"Assistance with Cyber Security Investigations" matching MCP servers:

Enables secure interaction between LLMs and MCP tools by applying zero-trust security controls, including sensitive data masking, file system protection, and policy enforcement.

Enables transparent security for any MCP server by intercepting tool calls, blocking prompt injection attempts, masking PII in responses, and writing immutable audit logs.

A Model Context Protocol server that provides AI assistants access to AWS CloudWatch Logs, enabling browsing, searching, summarizing, and correlating logs across multiple AWS services.

An MCP server for Security Onion Community Edition that provides 21 read and write tools for SOC operations, including event querying, alert management, detection tuning, PCAP retrieval, and agent enrollment, without requiring a Pro license.

Gives AI assistants access to F6 XDR alerts, incidents, emails, files, hosts, and audit logs via query-language search, with tools for counting records, inspecting available fields and filters, and marking events.

Enables Windows Event Log (EVTX) analysis by wrapping Hayabusa, exposing scan and rule retrieval tools.

Enables secure MCP traffic by filtering threats with a 3-stage detection pipeline, applying RBAC policies, and redacting sensitive data in real-time via an SSE-inspecting proxy.

Enables natural language analysis of network packet captures, including protocol detection, flow analysis, and security threat identification, integrated with AI assistants.

Enables Claude sessions to conduct RCA investigations by planning from identifiers, correlating IDs, analyzing HAR evidence, querying generic sources, and validating draft RCA envelopes.

AI-powered threat intelligence server with real-time alert monitoring and multi-source IOC analysis, enabling security investigations directly in Claude Desktop.

A read-only MCP server for Rollbar investigations, enabling listing configured environments and making authenticated GET requests to the Rollbar API.

Enables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.

MCP server for the Production Master incident-investigation service, enabling any MCP client to drive investigations via tool calls with pass-through authentication.

Enables triggering, streaming, and reviewing autonomous production-incident investigations directly from your editor, with human-gated approval for any mutating actions.

A unified MCP server for Rapid7's security platform, exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client.

Enables governed, read-only investigations of Amazon Athena access logs by searching exact user, IP, or correlation indicators and summarizing activity by correlation ID, with parameterized queries, validation, and result limits.

Bridges AI assistants with Wazuh SIEM infrastructure, providing natural language access to security alerts, vulnerability analysis, CVE databases, and network documentation for security operations.

Enables AI agents to query Zabbix for current problems, host investigations, alert triage, metrics, and maintenance operations through task-shaped tools with bounded JSON output and human-approval safeguards for any changes.

This is a secure SSH MCP server providing enterprise-grade SSH management with AI assistance, MFA, RBAC, encryption, and compliance auditing.

An MCP server for querying Grafana Loki directly with a discovery-first workflow — labels, values, series, and LogQL queries without requiring Grafana.