Arcanna MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Arcanna MCP Serverquery recent security events from the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Arcanna MCP Server
The Arcanna MCP server allows user to interact with Arcanna's AI use cases through the Model Context Protocol (MCP).
Usage with Claude Desktop or other MCP Clients
Configuration
Add the following entry to the mcpServers section in your MCP client config file (claude_desktop_config.json for Claude
Desktop).
Use docker image (https://hub.docker.com/r/arcanna/arcanna-mcp-server) or PyPi package (https://pypi.org/project/arcanna-mcp-server/)
Building local image from this repository
Prerequisites
Configuration
Change directory to the directory where the Dockerfile is.
Run
docker build -t arcanna/arcanna-mcp-server . --progress=plain --no-cacheAdd the configuration bellow to your claude desktop/mcp client config.
{
"mcpServers": {
"arcanna-mcp-server": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ARCANNA_MANAGEMENT_API_KEY",
"-e",
"ARCANNA_HOST",
"arcanna/arcanna-mcp-server"
],
"env": {
"ARCANNA_MANAGEMENT_API_KEY": "<ARCANNA_MANAGEMENT_API_KEY>",
"ARCANNA_HOST": "<YOUR_ARCANNA_HOST_HERE>"
}
}
}
}Related MCP server: SOAR MCP Server
Servers
One package, three MCP servers. Install once; each executable is a separate server, so a client attaches only
what it needs. All three use the same environment (ARCANNA_HOST, ARCANNA_MANAGEMENT_API_KEY, optional
ARCANNA_AGENTS_HOST, TRANSPORT_MODE=stdio|sse, PORT for sse). Tools are filtered by the API key's scopes.
Executable | MCP name | Covers |
|
| Jobs, integrations, events, feedback, buckets, metrics, IaC, roles, platform, code blocks |
|
| Agentic workflows: create, update, run, human-in-the-loop sessions |
|
| RAG documents, collections and tags |
Docker: the image's entrypoint is arcanna-mcp-server; run another server with e.g.
docker run -i --rm --entrypoint arcanna-agents-mcp -e ARCANNA_HOST -e ARCANNA_MANAGEMENT_API_KEY arcanna/arcanna-mcp-server.
Tools
arcanna-mcp-server
jobs:
start_job,stop_job,train_job,get_job_status,get_job_input_state,reset_job_input_state,submit_training_config_validation,get_training_config_validation,list_training_config_validations,cancel_training_config_validationresources:
search_integrations,get_integration_details,search_jobs,get_job_details,list_integration_types,get_integration_type_metadata,get_job_category_metadata,create_integration,update_integration,delete_integration,create_job,update_job,delete_job,check_integration_health,list_llm_models,get_job_decision_points,apply_iac,export_iac,get_roles,upsert_roles,delete_rolesevents:
query_arcanna_events,count_events,get_field_stats,get_field_groups,get_filter_fields,get_fields_mapping,get_event_explanation,get_similar_events,get_event_agentic_workflows,get_job_outliers,add_feedback_to_event,clear_event_feedback,add_agentic_notes,reprocess_events,reprocess_event_by_id,delete_events,ingest_event,export_event_by_id,transfer_eventbuckets:
query_buckets,get_bucket,get_similar_buckets,reprocess_buckets,request_bucket_model_update,request_bucket_model_update_by_filters,approve_bucket_feedback,update_bucket_feedback_state,delete_bucketsmetrics:
get_job_metrics,get_job_and_model_metrics,get_model_metrics,request_model_metrics_recompute,get_platform_metrics,get_internal_metrics,get_field_metrics,export_feedback,set_production_dateplatform:
health_check,get_platform_info,get_system_timestamp,delete_storage_datacode_blocks:
generate_code_instructions,execute_code,execute_code_async,save_code
arcanna-agents-mcp
workflows:
list_agentic_workflows,get_agentic_workflow_by_id,create_agentic_workflow,update_agentic_workflow,run_agentic_workflow,test_agentic_workflow,list_agent_tools,list_llm_providers,get_workflow_session,answer_workflow_decision,continue_workflow_session,stop_workflow_sessions
arcanna-rag-mcp
documents:
query_rag_documents,get_rag_document,upload_rag_documents,update_rag_document,delete_rag_document,approve_rag_document,reject_rag_document,retry_rag_document,get_rag_pipeline_statuscollections:
query_rag_collections,create_rag_collection,update_rag_collection,delete_rag_collection,create_rag_subcollection,update_rag_subcollection,delete_rag_subcollection,list_rag_tags
Breaking changes in 0.2.0
The single server was split into three and tools were renamed or replaced. Tool names referenced in roles, assistant tool settings or agentic workflows must be updated by hand:
Removed / renamed | Use instead |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Agentic tools moved from the arcanna server to arcanna-agents. execute_code now runs a saved code
block integration on a stored event (the inline test endpoint no longer exists); save_code saves through IaC.
Development
venv/bin/uv sync
.venv/bin/python -m pytest -q tests
.venv/bin/python -m pyright srcTools are generated from the Arcanna OpenAPI specs, then trimmed by hand:
Refresh the specs from a modular-framework checkout (see
scripts/dump_specs.py).Map the tool in
scripts/tool_map.py(server, module, operationId, scopes)..venv/bin/python scripts/gen_tools.pyappends a stub to the module; add it toexport_tools()and trim the docstring to: what it does, when to use it vs its neighbour, response shape, cost, and what not to use it for.tests/test_tools.pychecks mapping, scopes, descriptions, docstring length and the called endpoint.
This server cannot be deployed
Maintenance
Related MCP Connectors
Manage tickets, run agents and workflows, query tables, and search workspace knowledge.
Ask about your Kodem Security data and act on findings in plain language, with your permissions.
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceConnects AI agents with the CrowdStrike Falcon platform to enable intelligent security analysis, providing programmatic access to detections, incidents, threat intelligence, vulnerabilities, and other security capabilities for advanced security operations and automation.274MIT
- AlicenseNot gradedqualityDmaintenanceIntegrates SOAR (Security Orchestration, Automation and Response) capabilities into AI clients, enabling security playbook execution, event management, and threat intelligence queries. Provides a complete security incident response platform through natural language interactions.MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to operate a Splunk SOAR instance headlessly via its REST API, supporting container triage, playbook authoring and execution, and asset management.2MIT

UTMStack MCP Serverofficial
AlicenseBqualityBmaintenanceEnables AI assistants to drive the UTMStack SIEM/XDR platform for triaging alerts, searching logs, running SQL, managing incidents, inspecting agents, creating/deleting correlation rules, managing data filters, and running commands on endpoints.44MIT