rapid7

This MCP server exposes Rapid7 InsightIDR log querying capabilities via the MCP framework. It allows you to query logs within a given logset over a specified time window using natural language or LEQL filters, paginate results, and optionally target specific logsets by name. The server also supports listing available logsets, and you can poll the status of long-running queries. Use the provided tools to construct queries with time ranges in ISO8601 format and, when needed, refine results with filters or LEQL expressions. For production deployments, configure the RAPID7_API_KEY and RAPID7_BASE_URL environment variables to securely authorize and direct requests to the Rapid7 EU API (or another region by adjusting the base URL).

Typical usage flow:

• Start the MCP server (node mcp-server.js) after setting environment variables.
• Use queryRapid7Logset or queryRapid7LogsetByName to fetch logs within a window, with optional perPage and query parameters.
• Use listRapid7Logsets to discover available logsets and their IDs.
• If a long-running query is started, use pollRapid7Query with the returned queryId to monitor progress and retrieve results when complete.

Prerequisites:

• Node.js installed (v14+ recommended)
• Access to Rapid7 InsightIDR API and a valid API key
• Optional: a local clone of this MCP server repository

Installation steps:

1. Clone the repository: git clone https://github.com/your-org/rapid7-mcp-server.git cd rapid7-mcp-server

2. Install dependencies: npm install

3. Configure environment variables (example):

   • RAPID7_API_KEY=your-api-key-here
   • RAPID7_BASE_URL=https://eu.rest.logs.insight.rapid7.com

   You can set these in a local .env file (if using a runner that loads it) or export them in your shell before starting the server.

4. Run the server: node mcp-server.js

5. (Optional) Run tests: npm test

Tips and notes:

• Do not commit API keys to version control. Use environment variables or a secure vault.
• The RAPID7_BASE_URL defaults to the EU region. To switch regions, update this value to the appropriate base URL for US, CA, AU, AP, etc.
• Ensure the Rapid7 API key has permissions to query logs and access the selected logsets.
• When using listRapid7Logsets, you can discover logset IDs and names to feed into queryRapid7Logset.
• Handle ISO8601 datetime formats strictly; the server converts them to UNIX timestamps for queries.
• If you encounter authentication errors, verify that the API key is valid and has not expired, and confirm network access to the Rapid7 API endpoint.