# LimaCharlie MCP **URL:** \ **Category:** Feature Requests\ **Tags:** ai\ **Created:** [April 17, 2025, 11:21am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274 "2025-04-17T11:21:35Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [April 17, 2025, 11:21am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/1 "2025-04-17T11:21:36Z")
LimaCharlie MCP would be a great start to allow developers to create and integrate AI SOC functionalities across all of LimaCharlie’s APIs and Python CLI/SDK. ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [April 19, 2025, 12:59am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/2 "2025-04-19T00:59:15Z")
You read my mind, it’s going to be my weekend. 🙂 We’re also rewriting the `ext-ai-agent-engine` to use the new Google Agent Development Kit. So lots of new AI Agent stuff coming soon. ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [April 22, 2025, 5:55pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/3 "2025-04-22T17:55:28Z")
Would you do me the honors to be the first external person to give it a try? 🙂 I’ve been using it internally with the rebuild of our ext-ai-agent-engine that I should be able to get out shortly. > **[MCP Server](https://docs.limacharlie.io/docs/mcp-server)** ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [April 23, 2025, 12:49am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/4 "2025-04-23T00:49:23Z")
Yes, I would love to test out the MCP Server 😃 ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [April 23, 2025, 12:53pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/5 "2025-04-23T12:53:43Z")
MCP server working! @maximelb Its awesome! I tried to set it up using OpenAI Agent SDK, works fine as well. Guess its just a matter of adding the capabilities now 🙌 ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [April 23, 2025, 12:57pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/6 "2025-04-23T12:57:28Z")
Nice! Is there a y capabilities you’d like to see before others? ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [April 23, 2025, 2:06pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/7 "2025-04-23T14:06:23Z")
Me personally, since I’m trying to create an AI SOC on top of LC, I think the following would be nice: The essentials maybe: -create/set/push D&R rules —\> can be combined with LC RAG Knowledge Base and the detection alert webhooks to expand on specific D&R rules -Seal and Isolate sensors Nice to haves: -create/set/push FP rules —\> automatically push the FP rules the same way, when we click the “Mark False Positive” button from the Detections module from the web GUI -Replay or LCQL (maybe) Not too sure but these are the main capabilities from the top of my head 😅 ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [April 23, 2025, 2:08pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/8 "2025-04-23T14:08:37Z")
Great, should be easy to add. ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [April 24, 2025, 4:11pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/9 "2025-04-24T16:11:49Z")
Hi @maximelb I was testing the get\_mitre\_report MCP tool, but keep getting this error: {“error”: “Failed to get JWT from API key oid= uid=None: No API key set”} Do I need to provide a UID as well? I was able to authenticate the MCPSSEServer session properly and use the other tools, but when I try to use the get\_mitre\_report tool, it keeps failing and giving me that response for some reason. Is there a specific way to hit the get\_mitre\_report tool? Thank you 😃 ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [April 24, 2025, 4:14pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/10 "2025-04-24T16:14:44Z")
Nah pretty sure it’s just not a helpful message after a re-auth where you’re missing a permission. That API required `dr.list` as a permission, can you check you have it? Will make a note to rework the SDK to make that error more obvious. ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [May 8, 2025, 5:08pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/11 "2025-05-08T17:08:45Z")
Hi @maximelb I’m seem to be having issues with the “isolate\_network” tool in the MCP. It returns me: 2025-05-09 00:03:47,275 - INFO - Calling MCP tool isolate\_network with parameters: {“sid”: “”} 2025-05-09 00:03:47,685 - INFO - HTTP Request: POST [https://mcp.limacharlie.io/messages/?session\_id=](https://mcp.limacharlie.io/messages/?session_id=)\ “HTTP/1.1 202 Accepted” 2025-05-09 00:03:47,750 - INFO - Raw result from ‘isolate\_network’ call: {‘tool’: ‘isolate\_network’, ‘status’: ‘success’, ‘data’: {}, ‘parameters\_used’: {‘sid’: ‘’}} But then in the LimaCharlie Dashboard, I don’t see the sensor being isolated. I also did a verification process using the “is\_isolated” after that “isolate\_network” tool call: 2025-05-09 00:03:47,750 - INFO - Calling MCP tool is\_isolated with parameters: {“sid”: “”} 2025-05-09 00:03:48,172 - INFO - HTTP Request: POST [https://mcp.limacharlie.io/messages/?session\_id=](https://mcp.limacharlie.io/messages/?session_id=)\“HTTP/1.1 202 Accepted” 2025-05-09 00:03:48,240 - INFO - Post-isolation verification check: {‘status’: ‘success’, ‘is\_isolated’: False, ‘sid’: ‘’} Not too sure what’s happening in the background, no error messages 😅 ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [May 8, 2025, 5:09pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/12 "2025-05-08T17:09:42Z")
PS: I removed the sensitive information, but all the SIDs were correct. ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [May 8, 2025, 5:14pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/13 "2025-05-08T17:14:36Z")
Further testing also shows that even when I manually isolate the sensor via the web GUI. Then run “is\_isolated” it still shows me FALSE. ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [May 8, 2025, 9:56pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/14 "2025-05-08T21:56:52Z")
When you run “is\_isolated”, that’s from the MCP too? Trying to narrow down if the issue is on Set or on Get. ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [May 9, 2025, 4:29am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/15 "2025-05-09T04:29:46Z")
Yeap, all was ran through the MCP ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [May 9, 2025, 3:22pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/16 "2025-05-09T15:22:03Z")
Ok cool, taking a look. ---
**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\ **Post date:** [May 9, 2025, 4:52pm UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/17 "2025-05-09T16:52:13Z")
So I tried to replicate and it worked for me. Would you be able to DM me the SID (SensorID) and timestamp of the box where you tried this so I can see from our logs what was happening? ---
**Author:** ![Timothy\_christ](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/timothy_christ/32/87_2.png) [@Timothy\_christ](https://community.limacharlie.com/u/Timothy_christ)\ **Post date:** [May 10, 2025, 3:35am UTC](https://community.limacharlie.com/t/limacharlie-mcp/274/18 "2025-05-10T03:35:12Z")
Hi @maximelb yea I think there was a mistake on my code. I was able to get it to work using a simple test script now. 😃