Lacework

An MCP (Model Context Protocol) server built with FastMCP that exposes Lacework API v2 alert operations as tools for AI agents and LLM integrations.

Quick Start (New Machine Setup)

# 1. Clone the repo
git clone <repo-url>
cd lacework_mcp_server

# 2. Create a virtual environment (Python 3.10+)
python3 -m venv .venv
source .venv/bin/activate

# 3. Install dependencies
pip install -e .
# or manually:
# pip install fastmcp httpx

# 4. Configure Lacework credentials (pick one)

# Option A – Config file
cat > ~/.lacework.json <<'EOF'
{
  "account": "yourcompany.lacework.net",
  "keyId": "YOUR_ACCESS_KEY_ID",
  "secret": "YOUR_SECRET_KEY"
}
EOF

# Option B – Environment variables
export LACEWORK_ACCOUNT="yourcompany"
export LACEWORK_KEY_ID="YOUR_ACCESS_KEY_ID"
export LACEWORK_SECRET="YOUR_SECRET_KEY"

# Environment variables take precedence over the config file.

# 5. Run the server
python lacework_mcp_server.py

Tools

Tool	Description
list_alerts	List alerts within an optional time range (supports relative times like 2h, last 2 hours)
search_alerts	Search alerts with filters (severity, status, alert type) and flexible time inputs (30m, last 2 hours, 2024-06-01)
get_alert_details	Get detailed info for a specific alert (Details, Investigation, Events, RelatedAlerts, Integrations, Timeline, ObservationTimeline)
get_alert_timeline	Shortcut – get the timeline for an alert
get_alert_investigation	Shortcut – get investigation details for an alert
get_alert_entities	List entities (machines, IPs) associated with an alert
get_alert_entity_details	Get enriched context for a specific entity (VirusTotal, network activity, etc.)
post_alert_comment	Post a comment on an alert's timeline
close_alert	Close an alert with a reason code

Running

Standalone (stdio – local)

source .venv/bin/activate
python lacework_mcp_server.py

Remote (SSE / Streamable HTTP)

Run the server on a remote host so AI agents can connect over HTTP and pass credentials per-request:

# SSE transport (default host 0.0.0.0, port 8000)
python lacework_mcp_server.py --transport sse --port 8000

# Streamable HTTP transport
python lacework_mcp_server.py --transport streamable-http --host 0.0.0.0 --port 9000

When running remotely, callers pass Lacework credentials as tool parameters instead of relying on server-side config:

{
  "name": "search_alerts",
  "arguments": {
    "start_time": "last 2 hours",
    "severity": "Critical",
    "lacework_account": "mycompany",
    "lacework_key_id": "MY_KEY_ID",
    "lacework_secret": "MY_SECRET"
  }
}

All three credential fields (lacework_account, lacework_key_id, lacework_secret) are optional on every tool. When omitted, the server falls back to its local config (env vars / ~/.lacework.json). Clients for different Lacework accounts are cached so tokens are reused across calls.

With Claude Desktop / VS Code

Add to your MCP settings (e.g. ~/.claude/claude_desktop_config.json or .vscode/mcp.json):

Local (with ~/.lacework.json present):

{
  "mcpServers": {
    "lacework": {
      "command": "/path/to/lacework_mcp_server/.venv/bin/python",
      "args": [
        "/path/to/lacework_mcp_server/lacework_mcp_server.py"
      ]
    }
  }
}

Local (without ~/.lacework.json – pass creds via env):

{
  "mcpServers": {
    "lacework": {
      "command": "/path/to/lacework_mcp_server/.venv/bin/python",
      "args": [
        "/path/to/lacework_mcp_server/lacework_mcp_server.py"
      ],
      "env": {
        "LACEWORK_ACCOUNT": "yourcompany",
        "LACEWORK_KEY_ID": "YOUR_KEY_ID",
        "LACEWORK_SECRET": "YOUR_SECRET"
      }
    }
  }
}

Remote (server running elsewhere via SSE):

{
  "mcpServers": {
    "lacework": {
      "url": "http://your-server-host:8000/sse"
    }
  }
}

For remote servers, credentials are passed as tool parameters on each call (lacework_account, lacework_key_id, lacework_secret).

API Reference

Based on the Lacework API v2 documentation:

• Authentication: Uses POST /api/v2/access/tokens with automatic token refresh
• Alerts: Full CRUD via /api/v2/Alerts endpoints
• Rate limits: 480 requests/hour per functionality
• Time ranges: Max 7 days per request; default is last 24 hours