Back to Browse

Rocketcyber MCP Server

Developer ToolsLow Risk10.0MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.

About

MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.

Security Report

10.0
Low Risk10.0Low Risk

Valid MCP server (2 strong, 4 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.

10 files analyzed · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

RocketCyber API key for authenticating to the Managed SOC APIRequired

Environment variable: ROCKETCYBER_API_KEY

RocketCyber customer (tenant) identifierOptional

Environment variable: ROCKETCYBER_CUSTOMER_ID

RocketCyber API base URL — override only if using a non-default regionOptional

Environment variable: ROCKETCYBER_API_URL

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.Optional

Environment variable: MCP_TRANSPORT

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.Optional

Environment variable: AUTH_MODE

Log verbosity: debug, info, warn, errorOptional

Environment variable: LOG_LEVEL

Documentation

View on GitHub

From the project's GitHub README.

rocketcyber-mcp

MCP (Model Context Protocol) server for the RocketCyber Managed SOC platform. Provides read-only access to RocketCyber security data through 10 tools and 3 resources.

Features

  • 10 read-only tools covering all RocketCyber API resources
  • 3 MCP resources for quick data access
  • Dual transport: stdio (default) and HTTP Streamable
  • Lazy SDK initialization on first tool call
  • Winston logger with all output routed to stderr
  • Connection test tool for validating credentials

One-Click Deployment

[!IMPORTANT] Before you click: this server depends on @wyre-technology/node-rocketcyber, which is hosted on the GitHub Packages npm registry. GitHub Packages has no anonymous access — even though the package is public, every npm install needs a token. The cloud builder runs npm install for you, so you must give it one, or the build fails with npm error 401 Unauthorized ... npm.pkg.github.com.

  1. Create a GitHub Personal Access Token with the read:packages scope (classic token). Any GitHub account works — you do not need to be a member of the wyre-technology org to read its public packages.
  2. Add it as a build variable when prompted by the deploy flow:
    • Cloudflare Workers → set a build variable named NODE_AUTH_TOKEN to your PAT (Workers → Settings → Build → Variables and Secrets).
    • DigitalOcean App Platform → set an encrypted env var named GITHUB_TOKEN with scope Build Time to your PAT (the Dockerfile reads it for the install).

Deploy to DO

Deploy to Cloudflare Workers

Installation

This project depends on @wyre-technology/node-rocketcyber, published to the GitHub Packages npm registry, which requires a token even for public packages. Authenticate once, then install:

# Authenticate npm to GitHub Packages (token needs the read:packages scope)
export NODE_AUTH_TOKEN=$(gh auth token)   # or a PAT with read:packages

npm install
npm run build

The repo's .npmrc already points the @wyre-technology scope at GitHub Packages and reads the token from NODE_AUTH_TOKEN, so no further config is needed.

Configuration

Environment VariableRequiredDefaultDescription
ROCKETCYBER_API_KEYYes-RocketCyber API key
ROCKETCYBER_REGIONNousAPI region: us or eu
MCP_TRANSPORTNostdioTransport type: stdio or http
MCP_HTTP_PORTNo8080HTTP port (when using http transport)
MCP_HTTP_HOSTNo0.0.0.0HTTP host (when using http transport)
LOG_LEVELNoinfoLog level: error, warn, info, debug
LOG_FORMATNosimpleLog format: json or simple

Usage

Claude Desktop (stdio)

Add to your Claude Desktop configuration (claude_desktop_config.json):

{
  "mcpServers": {
    "rocketcyber": {
      "command": "node",
      "args": ["/path/to/rocketcyber-mcp/dist/entry.js"],
      "env": {
        "ROCKETCYBER_API_KEY": "your-api-key"
      }
    }
  }
}

HTTP Transport

ROCKETCYBER_API_KEY=your-api-key MCP_TRANSPORT=http npm start

Tools

ToolDescription
rocketcyber_test_connectionTest the connection to RocketCyber API
rocketcyber_get_accountGet account information
rocketcyber_list_agentsList monitored agents/endpoints
rocketcyber_list_incidentsList security incidents
rocketcyber_list_eventsList security events
rocketcyber_get_event_summaryGet event summary/statistics
rocketcyber_list_firewallsList firewall devices
rocketcyber_list_appsList managed apps
rocketcyber_get_defenderGet Windows Defender status
rocketcyber_get_officeGet Office 365 status

Resources

URIDescription
rocketcyber://accountAccount information
rocketcyber://incidentsSecurity incidents
rocketcyber://agentsMonitored agents/endpoints

Development

# Install dependencies
npm install

# Run in development mode
npm run dev

# Build
npm run build

# Start production server
npm start

License

Apache-2.0

Reviews

No reviews yet

Be the first to review this server!