Bridge your AI agents with LiteSOC forensics. The official Model Context Protocol server gives tools like Cursor, Claude, and VS Code direct access to your live security alerts — without leaving your editor.
What you need before you start
Node.js ≥ 18
Required to run the MCP server via npx
LiteSOC API Key
list_alerts, analyze_alert, and resolve_incident tools require a Pro or Enterprise plan. The get_recent_events tool is available on all plans.Choose your AI editor. The server runs automatically via npx — no global install needed.
Open Cursor MCP settings
Go to Cmd+Shift+P → Cursor Settings → Tools & MCP → enable MCP Servers.
Add the LiteSOC server
Click Add MCP Server and paste the following configuration:
{
"mcpServers": {
"litesoc": {
"command": "npx",
"args": ["-y", "@litesoc/mcp-server"],
"env": {
"LITESOC_API_KEY": "lsk_live_your_api_key_here"
}
}
}
}Replace the API key
Swap lsk_live_your_api_key_here with your real key from dashboard/settings.
Verify the connection
Open the Cursor composer and type @LiteSOC list my open alerts. You should see a response with live data from your project.
The MCP server exposes 4 tools your AI agent can call autonomously.
List all critical open alerts.
Analyze alert <id> and tell me if the actor used a VPN.
Show me the last 20 auth.login_failed events.
Resolve alert <id> — confirmed false positive, internal IP.
Once connected, your AI agent can reason over your security posture in natural language.
“@LiteSOC analyze my open alerts and suggest a fix.”
Fetches all open alerts, cross-references forensic data, and returns prioritized remediation steps.
“Are there any new threats detected in the last 10 minutes?”
The agent calls get_recent_events and list_alerts, then summarizes what's happening right now.
“Show me auth.login_failed events from Russia in the last hour.”
Filters recent events by event name and cross-references geolocation data to build a threat picture.
“Resolve alert abc-123 — confirmed false positive, internal office IP.”
Calls resolve_incident with your notes. The action is logged to the immutable SOC 2 audit trail.
“Is this user acting suspiciously? Their ID is user_456.”
Searches events by actor ID to identify anomalous patterns — unusual hours, new devices, geo jumps.
The MCP server inherits all of LiteSOC's data isolation and privacy guarantees.
Tenant isolation
Every query is scoped to your organization. Cross-tenant access is enforced at the API level.
No credential storage
The API key is read from the environment at runtime and never written to disk or logs.
PII redaction
API keys, emails, and tokens are automatically masked in all log output.
SOC 2 audit trail
Every resolve_incident call writes an immutable audit log entry meeting CC7.2 requirements.
Grab your API key from settings and you'll be up in under 2 minutes.