RocketCyber MCP
MCP server for RocketCyber managed SOC — read-only access to accounts, agents, incidents, events, firewalls, apps, and security status.
🔗 Companion Plugin
Pair this MCP server with the RocketCyber plugin for skills, commands, and API knowledge alongside direct API access.
Installation
Run the MCP server with npx:
npx @wyre-technology/rocketcyber-mcp Or install the package:
npm install @wyre-technology/rocketcyber-mcp Claude Desktop Configuration
Add to your claude_desktop_config.json:
{
"mcpServers": {
"rocketcyber": {
"command": "npx",
"args": [
"@wyre-technology/rocketcyber-mcp"
],
"env": {
"ROCKETCYBER_API_KEY": "your-rocketcyber-api-key"
}
}
}
}Authentication
| Variable | Required | Description |
|---|---|---|
ROCKETCYBER_API_KEY | Yes | RocketCyber API key from Provider Settings > API tab |
ROCKETCYBER_REGION | No | Region: us (default) or eu |
Architecture
Flat tool exposure with lazy SDK initialization. All 10 tools available immediately (read-only).
Available Tools (10)
Tools are organized into 6 domains:
Account
View account information.
| Tool | Description |
|---|---|
rocketcyber_get_account | Get account info |
Incidents
View and triage security incidents.
| Tool | Description |
|---|---|
rocketcyber_list_incidents | List security incidents |
Agents
Monitor RocketAgent deployment and health.
| Tool | Description |
|---|---|
rocketcyber_list_agents | List monitored agents |
Events
View security events and summaries.
| Tool | Description |
|---|---|
rocketcyber_list_events | List security events |
rocketcyber_get_event_summary | Get event summary/stats |
Security Status
View firewall, app, Defender, and Office 365 status.
| Tool | Description |
|---|---|
rocketcyber_list_firewalls | List firewall devices |
rocketcyber_list_apps | List managed apps |
rocketcyber_get_defender | Get Defender status |
rocketcyber_get_office | Get Office 365 status |
Utilities
Connection testing.
| Tool | Description |
|---|---|
rocketcyber_test_connection | Test API connectivity |
Rate Limits
60 requests per minute. The underlying client library handles rate limiting automatically.