RocketCyber MCP — Claude Code MCP server: what it does, how to install
Integrates RocketCyber Managed SOC telemetry into AI workflows for alert triage, MTTR calculations, and device risk ranking. Built for MSP teams using chat interfaces.
Open on GitHubWhat RocketCyber MCP does
This server connects your AI assistant directly to the RocketCyber Managed SOC API. It handles alert triage and computes incident MTTR metrics. The standard web console leaves these calculations out. Tool executions delegate directly to the companion rocketcyber-cli binary.
Avoid using the HTTP transport. The --transport http flag opens an unauthenticated port across all local interfaces. Any browser tab could query the server and read your telemetry. Keep execution restricted to standard stdio.
Installation uses the plugin marketplace or an automated shell script. Valid RocketCyber API keys are required for authentication. If the server cannot find the binary, point ROCKETCYBER_CLI_PATH directly to the executable.
What it helps with
- triage RocketCyber SOC security alerts from chat
- calculate mean time to resolution (MTTR) across incidents
- generate risk ranking reports for managed endpoints
- query posture metrics without opening the web console
Example prompts for the agent
- Triage the latest high-severity alerts from RocketCyber
- Calculate our incident MTTR for the past thirty days
- Run
rocketcyber-clito list the top risk-ranked devices
How to install RocketCyber MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about RocketCyber MCP
How to install RocketCyber MCP in Claude Code?
In Claude Code, run /plugin marketplace add Servosity/msp-skills followed by /plugin install rocketcyber@msp-skills.
What does RocketCyber MCP do?
It provides AI agents with tools to triage Managed SOC alerts, calculate resolution metrics, and score endpoint vulnerabilities via the RocketCyber API.
Why is HTTP transport mode discouraged?
The current HTTP mode has no password protection and listens on all interfaces, exposing telemetry to browser attacks. The developers require using stdio transport instead.
