securitahguy/rapid7-mcp
Developer tools이 페이지는 AI로 자동 번역되었습니다. 기술적인 세부 사항은 원문을 확인하세요. 원문 보기
An MCP (Model Context Protocol) server for Rapid7. Allows Claude and other LLMs to query vulnerabilities, assets, and alerts directly from Rapid7 APIs.
개요
A unified MCP server for Rapid7's security platform — exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client. Ask natural-language questions across your entire Rapid7 environment — vulnerabilities, active incidents, compromised hosts — and get structured answers without writing a single API call. Set DEMO_MODE=true to explore all 26 tools against realistic fixture data. Clone, run, connect — no credentials required. Once connected to Claude, you can ask things like: "Which of my sites has the highest risk score?" "What are the critical vulnerabilities on the production web server, and is there already a remediation project for them?" "Is Log4Shell present anywhere in my environment? Show me the CVSS score and any available exploits." "Are there any open InsightIDR investigations right now? What's the highest priority one?
README
원문 README의 일부입니다. 원문 보기.
rapid7-mcp
A unified MCP server for Rapid7’s security platform — exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client.
Ask natural-language questions across your entire Rapid7 environment — vulnerabilities, active incidents, compromised hosts — and get structured answers without writing a single API call.
Built with fastapi-mcp, FastAPI, and httpx.
No Rapid7 instance? Set
DEMO_MODE=trueto explore all 26 tools against realistic fixture data. Clone, run, connect — no credentials required.
What you can do
Once connected to Claude, you can ask things like:
“Which of my sites has the highest risk score?” “What are the critical vulnerabilities on the production web server, and is there already a remediation project for them?” “Is Log4Shell present anywhere in my environment? Show me the CVSS score and any available exploits.” “Are there any open InsightIDR investigations right now? What’s the highest priority one?” “Search our logs for any connections to this IP address: 185.220.101.1” “What active Metasploit sessions exist and what hosts were compromised?” “Give me a full security posture summary across sites, open incidents, and active sessions.”
The server translates these into API calls across InsightVM, InsightIDR, and Metasploit Pro and returns structured data that Claude can reason over, correlate, and summarize.
Architecture
Claude / Cursor / MCP Client
│ MCP (Streamable HTTP)
▼
┌───────────────────────────────────────────┐
│ FastAPI + fastapi-mcp :8000 │
│ │
│ InsightVM InsightIDR MSP │
│ ────────────── ────────── ───────── │
│ /sites /idr/invest. /workspcs │
│ /assets /idr/logs /sessions │
│ /asset_groups /idr/iocs /loot │
│ /vulnerabilities /tasks │
│ /scans │
│ /remediation_projects │
│ /reports │
│ │
│ /mcp ← MCP endpoint │
└──────┬──────────────┬──────────┬──────────┘
│ Basic Auth │ X-Api-Key│ Token
▼ ▼ ▼
InsightVM InsightIDR Metasploit설치
This server does not publish a one-line install command.
Open the repository installation guide MCP 초보자라면? mcpskill.org 가이드부터 시작하세요 →설정
{
"mcpServers": {
"rapid7": {
"url": "http://localhost:8000/mcp"
}
}
}