広告掲載
MCP.so
ログイン
L

Lacework MCP Server

@shashwat-sec

リポジトリ

基本情報

カテゴリ

その他

トランスポート

stdio

作者

shashwat-sec

投稿者

Shashwat Singh

Lacework MCP Server について

概要はまだありません

#lacework#security#mcp#server#lacework-security

Lacework MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "lacework": {
      "command": "/path/to/lacework_mcp_server/.venv/bin/python",
      "args": [
        "/path/to/lacework_mcp_server/lacework_mcp_server.py"
      ]
    }
  }
}

Lacework MCP Server のツール

9

List alerts within an optional time range (supports relative times like `2h`, `last 2 hours`)

Search alerts with filters (severity, status, alert type) and flexible time inputs (`30m`, `last 2 hours`, `2024-06-01`)

Get detailed info for a specific alert (Details, Investigation, Events, RelatedAlerts, Integrations, Timeline, ObservationTimeline)

Shortcut – get the timeline for an alert

Shortcut – get investigation details for an alert

List entities (machines, IPs) associated with an alert

Get enriched context for a specific entity (VirusTotal, network activity, etc.)

Post a comment on an alert's timeline

Close an alert with a reason code

概要

What is Lacework Mcp Server?

An MCP server built with FastMCP that exposes Lacework API v2 alert operations as tools for AI agents and LLM integrations. Designed for security teams who want to query, investigate, and manage Lacework alerts through natural language interfaces.

How to use Lacework Mcp Server?

Clone the repo, set up a Python 3.10+ virtual environment, install dependencies with pip install -e ., and configure Lacework credentials via ~/.lacework.json or environment variables (LACEWORK_ACCOUNT, LACEWORK_KEY_ID, LACEWORK_SECRET). Run the server with python lacework_mcp_server.py for stdio (local) or with --transport sse / --transport streamable-http for remote HTTP access. Credentials can also be passed as tool parameters per request when running remotely.

Key features of Lacework Mcp Server

  • Nine alert‑focused tools: list, search, details, timeline, investigation, entities, comments, close.
  • Supports flexible time ranges (e.g., 2h, last 2 hours, specific dates).
  • Environment or config‑file based credential loading with fallback.
  • Per‑request credentials for multi‑tenant or remote scenarios.
  • Automatic token refresh using Lacework API v2 authentication.
  • Client caching reuses tokens across calls for the same account.
  • Multiple transport modes: stdio, SSE, Streamable HTTP.

Use cases of Lacework Mcp Server

  • List recent alerts within a custom time window.
  • Search alerts by severity, status, or alert type.
  • Retrieve full alert details including investigation and timeline.
  • Post comments or close alerts directly from an AI assistant.
  • Get enriched entity context (e.g., VirusTotal, network activity).

よくある質問

1

How do I configure Lacework credentials?

Two options: a config file at `~/.lacework.json` with `account`, `keyId`, `secret`; or environment variables `LACEWORK_ACCOUNT`, `LACEWORK_KEY_ID`, `LACEWORK_SECRET`. Environment variables take precedence.

2

Can I run the server remotely?

Yes. Use `--transport sse` or `--transport streamable-http` to serve over HTTP. Callers then pass `lacework_account`, `lacework_key_id`, and `lacework_secret` as optional parameters on each tool call.

3

What are the rate limits and time range constraints?

Lacework API v2 enforces 480 requests per hour per functionality. Time ranges are limited to a maximum of 7 days per request.

4

How does authentication work?

The server uses `POST /api/v2/access/tokens` to obtain tokens and automatically refreshes them as needed. Tokens are cached per account for reuse across calls.

5

What transports are supported for integrating with MCP clients?

The server supports stdio (for local use with Claude Desktop, VS Code), SSE (Server‑Sent Events), and Streamable HTTP. Remote clients connect via a URL like `http://your-server-host:8000/sse`.

コメント

「その他」の他のコンテンツ

MCP Toolbox for Databases

googleapis

MCP Toolbox for Databases is an open source MCP server for databases.

15.9K

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

Health by Dr Brad

Dr Brad Stanfield

Health by Dr Brad works out a health plan from your own results: which screening is due at your age, and evidence-based suggestions, each with the reason and the published guideline or study behind it. Your record is one

Sequential Thinking

modelcontextprotocol

Model Context Protocol Servers

88.2K
広告掲載