RISKEN MCP Server

What is RISKEN MCP Server?

The RISKEN MCP Server is a Model Context Protocol (MCP) server that integrates with RISKEN APIs, enabling advanced automation and interaction capabilities for developers and tools. It provides tools and resources for managing security findings and alerts via AI assistants.

How to use RISKEN MCP Server?

Run the server locally using Docker or deploy on Google Cloud Run with Terraform. Configure your MCP client (Claude Desktop, Cursor) with a JSON configuration that specifies the Docker image and environment variables RISKEN_ACCESS_TOKEN and RISKEN_URL. The server supports both stdio and Streamable HTTP transports.

Key features of RISKEN MCP Server

• Search and query RISKEN findings with filters.
• Archive resolved findings with optional notes.
• Search and monitor alert status in RISKEN.
• Retrieve full finding content via resource URIs.
• Support for both Organization and Project access tokens.
• Built-in OAuth2.1 support with external Identity Providers.

Use cases of RISKEN MCP Server

• Check active alerts in RISKEN and monitor their status.
• Search, analyze, and review findings including explanations and remediation steps.
• Archive resolved findings to maintain a clean security posture.
• Integrate RISKEN security data into AI-driven workflows.

FAQ from RISKEN MCP Server

What are the prerequisites to run the server?

You need Docker installed and running, plus a valid RISKEN Access Token. The server is distributed as a Docker image.

How do I connect to a remote RISKEN MCP Server?

Deploy the server on Google Cloud Run using Terraform, then connect via a proxy (e.g., mcp-remote) because most MCP clients only support stdio connections natively.

What authentication methods are supported?

The server supports two methods: direct token authentication using RISKEN_ACCESS_TOKEN (Organization or Project token) and OAuth2.1 Third-Party Authorization with an external Identity Provider.

Can I search findings with different statuses and scores?

Yes. The search_finding tool supports filtering by status (all, active, pending), score ranges (Low, Medium, High, Critical), data source, resource name, and more.

Where can I run the RISKEN MCP Server?

It can run locally via Docker (stdio or HTTP) or be deployed to Google Cloud Run. The server also supports Streamable HTTP for remote connections.