AI-SOC-Agent

SamiGPT acts as an MCP server that exposes security investigation and response capabilities as tools for AI agents, LLM tools, and automated workflows. It connects to various security tooling like case management systems (TheHive, IRIS), SIEMs (Elastic), EDR platforms, and threat intelligence sources, enabling automated triage, investigation, and enrichment via the Model Context Protocol. You can run SamiGPT in two modes: as an MCP Server that directly serves MCP-compliant tools, or in conjunction with the AI Controller web interface that uses the cursor-agent binary for command execution. To use the MCP server, configure your MCP-enabled tool to point at the SamiGPT server (e.g., the Python module path when running locally). When connected, you can issue MCP-enabled commands to create and manage cases, fetch SIEM events, enrich indicators with CTI data, and orchestrate multi-step workflows across SOC tiers.

Prerequisites:

• Python 3.9 or higher
• pip (comes with Python)
• Optional: virtual environment support (venv) for isolation

Setup steps:

1. Clone the repository:

git clone <repository-url>
cd SamiGPT

2. Create and activate a virtual environment:

python3 -m venv venv
# macOS/Linux
source venv/bin/activate
# Windows
venv\Scripts\activate

3. Install dependencies:

pip install --upgrade pip
pip install -r requirements.txt

4. Run the MCP server:

python -m src.mcp.mcp_server

5. (Optional) Verify the server is listening and accessible from MCP clients and the web UI if configured.

Configure integrations in config.json or via the web UI as needed.

Tips and common considerations:

• The MCP server supports connecting to multiple tools (TheHive, IRIS, Elastic, OpenCTI, Claude Desktop, Cursor, etc.). Ensure proper network access and credentials are configured for each integration.
• If you plan to use the Cursor-based workflow, you may reference the example MCP configuration for Cursor, including cwd and Python module invocation.
• When running in production, consider containerizing the server or deploying with a process manager to manage restarts and logs.
• Keep dependencies up to date and monitor the MCP endpoints for changes in vendor APIs.
• Ensure it is running in a secure environment and limit exposed endpoints to trusted clients only.