A cybersecurity MCP server connects an AI assistant to a security tool, so analysts can query alerts, findings or campaign results in plain language. This guide groups 17 servers by team function and states, for each one, what it exposes, who maintains it, and whether it only reads or can also change things.
Key takeaways
- Many major security vendors now publish an MCP server, but "official" ranges from a supported product to a vendor-maintained open source preview.
- Read or write scope matters more than the vendor name: some servers only query data, others can change policies, users or detection rules.
- Remote servers with OAuth sign-in inherit the user's existing permissions; local servers usually run on API keys you have to scope yourself.
- Community servers (MITRE ATT&CK, Ghidra) are useful for research but need a code review before they touch production data.
- Human risk is the gap in most lists: Arsen MCP brings phishing simulation and awareness results into the same assistant, and launches the next campaign from it.
What is a cybersecurity MCP server?
The Model Context Protocol (MCP) is an open standard that lets AI assistants use tools exposed by other software. A cybersecurity MCP server is the connector a security vendor (or the community) builds so that an assistant such as Claude, ChatGPT or Copilot can search logs, read detections or pull findings from that product.
Each server exposes a set of tools. A tool can read data (list alerts, run a query) or write data (isolate a host, change a policy). The client asks the user to connect, the server checks the credentials, and the assistant calls the tools it needs to answer a question.
For a security team, the value is speed and cross-referencing. One question can pull an identity log from Okta, a detection from CrowdStrike and a phishing score from Arsen, without exports or API projects.
How were these MCP servers selected?
Every server below was checked on its vendor's documentation, repository or package page in November 2026. We kept servers that a security team would deploy against its own tools, and grouped them by team function rather than by popularity.
For each entry we state five things, because they decide whether a server can be approved:
- What it exposes: the data and actions the tools cover.
- Maintainer: an official vendor product, a vendor-maintained open source project, or a community project.
- Read or write: whether the tools can change anything in the product.
- Hosting and authentication: a remote server with sign-in, or a local server with API keys.
- Limits: preview status, licensing or setup constraints stated by the vendor.
Arsen, the publisher of this guide, appears first because it is the only human risk entry. The order is not a ranking.
What should you vet before you connect an MCP server?
Treat every MCP server as a new integration with its own trust boundary. In its May 2026 guidance on MCP security design considerations, the NSA recommends vetting each MCP project, applying least privilege, validating tool parameters, sandboxing execution and logging every tool call into existing monitoring.
Vet before you connect
Which MCP server covers human risk?
Human risk is missing from most security MCP lists. Arsen MCP is the human risk entry in this guide: it brings phishing simulation and awareness results into the assistant, and launches campaigns and awareness programs from it.
Arsen MCP
Best for: security and awareness teams who want to follow and run their phishing simulations and training programs from the AI assistant they already use.
Arsen MCP is an official MCP server that connects AI assistants to Arsen advanced phishing simulations, training programs and security awareness data. It reads organizations, simulation and training results, campaigns and campaign summaries, and prepares phishing campaigns and awareness programs that launch once the user approves them, limited to the organizations each user can access. Users connect from their Arsen settings and sign in with their Arsen account, SSO and MFA included.
Which MCP servers help SOC and SIEM teams?
SOC teams get the most immediate value from MCP: natural-language search over logs and incidents, without writing every query by hand. Splunk, Microsoft and Google all publish servers for their SIEM platforms.
Splunk MCP Server
Best for: SOC teams on Splunk Enterprise or Splunk Cloud who want assistants to search and explain SPL.
The MCP Server for Splunk Platform is a Splunk app, documented at version 2.1. It exposes search, index, alert and knowledge object tools, AI Assistant tools that generate, explain and optimize SPL, and Observability tools, with Enterprise Security tools documented separately. Splunk states that its run query tool is meant for safe, non-destructive searches.
Learn more about Splunk MCP Server →
Microsoft Sentinel MCP
Best for: Microsoft security teams that want natural-language hunting over the Sentinel data lake.
