend serves each from a dedicated index and cannot AND-combine them). date_from/date_to (YYYY-MM-DD, UTC, inclusive, max 31-day range) apply ONLY to the severity selector and default to the last 7 days; they are ignored for event_id/category. Paginated via next_token. Correlating by source_ip / principal / resource / account / region is not yet supported by the backend -- use event_id to pivot on a specific event. |
| opencdr_signals_statsA | Signal counts by severity for a date range. Read-only. A dashboard/summary view, not a substitute for opencdr_signals_search's paginated item listing. Defaults to the last 7 days if neither date is given (YYYY-MM-DD, UTC, inclusive; max range 31 days -- the same date-range bound the severity selector of opencdr_signals_search uses). Returns {date_from, date_to, counts: {: , ...}, total}. |
| opencdr_logs_searchA | Search audit/CloudTrail logs. Read-only. Provide exactly ONE selector: service, event_id, or event_name (the backend serves each from a dedicated index and cannot AND-combine them). date_from/date_to (YYYY-MM-DD, UTC, inclusive, max 31-day range) apply ONLY to the service selector and default to the last 7 days; they are ignored for event_id/event_name. Paginated via next_token. Correlating by source_ip / principal / access_key_id / user_agent / resource / account is not yet supported by the backend -- use event_id to pivot on a specific event. |
| opencdr_integrations_getC | Get the parser catalog, integration binding, or ingestion job diagnostics. |
| opencdr_settings_getB | Get an OpenCDR settings document by id (default: global). Read-only. |
| opencdr_ir_roles_listB | List IR role mappings (which IAM role responder assumes per AWS account). Read-only. |
| opencdr_ir_roles_getB | Get the IR role mapping for a 12-digit AWS account id. Read-only. |
| opencdr_ir_actions_listB | List executed, rollback-eligible IR actions. Read-only. |
| opencdr_ir_actions_getB | Get a specific executed IR action. Read-only. Includes rollback_supported and, once a rollback has been attempted, rollback_status ("pending"/"succeeded"/"failed"), rollback_error (set only on failure), and rollback_updated_at. rolled_back mirrors rollback_status == "succeeded" for back-compat; absent rollback_status means no rollback has been attempted yet. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Each tool maps to a distinct resource and action: rules, detection lists, signals, logs, integrations, settings, IR roles, and IR actions. The only mild terminology overlap is rules vs. detection lists, but the descriptions explicitly clarify which tool to use.
All tools use the opencdr_ prefix and snake_case resource_action convention, with consistent list/get/search/stats verbs. Minor exceptions like opencdr_status and lists_show remain readable and do not create confusion.
Fourteen tools is well-scoped for a read-only observability and investigation server. Each resource has only the list/get/search/stats operations needed for its role, with no obvious padding.
The read-only investigation surface is broad: health, rules, lists, signals, logs, integrations, settings, and IR roles/actions are all covered. Gaps remain around write/update/delete operations and rollback execution despite rollback-eligible IR actions, plus single-selector search limitations that agents must work around.