MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.
Connect Runs on your machine
claude mcp add rocketcyber-mcp -e ROCKETCYBER_API_KEY=<ROCKETCYBER_API_KEY> -e ROCKETCYBER_CUSTOMER_ID=<ROCKETCYBER_CUSTOMER_ID> -e ROCKETCYBER_API_URL=<ROCKETCYBER_API_URL> -e MCP_TRANSPORT=<MCP_TRANSPORT> -e AUTH_MODE=<AUTH_MODE> -e LOG_LEVEL=<LOG_LEVEL> -- docker run -i --rm ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4
{
"mcpServers": {
"rocketcyber-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4"
],
"env": {
"ROCKETCYBER_API_KEY": "<ROCKETCYBER_API_KEY>",
"ROCKETCYBER_CUSTOMER_ID": "<ROCKETCYBER_CUSTOMER_ID>",
"ROCKETCYBER_API_URL": "<ROCKETCYBER_API_URL>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"AUTH_MODE": "<AUTH_MODE>",
"LOG_LEVEL": "<LOG_LEVEL>"
}
}
}
}
{
"mcpServers": {
"rocketcyber-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4"
],
"env": {
"ROCKETCYBER_API_KEY": "<ROCKETCYBER_API_KEY>",
"ROCKETCYBER_CUSTOMER_ID": "<ROCKETCYBER_CUSTOMER_ID>",
"ROCKETCYBER_API_URL": "<ROCKETCYBER_API_URL>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"AUTH_MODE": "<AUTH_MODE>",
"LOG_LEVEL": "<LOG_LEVEL>"
}
}
}
}
{
"servers": {
"rocketcyber-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4"
],
"env": {
"ROCKETCYBER_API_KEY": "<ROCKETCYBER_API_KEY>",
"ROCKETCYBER_CUSTOMER_ID": "<ROCKETCYBER_CUSTOMER_ID>",
"ROCKETCYBER_API_URL": "<ROCKETCYBER_API_URL>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"AUTH_MODE": "<AUTH_MODE>",
"LOG_LEVEL": "<LOG_LEVEL>"
}
}
}
}
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
ROCKETCYBER_API_KEYRequired, secret | RocketCyber API key for authenticating to the Managed SOC API |
ROCKETCYBER_CUSTOMER_IDRequired | RocketCyber customer (tenant) identifier |
ROCKETCYBER_API_URLOptional | RocketCyber API base URL — override only if using a non-default region |
MCP_TRANSPORTOptional | Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting. |
AUTH_MODEOptional | Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway. |
LOG_LEVELOptional | Log verbosity: debug, info, warn, error |
Details
| Package | ghcr.io/wyre-technology/rocketcyber-mcp:v1.5.4 (OCI, stdio) |
| First published | 13 Aug 2026 |
| Last updated | 13 Aug 2026 |
| Registry name | io.github.wyre-technology/rocketcyber-mcp |
More ai and media servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
