An MCP (Model Context Protocol) server for Rapid7. Allows Claude and other LLMs to query vulnerabilities, assets, and alerts directly from Rapid7 APIs.
概览
A unified MCP server for Rapid7's security platform — exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client. Ask natural-language questions across your entire Rapid7 environment — vulnerabilities, active incidents, compromised hosts — and get structured answers without writing a single API call. Set DEMO_MODE=true to explore all 26 tools against realistic fixture data. Clone, run, connect — no credentials required. Once connected to Claude, you can ask things like: "Which of my sites has the highest risk score?" "What are the critical vulnerabilities on the production web server, and is there already a remediation project for them?" "Is Log4Shell present anywhere in my environment? Show me the CVSS score and any available exploits." "Are there any open InsightIDR investigations right now? What's the highest priority one?
README
以下为原文 README 节选，完整内容请查看原文。
rapid7-mcp
A unified MCP server for Rapid7’s security platform — exposing InsightVM (vulnerability management), InsightIDR (SIEM/investigations), and Metasploit Pro (pentest telemetry) as tools for Claude, Cursor, and any MCP-compatible LLM client.
Ask natural-language questions across your entire Rapid7 environment — vulnerabilities, active incidents, compromised hosts — and get structured answers without writing a single API call.
Built with fastapi-mcp, FastAPI, and httpx.
No Rapid7 instance? Set
DEMO_MODE=trueto explore all 26 tools against realistic fixture data. Clone, run, connect — no credentials required.
What you can do
Once connected to Claude, you can ask things like:
“Which of my sites has the highest risk score?” “What are the critical vulnerabilities on the production web server, and is there already a remediation project for them?” “Is Log4Shell present anywhere in my environment? Show me the CVSS score and any available exploits.” “Are there any open InsightIDR investigations right now? What’s the highest priority one?” “Search our logs for any connections to this IP address: 185.220.101.1” “What active Metasploit sessions exist and what hosts were compromised?” “Give me a full security posture summary across sites, open incidents, and active sessions.”
The server translates these into API calls across InsightVM, InsightIDR, and Metasploit Pro and returns structured data that Claude can reason over, correlate, and summarize.
Architecture
Claude / Cursor / MCP Client
│ MCP (Streamable HTTP)
▼
┌───────────────────────────────────────────┐
│ FastAPI + fastapi-mcp :8000 │
│ │
│ InsightVM InsightIDR MSP │
│ ────────────── ────────── ───────── │
│ /sites /idr/invest. /workspcs │
│ /assets /idr/logs /sessions │
│ /asset_groups /idr/iocs /loot │
│ /vulnerabilities /tasks │
│ /scans │
│ /remediation_projects │
│ /reports │
│ │
│ /mcp ← MCP endpoint │
└──────┬──────────────┬──────────┬──────────┘
│ Basic Auth │ X-Api-Key│ Token
▼ ▼ ▼
InsightVM InsightIDR Metasploit安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"rapid7": {
"url": "http://localhost:8000/mcp"
}
}
}