Microsoft Sentinel MCP is in preview and fully hosted by Microsoft. Its data exploration collection searches tables and retrieves data from the Sentinel data lake, and an entity analyzer scores URLs, users and applications. Access runs through Microsoft Entra ID with the Security Reader role, while the Knowledge Objects server, in private preview, can create and update objects.
Learn more about Microsoft Sentinel MCP →
Google Security Operations MCP
Best for: Google SecOps customers who want detection, SOAR and threat intelligence in one assistant.
Google's MCP security project provides servers for Security Operations (detection, investigation and hunting), SecOps SOAR (cases and response actions) and Security Command Center. Google recommends its fully managed remote server for SecOps, while the local servers authenticate with Google Cloud credentials and, for SOAR, an app key.
Learn more about Google Security Operations MCP →
Which MCP servers cover endpoint detection and response?
CrowdStrike and SentinelOne both maintain open source MCP servers for their platforms. Neither is presented as a supported product yet, so plan them for pilots rather than production workflows.
CrowdStrike Falcon MCP
Best for: Falcon customers exploring AI-assisted triage of detections, hosts and threat intelligence.
falcon-mcp is maintained by CrowdStrike as open source and is in public preview, and CrowdStrike states it is not an official product and advises against production deployments before version 1.0. It spans 24 modules, including detections, hosts, intel, IOC, NG-SIEM and Spotlight. Some modules can create, update or delete resources such as IOCs, exclusions and policies, and authentication uses Falcon API client credentials.
Learn more about CrowdStrike Falcon MCP →
SentinelOne Purple AI MCP
Best for: SentinelOne customers who want read access to alerts, vulnerabilities and inventory from any assistant.
The Purple AI MCP server is maintained by SentinelOne as open source, with the same caveat that it is not an official product. It exposes Purple AI investigations, PowerQuery analytics, alerts, vulnerabilities, misconfigurations and asset inventory. Authentication uses a SentinelOne console token, which SentinelOne recommends scoping to Account or Site rather than Global.
Learn more about SentinelOne Purple AI MCP →
Which MCP servers help cloud and edge security teams?
Cloud teams use MCP to question their inventory and posture in plain language. Wiz and Cloudflare both run remote servers with OAuth sign-in.
Wiz MCP Server
Best for: cloud security teams who want assistants to search issues, inventory and exposure in Wiz.
Wiz introduced its MCP server in preview in April 2025. It gives natural-language access to cloud inventory, configurations and security issues, with use cases tied to Wiz Defend investigations and Wiz Code remediation. The server is remote and users sign in with their own Wiz identity through OAuth.
Learn more about Wiz MCP Server →
Cloudflare MCP servers
Best for: teams running Cloudflare for edge, Zero Trust or SaaS security.
Cloudflare runs its own remote MCP servers. The Cloudflare API server covers the full Cloudflare API, Zero Trust included, with OAuth sign-in or an API token, and the permissions granted during OAuth decide what it can change. A separate Cloudflare One CASB server helps find SaaS security misconfigurations.
Learn more about Cloudflare MCP servers →
Which MCP server covers identity and access?
Identity is where write access carries the most risk, since a tool can create or deactivate accounts. Okta's server shows how a vendor can add guardrails for that.
Okta MCP Server
Best for: identity teams who want to audit users, groups, apps and system logs from an assistant.
The Okta MCP Server is an Okta open source project that reads and manages users, groups, applications, policies and system logs. It runs locally and authenticates with the Device Authorization Grant for interactive use or Private Key JWT for automation, with tokens limited to the scopes you grant.
Learn more about Okta MCP Server →
Which MCP servers help application security teams?
AppSec servers run where developers already use AI: in the IDE or coding agent. Snyk and Semgrep both scan code locally from the assistant.
Snyk MCP
Best for: development teams who want AI coding assistants to scan the code they generate.
Snyk ships its MCP server inside the Snyk CLI, started with the "snyk mcp" command. It exposes code, open source, IaC, container, SBOM and secret scans, plus package health checks. It runs locally, and Snyk notes that open source scans may run ecosystem tools such as Maven or Gradle on the machine.
