anysoar

One interface for AI agents to operate any SOAR platform, with guardrails built in.

Agents talk to anysoar; anysoar translates to whichever SOAR sits underneath through a per-vendor driver. Swapping SOARs means swapping a driver, not rewriting agents. Every action goes through a policy layer: reads run freely, writes wait for a person's approval, destructive actions are blocked, everything is audited, and a kill switch stops it all.

Status: pre-alpha. Expect breaking changes. Source, docs and a one-command demo: https://github.com/ag3ntsc4rn/anysoar

Install

pip install anysoar                       # models, driver interface, policy layer, mock SOAR
pip install "anysoar[mcp]"                # + the MCP server (anysoar-mcp)
pip install "anysoar[shuffle]"            # + the Shuffle driver
pip install "anysoar[tines]"              # + the Tines driver
pip install "anysoar[thehive]"            # + the TheHive driver
pip install "anysoar[testing]"            # + the contract test suite for driver authors

Python 3.12 or newer.

What's in it

• Drivers: a mock SOAR with a synthetic phishing scenario, Shuffle, Tines and TheHive (alerts, cases, and enrichment by Cortex analyzers). SwitchableDriver switches between SOARs while agents keep running.
• OCSF data model: alerts are Detection Findings, cases are Incident Findings, indicators are observables (OCSF 1.9.0), whatever the SOAR.
• Policy layer: GuardedDriver wraps any driver with approvals (from the MCP client or an approval service over HTTP), an audit log and a kill switch.
• MCP server: anysoar-mcp offers each SOAR operation as a tool to any MCP client.
• Driver contract tests: anysoar.testing.DriverContract, which every driver passes.

Use it from Python

The mock driver needs no SOAR:

import asyncio

from anysoar.drivers.mock import MockDriver
from anysoar.interface import CaseQuery
from anysoar.models import IncidentFindingStatusId, Observable, ObservableTypeId
from anysoar.policy import GuardedDriver


async def main() -> None:
    # GuardedDriver applies the policy: reads run, writes would need an approver.
    async with GuardedDriver(MockDriver()) as soar:
        open_cases = await soar.list_cases(
            CaseQuery(status_ids=frozenset({IncidentFindingStatusId.NEW}))
        )
        for case in open_cases.items:
            print(case.metadata.uid, case.message)

        sender = Observable(type_id=ObservableTypeId.EMAIL_ADDRESS, value="it-support@example.net")
        result = await soar.enrich_indicator(sender)
        print(result.observable.reputation)


asyncio.run(main())

Use ShuffleDriver(url, api_key) from anysoar.drivers.shuffle for Shuffle, TinesDriver(url, api_key) from anysoar.drivers.tines for Tines, or TheHiveDriver(url, api_key) from anysoar.drivers.thehive for TheHive; the rest of the code stays the same.

Use it from an MCP client

{
  "mcpServers": {
    "anysoar": {
      "command": "uvx",
      "args": ["--from", "anysoar[mcp]", "anysoar-mcp"]
    }
  }
}

The agent gets one tool per operation the SOAR supports, plus describe_soar. Write actions ask you in your MCP client, or in a web console with anysoar-mcp --approver http. Run anysoar-mcp --help for the options, including --driver mock,shuffle,thehive,tines and --policy.

Learn more

• Repository and full README
• The end-to-end demo
• Writing a driver
• Building an approval service
• Changelog

Licensed under Apache 2.0.