Skip to main content
Glama
shashwat-sec

Lacework Alerts MCP Server

by shashwat-sec

Lacework Alerts MCP Server

An MCP (Model Context Protocol) server built with FastMCP that exposes Lacework API v2 alert operations as tools for AI agents and LLM integrations.

Quick Start (New Machine Setup)

# 1. Clone the repo
git clone <repo-url>
cd lacework_mcp_server

# 2. Create a virtual environment (Python 3.10+)
python3 -m venv .venv
source .venv/bin/activate

# 3. Install dependencies
pip install -e .
# or manually:
# pip install fastmcp httpx

# 4. Configure Lacework credentials (pick one)

# Option A – Config file
cat > ~/.lacework.json <<'EOF'
{
  "account": "yourcompany.lacework.net",
  "keyId": "YOUR_ACCESS_KEY_ID",
  "secret": "YOUR_SECRET_KEY"
}
EOF

# Option B – Environment variables
export LACEWORK_ACCOUNT="yourcompany"
export LACEWORK_KEY_ID="YOUR_ACCESS_KEY_ID"
export LACEWORK_SECRET="YOUR_SECRET_KEY"

# Environment variables take precedence over the config file.

# 5. Run the server
python lacework_mcp_server.py

Related MCP server: xsiam-mcp

Tools

Tool

Description

list_alerts

List alerts within an optional time range (supports relative times like 2h, last 2 hours)

search_alerts

Search alerts with filters (severity, status, alert type) and flexible time inputs (30m, last 2 hours, 2024-06-01)

get_alert_details

Get detailed info for a specific alert (Details, Investigation, Events, RelatedAlerts, Integrations, Timeline, ObservationTimeline)

get_alert_timeline

Shortcut – get the timeline for an alert

get_alert_investigation

Shortcut – get investigation details for an alert

get_alert_entities

List entities (machines, IPs) associated with an alert

get_alert_entity_details

Get enriched context for a specific entity (VirusTotal, network activity, etc.)

post_alert_comment

Post a comment on an alert's timeline

close_alert

Close an alert with a reason code

Running

Standalone (stdio – local)

source .venv/bin/activate
python lacework_mcp_server.py

Remote (SSE / Streamable HTTP)

Run the server on a remote host so AI agents can connect over HTTP and pass credentials per-request:

# SSE transport (default host 0.0.0.0, port 8000)
python lacework_mcp_server.py --transport sse --port 8000

# Streamable HTTP transport
python lacework_mcp_server.py --transport streamable-http --host 0.0.0.0 --port 9000

When running remotely, callers pass Lacework credentials as tool parameters instead of relying on server-side config:

{
  "name": "search_alerts",
  "arguments": {
    "start_time": "last 2 hours",
    "severity": "Critical",
    "lacework_account": "mycompany",
    "lacework_key_id": "MY_KEY_ID",
    "lacework_secret": "MY_SECRET"
  }
}

All three credential fields (lacework_account, lacework_key_id, lacework_secret) are optional on every tool. When omitted, the server falls back to its local config (env vars / ~/.lacework.json). Clients for different Lacework accounts are cached so tokens are reused across calls.

With Claude Desktop / VS Code

Add to your MCP settings (e.g. ~/.claude/claude_desktop_config.json or .vscode/mcp.json):

Local (with ~/.lacework.json present):

{
  "mcpServers": {
    "lacework": {
      "command": "/path/to/lacework_mcp_server/.venv/bin/python",
      "args": [
        "/path/to/lacework_mcp_server/lacework_mcp_server.py"
      ]
    }
  }
}

Local (without ~/.lacework.json – pass creds via env):

{
  "mcpServers": {
    "lacework": {
      "command": "/path/to/lacework_mcp_server/.venv/bin/python",
      "args": [
        "/path/to/lacework_mcp_server/lacework_mcp_server.py"
      ],
      "env": {
        "LACEWORK_ACCOUNT": "yourcompany",
        "LACEWORK_KEY_ID": "YOUR_KEY_ID",
        "LACEWORK_SECRET": "YOUR_SECRET"
      }
    }
  }
}

Remote (server running elsewhere via SSE):

{
  "mcpServers": {
    "lacework": {
      "url": "http://your-server-host:8000/sse"
    }
  }
}

For remote servers, credentials are passed as tool parameters on each call (lacework_account, lacework_key_id, lacework_secret).

API Reference

Based on the Lacework API v2 documentation:

  • Authentication: Uses POST /api/v2/access/tokens with automatic token refresh

  • Alerts: Full CRUD via /api/v2/Alerts endpoints

  • Rate limits: 480 requests/hour per functionality

  • Time ranges: Max 7 days per request; default is last 24 hours

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.
    MIT
  • A
    license
    B
    quality
    C
    maintenance
    Exposes the entire Palo Alto Cortex XSIAM REST API (129 operations across 26 categories) as MCP tools, plus composite tools like xql_query for AI agents to search and investigate security data.
    100
    Apache 2.0
  • A
    license
    A
    quality
    C
    maintenance
    Exposes Tenable security operations as MCP tools for AI-powered security workflows, enabling asset, vulnerability, scan, plugin, and tag management via natural language.
    17
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Exposes the LogicMonitor REST API as MCP tools with per-request LMv1 authentication, enabling querying of devices, alerts, reports, and more.
    Apache 2.0