soar_mcp_server

Exposes Splunk SOAR as an MCP (Model Context Protocol) server endpoint. Claude Desktop, Claude Code, or any MCP-compatible AI client connects directly to SOAR and uses analyst-focused tools to read cases, artifacts, playbooks, and optionally write notes or run playbooks. Configure tools directly via the asset configuration checkboxes below.

{
  "mcpServers": {
    "soar_mcp_server": {
      "command": "uvx",
      "args": [
        "soar-mcp-server"
      ]
    }
  }
}

claude mcp add soar_mcp_server uvx soar-mcp-server

{
  "mcpServers": {
    "soar_mcp_server": {
      "command": "uvx",
      "args": [
        "soar-mcp-server"
      ]
    }
  }
}