Logpoint MCP Server

This repository implements production-ready MCP server endpoints for Logpoint SIEM with support for n8n and Claude integrations.

Features

• POST /getalloweddata for allowed configuration data
• POST /getsearchlogs to start and fetch search results
• Incident API endpoints for retrieving, updating, and closing incidents
• Alert Rule API endpoints with JWT bearer authentication
• Repo and user-defined list endpoints
• HTTP and email notification settings endpoints
• n8n webhook integration endpoint
• Claude incident summary integration endpoint
• MCP server (app/mcp_server.py) exposing the incident/search actions, threat intel lookups, MITRE ATT&CK reference, and Jira/email tools as MCP tools for an LLM triage agent (see MCP Server below)

Run locally

1. Create a Python environment:

   python3 -m venv .venv
   source .venv/bin/activate
   pip install -r requirements.txt
   

2. Copy env example and customize production settings:

   cp .env.example .env
   

3. Configure your .env values before starting the server.

4. Start the server:

   uvicorn app.main:app --host 0.0.0.0 --port 8000 --log-level info
   

5. Example credentials:

   • username: John
   • secret_key: a1b2c3d4e5f6g7h8i9j0k1

Production and Integration Ready

• Environment-driven configuration via .env
• CORS enabled for allowed origins
• /health status endpoint
• /integration/n8n/alert for n8n webhooks
• /integration/claude/incident-summary for Claude prompt-ready incident summaries

Environment variables

The server loads configuration from .env or environment variables using Pydantic.

JWT_SECRET=a1b2c3d4e5f6g7h8i9j0k1
JWT_ALGORITHM=HS256
ALLOWED_ORIGINS=["*"]
ENVIRONMENT=production
ALLOWED_USERS=John:a1b2c3d4e5f6g7h8i9j0k1

Integration examples

n8n webhook payload example:

curl -X POST http://localhost:8000/integration/n8n/alert \
  -H "Content-Type: application/json" \
  -d '{"alert_id":"abc123","severity":"high"}'

Claude incident summary example:

curl -X POST http://localhost:8000/integration/claude/incident-summary \
  -H "Content-Type: application/json" \
  -d '{"incident_id":"abc123","name":"Suspicious login","risk_level":"high","status":"unresolved","assigned_to":"admin"}'

MCP Server

app/mcp_server.py exposes the Guardsix triage actions as MCP tools, so an LLM (Claude/OpenAI via n8n's AI Agent + MCP Client Tool node, or Claude Desktop) can call them directly instead of n8n hardcoding the request sequence.

Tools exposed:

Tool	Purpose
get_incidents	Fetch incidents in a time range
get_incident_data	Fetch correlated log rows for one incident
search_logs / fetch_search_results	Start/poll a Guardsix search
add_incident_comment	Note an analyst decision (false-positive path)
assign_incident	Assign an incident to a user/group
resolve_incident / close_incident / reopen_incident	Incident lifecycle actions
get_users	List incident users/groups for assignment
lookup_virustotal_tool / lookup_abuseipdb_tool / lookup_misp_tool	Threat intel reputation (mocked)
mitre_attack_lookup	Ground technique IDs against a local ATT&CK reference
create_jira_ticket_tool	Open a Jira case for a confirmed true positive (mocked)
send_email_tool	Notify the SOC team (mocked)

Run it:

# stdio - Claude Desktop / MCP CLI clients
python -m app.mcp_server

# SSE - n8n's MCP Client Tool node
python -m app.mcp_server --transport sse

# Streamable HTTP
python -m app.mcp_server --transport streamable-http

Incident/search tools require the same username/secret_key credentials as the REST API (see example credentials above). Threat intel, Jira, and email tools are mocked (app/integrations.py) — swap those function bodies for real VirusTotal/AbuseIPDB/MISP/Jira/SMTP calls once API keys are available.

JWT Token Generator

python token_generator.py --sub admin --scope "user:read alertrules:write logsources:read alertrules:read search:read search:write" --secret a1b2c3d4e5f6g7h8i9j0k1