incident-response
13 servers · 618★ total
Vigil - a 100% OpenSource AI system for machine-speed network defense
Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
Curated + scored map of official MCP servers and agents for DevOps, Cloud, SRE, and Platform Engineering — every entry rated on production access, approval gates, and audit evidence.
MCP server that gives LLM agents read-only shell access over SSH. Powers Fawdy (fawdy.com)
MCP server bridging Kali and FlareVM for automated Windows malware analysis. 48 tools, 5 prompts, 5 resources, composite playbooks (triage, behavioral, unpack, persistence audit).
Agentic-DART — autonomous detection & response agent. Architecture-first, not prompt-first. Starts as agentic DFIR; designed to expand toward agentic SOC and beyond.
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
MCP server for self-hosted Sentry: issues, events, releases, users, org stats, and project diagnostics for AI assistants.
Community MCP server that exposes Coroot incidents and health summaries as read-only tools for AI assistants (not an official Coroot product).
AI-driven DFIR framework: an MCP server that turns Claude Code into an autonomous digital-forensics analyst on SANS SIFT - correlates disk + memory evidence, enforces a deterministic evidence-provenance gate, and produces auditable, hash-chained investigation reports.
Model Context Protocol (MCP) server for Icinga 2 Core, Icinga Web, Icinga Director and the Linuxfabrik monitoring-plugins catalog.
Code-enforced incident-response agent that investigates SigNoz alerts, publishes evidence-backed root-cause claims, and gates every action behind a safety policy. Built for Agents of SigNoz hackathon.