# RocketCyber MCP

Integrates RocketCyber Managed SOC telemetry into AI workflows for alert triage, MTTR calculations, and device risk ranking. Built for MSP teams using chat interfaces.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/rocketcyber
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/rocketcyber-mcp

## What it does

This server connects your AI assistant directly to the RocketCyber Managed SOC API. It handles alert triage and computes incident MTTR metrics. The standard web console leaves these calculations out. Tool executions delegate directly to the companion `rocketcyber-cli` binary.

Avoid using the HTTP transport. The `--transport http` flag opens an unauthenticated port across all local interfaces. Any browser tab could query the server and read your telemetry. Keep execution restricted to standard `stdio`.

Installation uses the plugin marketplace or an automated shell script. Valid RocketCyber API keys are required for authentication. If the server cannot find the binary, point `ROCKETCYBER_CLI_PATH` directly to the executable.

## Requirements
- Environment variables: `ROCKETCYBER_API_TOKEN`, `ROCKETCYBER_BASE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- triage RocketCyber SOC security alerts from chat
- calculate mean time to resolution (MTTR) across incidents
- generate risk ranking reports for managed endpoints
- query posture metrics without opening the web console

## Example prompts
- Triage the latest high-severity alerts from RocketCyber
- Calculate our incident MTTR for the past thirty days
- Run `rocketcyber-cli` to list the top risk-ranked devices

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md