Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@axur-mcp Get details for ticket h7dw97"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server for the Axur cybersecurity platform. Provides read-only access to ticket data, enabling AI assistants to search, inspect, and analyze security incidents.
Ticket Search & Retrieval — filter, paginate, and fetch tickets by key
Ticket Details — field values, comments, snapshots, attachments, lifecycle state, takedown options
Ticket Statistics — counts by status, incidents by threat type, takedown/treatment metrics, uptime analysis, global and market-segment benchmarks
Related MCP server: mcp-movidesk
ticketsSearch and retrieve tickets.
Action | Description |
| Search/filter tickets with pagination and sorting |
| Get a single ticket by key |
| Get multiple tickets by comma-separated keys |
| Get ticket change history |
| List all supported ticket types |
ticket_detailsGet detailed information for a specific ticket.
Action | Description |
| Ticket field values (status, type, domain, IP, etc.) |
| Comments, descriptions, evidence messages |
| Detection snapshots (domain info, ISP, content, digital location) |
| List attachments for a detection |
| Available state transitions |
| Takedown options and eligibility |
| Full ticket timeline |
ticket_statsRetrieve ticket statistics and metrics.
Action | Description |
| Ticket count by status (requires |
| Incidents grouped by threat type |
| Takedown success rate, median time to notification |
| Internal treatment success rate and metrics |
| Resolution uptime distribution (buckets: <1d, 2d, 5d, etc.) |
| Treatment uptime distribution |
| Median incidents across all Axur customers (13-month trend) |
| Mean incidents across all Axur customers |
| Median incidents for your market segment |
| Mean incidents for your market segment |
Node.js 18+
An Axur API token (get one here)
git clone https://github.com/Just5ky/axur-mcp.git
cd axur-mcp
npm install
npm run buildcp .env.example .env
# Edit .env and add your Axur API tokenAdd to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"axur": {
"command": "node",
"args": ["/path/to/axur-mcp/dist/index.js"],
"env": {
"AXUR_API_TOKEN": "your_token_here"
}
}
}
}# Run directly
AXUR_API_TOKEN=your_token node dist/index.jsOnce connected to an AI assistant:
"Show me all open phishing tickets from this month"
"Get details for ticket h7dw97"
"What are the takedown metrics for the last 30 days?"
"How do our incident numbers compare to the market segment median?"
"List all ticket types supported by the platform"
This server covers the read-only Axur Platform ticket APIs:
tickets-api — ticket search, retrieval, stats
tickets-core — field values, ticket types
tickets-texts — textual data (comments, evidence)
tickets-snapshots — detection snapshots
tickets-attachments — attachment listing
tickets-lifecycle — lifecycle state inspection
tickets-takedown — takedown status inspection
tickets-timeline — timeline history
The Axur API enforces a rate limit of 60 requests per minute on stats endpoints. The server surfaces 429 errors directly — plan queries accordingly.
MIT
Retrieve detailed ticket information from Axur: field values, texts/comments, detection snapshots, attachments, lifecycle transitions, takedown options, and timeline.
Inputs: action (required), ticketKey (required), detectionIndex.
Search, retrieve, and inspect Axur platform tickets. Actions: list (filter/search tickets), get (single ticket), bulk_get (multiple tickets by keys), history (ticket change history), types (list supported ticket types).
Inputs: action (required), page, order, filter, +6 more.
Retrieve Axur ticket statistics: counts by status, incidents by threat type, takedown/treatment metrics and uptime, global and market-segment incident medians/means. Note: from/to date range must not exceed 90 days.
Inputs: action (required), to, from, assets, +4 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 3 tools
The tools are mostly distinct: 'tickets' handles search, list, and summary retrieval; 'ticket_details' provides deep single-ticket information; 'ticket_stats' covers statistics. However, there is potential overlap between 'tickets' get action and 'ticket_details', as both retrieve ticket info, but descriptions suggest different detail levels.
All tool names follow a consistent 'ticket_' prefix with descriptive suffixes: 'tickets', 'ticket_details', 'ticket_stats'. The naming is predictable and uses snake_case uniformly.
With only 3 tools, the count is at the lower borderline. While the 'tickets' tool bundles multiple actions (list, get, bulk_get, history, types), the overall set feels slightly thin for a platform that likely involves CRUD and lifecycle management.
The tools are purely read-only (retrieve, search, stats). Missing operations to create, update, delete, or take action on tickets (e.g., takedown) is a significant gap for a security platform, limiting agent ability to respond to threats.
Remote MCP server for managing Muninx tickets, messages, ticket search, and support analytics.
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
Secure MCP server for exploring incwo CRM data, documents, and email workflows.
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
