IBM QRadar MCP Server - Official

An open-source Model Context Protocol (MCP) server implementation for IBM QRadar SIEM that enables AI agents to interact with QRadar SIEM data through standardized tools and protocols.

Overview

The QRadar MCP Server provides AI agents with standardized access to IBM QRadar SIEM capabilities, including offenses, events and flows, reference data, assets, analytics, configuration, and other security context.

The server can be deployed standalone using Docker or run locally for development. When used with IBM QRadar Investigation Assistant (QIA), the MCP Server can also be exposed directly through the QIA application using QRadar App Framework namespaces, enabling external MCP-compatible clients to connect without requiring deployment of a separate QRadar MCP application.

This enables integrations with MCP-compatible AI platforms and agents while keeping QRadar access and MCP capabilities within the QIA deployment model…

Project Structure

qradar-mcp/
├── client/            # QRadar REST API client
├── tools/             # MCP tools
├── resources/         # MCP resources
├── utils/             # Utilities (auth, logging, validation)
├── tests/             # Comprehensive test suite
├── server.py          # HTTP server entry point (Docker / uvicorn)
├── stdio_server.py    # stdio transport entry point (WxO local toolkit, Claude Desktop)
└── Dockerfile         # Container configuration

Features

• FastMCP Framework: Modern, async-first MCP server implementation with uvicorn (ASGI)
• MCP Protocol Compliance: Full implementation of Model Context Protocol specification
• 83 Tools: Comprehensive QRadar API coverage across read and write operations
  • Offense Management (12 tools) - List, retrieve, close, assign, and annotate offenses
  • Reference Data (19 tools) - Create, query, update, and delete reference sets, maps, and tables
  • Data Classification (13 tools) - Manage DSM event mappings, QID records, and categories
  • Ariel Search (8 tools) - Execute AQL queries, poll status, retrieve results, and manage saved searches
  • Config Management (9 tools) - Network hierarchy, staged networks, deploy, and user management
  • Analytics (6 tools) - Retrieve rules, building blocks, and custom actions
  • Log Sources (3 tools) - Query log source configurations and types
  • Network Services (5 tools) - DNS lookup, WHOIS lookup, and IP geolocation
  • Asset Management (2 tools) - List assets and properties
  • Forensics (2 tools) - Query forensics cases
  • QVM (2 tools) - Vulnerability and asset data
  • System Administration (2 tools) - System info and server listing
• Dynamic Resources: AQL field definitions, functions, generation guide, and API query syntax reference