Semgrep MCP
Best for: AppSec teams that write custom rules and want them available to coding agents.
Semgrep's MCP server scans code with registry or custom rules, returns abstract syntax trees and, with an AppSec Platform token, fetches findings. The standalone package is deprecated and the server now ships in the main Semgrep binary. A hosted endpoint exists but Semgrep labels it experimental.
Learn more about Semgrep MCP →
Which MCP server covers vulnerability and exposure management?
Exposure data is a natural fit for assistants: questions like "which internet-facing assets carry critical vulnerabilities?" take one prompt instead of a dashboard filter.
Tenable Hexa AI MCP Server
Best for: Tenable One customers who want to search exposure data and act on it from their own AI client.
The Tenable Hexa AI MCP Server is a remote server with about 90 tools to search assets, investigate vulnerabilities, build dashboards, tag assets and launch scans. It authenticates with Tenable API keys and requires a Tenable One Foundation or Advanced license.
Learn more about Tenable Hexa AI MCP Server →
Which MCP servers help threat intelligence teams?
Threat intelligence servers enrich what other tools surface: an indicator, a malware family, a threat actor's techniques.
Google Threat Intelligence MCP (VirusTotal)
Best for: analysts who enrich indicators, malware and threat actors during investigations.
The Google Threat Intelligence server, part of the same Google MCP security project, answers questions about indicators of compromise, malware and threat actors. It authenticates with a VirusTotal API key, which makes it the usual route for VirusTotal lookups from an assistant.
Learn more about Google Threat Intelligence MCP →
MITRE ATT&CK MCP (community)
Best for: detection engineers and threat hunters mapping activity to ATT&CK.
MITRE does not publish an MCP server. Community projects fill the gap, such as mitre-mcp, maintained by Montimage, which lists techniques, tactics, threat groups, software and mitigations across the Enterprise, Mobile and ICS domains. It runs locally, caches ATT&CK data and needs no authentication.
Which MCP servers help offensive security and research?
These servers act on real targets or binaries, so they belong in lab environments with clear authorization.
Burp Suite MCP Server
Best for: pentesters who want an assistant to review proxy history and send test requests in Burp.
PortSwigger publishes the Burp Suite MCP Server extension for Burp Suite Professional and Community. It can send HTTP requests, search proxy history, create Repeater tabs, send requests to Intruder and edit configuration. A configurable target approval system controls which hosts the assistant can reach.
Learn more about Burp Suite MCP Server →
GhidraMCP (community)
Best for: malware analysts and reverse engineers working in Ghidra.
GhidraMCP is an open source community project, created by LaurieWired, that lets an assistant decompile binaries, list classes, imports and exports, and rename methods and data. It installs as a Ghidra extension and runs locally, including in headless mode.
Which MCP server connects observability and security monitoring?
Observability platforms often hold security signals too. Datadog exposes them in the same MCP server as its observability tools.
Datadog MCP Server
Best for: teams running Cloud SIEM, workload or code security in Datadog alongside their observability data.
The remote Datadog MCP Server includes a security toolset covering security signals, findings, indicators of compromise, detection rules and WAF controls. Many of those tools can change data, such as triaging signals, editing detection rules or updating denylists, and each one lists the Datadog permission it requires.
Learn more about Datadog MCP Server →
How does Arsen MCP bring human risk data into your AI assistant?
Arsen MCP lets security teams run their awareness program from their AI assistant, on their own Arsen data. Questions such as "How did our last phishing campaign go?" or "Which groups should we prioritize this quarter?" return click, credential and report rates, phishing scores, coverage and the groups to focus on. A request such as "Plan a follow-up campaign for these groups next Tuesday" returns a campaign ready to approve.
- Read and write, with approval: the assistant reads results and prepares campaigns and awareness programs, and nothing launches until the user approves it.
- Same access as in Arsen: each request is checked against the user's current permissions, and figures stay at group level.
