Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@rapid7-mcp search logs for failed login attempts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that provides AI assistants with access to Rapid7 InsightIDR, a cloud-native SIEM for modern detection and response. Query investigations, search logs with LEQL, analyze alerts, track assets, monitor user behavior, and manage threat intelligence.
Search and filter investigations by status, priority, assignee, date range
Create, update, and manage investigation lifecycle
Add comments and retrieve associated alerts
Build investigation timelines
Execute LEQL (Log Entry Query Language) queries across log sets
List available log sets (Firewall, DNS, DHCP, Endpoint, Cloud, Active Directory)
Retrieve individual log entries and aggregate statistics
LEQL syntax reference and examples
List and filter alerts by severity, type, status, date
Get full alert details with evidence and indicators
Update alert status (open, investigating, closed)
Evidence extraction for investigation
Search endpoints by hostname, IP, OS, agent status
Full asset details: software inventory, vulnerabilities, agent info
Recent activity: logins, processes, network connections
Search user accounts across the organization
Activity analysis: login patterns, locations, accessed assets
Risky user identification with behavior scoring
Anomaly detection and alert correlation
IOC management: IPs, domains, file hashes
Add indicators to threat library
Search for threat indicator matches across logs
List and manage saved LEQL queries
Create reusable queries with descriptions
LEQL syntax helper with examples
Related MCP server: Megaraptor MCP
┌────────────────────────────────────────┐
│ MCP Client (LLM) │
└──────────────┬─────────────────────────┘
│ MCP Protocol (stdio)
┌──────────────▼─────────────────────────┐
│ rapid7-mcp server │
│ │
│ ┌──────────┐ ┌────────────────────┐ │
│ │ Prompts │ │ Resources │ │
│ │ 4 guides │ │ templates, LEQL, │ │
│ │ │ │ detection rules │ │
│ └──────────┘ └────────────────────┘ │
│ │
│ ┌──────────────────────────────────┐ │
│ │ Tools │ │
│ │ investigations │ logs │ alerts │ │
│ │ assets │ users │ threats│queries │ │
│ └──────────────┬───────────────────┘ │
│ │ │
│ ┌──────────────▼───────────────────┐ │
│ │ InsightIDR REST Client │ │
│ │ (client.ts + config.ts) │ │
│ └──────────────┬───────────────────┘ │
└──────────────────┼─────────────────────┘
│ HTTPS
┌──────────────────▼─────────────────────┐
│ Rapid7 InsightIDR Platform API │
│ https://<region>.api.insight.rapid7│
└────────────────────────────────────────┘git clone https://github.com/solomonneas/rapid7-mcp.git
cd rapid7-mcp
npm install
npm run buildSet environment variables:
export RAPID7_API_KEY="your-api-key"
export RAPID7_REGION="us" # us, eu, ca, au, ap
export RAPID7_ORG_ID="your-org-id" # optionalOr use a .env file:
RAPID7_API_KEY=your-api-key
RAPID7_REGION=us
RAPID7_ORG_ID=your-org-id{
"mcpServers": {
"rapid7": {
"command": "node",
"args": ["path/to/rapid7-mcp/dist/index.js"],
"env": {
"RAPID7_API_KEY": "your-api-key",
"RAPID7_REGION": "us"
}
}
}
}Add to your openclaw.json:
{
"mcp": {
"servers": {
"rapid7": {
"type": "stdio",
"command": "node",
"args": ["/path/to/rapid7-mcp/dist/index.js"],
"env": {
"RAPID7_API_KEY": "your-api-key",
"RAPID7_REGION": "us"
}
}
}
}
}Tool | Description |
| List/filter investigations by status, priority, assignee |
| Get full investigation details with timeline |
| Create new investigation |
| Update status, assignee, disposition |
| Add comment/note to investigation |
| Get alerts linked to an investigation |
| Execute LEQL queries against log sets |
| List available log sets |
| Get specific log entry by ID |
| Aggregate statistics for a time range |
| Get alerts with severity/type/status filters |
| Full alert details with evidence |
| Update alert status |
| Get evidence/indicators from an alert |
| Search endpoints by hostname, IP, OS |
| Full asset details with software/vulns |
| Recent activity for an asset |
| Search user accounts |
| User behavior analytics |
| Users with abnormal behavior scores |
| List IOCs in threat library |
| Add new IOC |
| Search for IOC matches in logs |
| List saved LEQL queries |
| Save a LEQL query for reuse |
| LEQL syntax reference and examples |
-- Find all blocked traffic from a source
where(source_address = 10.0.0.1 AND action = BLOCK)
-- Top talkers by connection count
groupby(source_address) calculate(count) sort(desc)
-- Failed logins for a specific user
where(user = "admin" AND result = FAILED_LOGIN)
-- HTTP errors by URL
where(status >= 400) groupby(url) calculate(count)
-- DNS queries to suspicious domains
where(query CONTAINS "malware") groupby(query) calculate(count)
-- Outbound connections on non-standard ports
where(destination_port != 80 AND destination_port != 443 AND direction = OUTBOUND)Prompt | Description |
| Guided alert investigation workflow |
| Search for IOC across all log sources |
| Analyze user activity for anomalies |
| Build chronological incident timeline |
URI | Description |
| Common investigation templates |
| LEQL syntax and examples |
| Built-in detection rule catalog |
npm run build # Compile TypeScript
npm run dev # Watch mode
npm run test # Run tests
npm run lint # Lint checkMIT
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Search your knowledge bases from any AI assistant using hybrid RAG.
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
Search companies, enrich contacts, and reveal emails and phones from your AI agent.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/solomonneas/rapid7-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server