- One-click connection: users connect from their Arsen settings and sign in with their Arsen account, SSO and MFA included.
- Built for partners too: a partner managing several organizations can query all of them in one conversation.
- Works next to the rest of the stack: combined with an identity MCP server, phishing scores can be cross-checked with MFA status in the same conversation.
The assistant reads the same campaign results that teams follow in the human risk dashboard. Claude connects with a Connect to Claude button, and other assistants that support remote MCP servers with sign-in can connect too. The step-by-step guide on how to use Arsen MCP covers each connection method and the first prompts to try, and why use Arsen MCP details what it changes for CISOs, GRC teams and MSPs.
Connect Arsen to your AI assistant →
How do these cybersecurity MCP servers compare?
The table summarizes maintainer, access and hosting as stated by each vendor in November 2026. "Not stated" means the vendor's documentation does not say.
| Server | Function | Maintainer | Access | Hosting | Authentication |
|---|---|---|---|---|---|
| Arsen MCP | Human risk | Official | Read and write with approval | Remote | OAuth, Arsen account |
| Splunk MCP Server | SOC and SIEM | Official | Not stated | Splunk app | Not stated |
| Microsoft Sentinel MCP | SOC and SIEM | Official, preview | Read and write | Remote | Microsoft Entra ID |
| Google SecOps MCP | SOC and SIEM | Google project | Not stated | Remote or local | Google Cloud |
| CrowdStrike Falcon MCP | Endpoint | Vendor open source | Read and write | Local | API client |
| SentinelOne Purple AI MCP | Endpoint | Vendor open source | Read only | Local | Console token |
| Wiz MCP Server | Cloud | Official | Not stated | Remote | OAuth |
| Cloudflare MCP | Edge and Zero Trust | Official | Read and write | Remote | OAuth or token |
| Okta MCP Server | Identity | Vendor open source | Read and write | Local | OAuth (Okta app) |
| Snyk MCP | AppSec | Official | Scans only | Local CLI | Snyk login |
| Semgrep MCP | AppSec | Official | Scans only | Local | Optional token |
| Tenable Hexa AI MCP | Exposure management | Official | Read and write | Remote | API keys |
| Google Threat Intelligence MCP | Threat intelligence | Google project | Not stated | Local | VirusTotal key |
| mitre-mcp | Threat intelligence | Community | Read only | Local | None |
| Burp Suite MCP | Offensive security | Official extension | Read and write | Local | Burp extension |
| GhidraMCP | Reverse engineering | Community | Read and write | Local | None |
| Datadog MCP Server | Observability and SIEM | Official | Read and write | Remote | Not stated |
Frequently asked questions about cybersecurity MCP servers
-
MCP adds a new integration path, so it carries the same risks as any connector: excessive permissions, untrusted code and data leaving through the assistant. The NSA's May 2026 guidance recommends vetting servers, applying least privilege, validating tool parameters and logging every tool call. Read-only servers with OAuth sign-in reduce the exposure.
-
Yes. CrowdStrike maintains falcon-mcp, an open source server in public preview that covers detections, hosts, intel, IOCs, NG-SIEM and other Falcon modules. CrowdStrike states that it is not an official product yet and advises against production use before version 1.0.
-
Some are, many are not. SentinelOne's Purple AI MCP and mitre-mcp only read data, while Okta, Tenable, Datadog, CrowdStrike and Arsen MCP expose tools that change users, scans, detection rules, policies or campaigns. Arsen MCP asks for the user's approval before a campaign launches. Check each tool's scope and the role of the credentials before connecting.
-
An official server is published and supported by the vendor of the product it connects to. Vendor-maintained open source servers come from the vendor but without product support, and community servers are written by third parties. Community code deserves a review before it touches production data.
-
Any MCP-compatible client can connect, but support varies by server. Tenable lists Claude Desktop, Claude Code, Cursor and VS Code with GitHub Copilot, and Arsen MCP connects to Claude today, with other assistants that support remote MCP servers and sign-in. Check each vendor's documentation for the clients it has tested.
