anysoar

One interface for AI agents to operate any SOAR platform, with guardrails built in.

Agents talk to anysoar; anysoar translates to whichever SOAR sits underneath through a per-vendor driver. Swapping SOARs means swapping a driver, not rewriting agents. Every action goes through a policy layer: reads run freely, writes wait for a person's approval, destructive actions are blocked, everything is audited, and a kill switch stops it all.

Status: pre-alpha. Expect breaking changes. Source, docs and a one-command demo: https://github.com/ag3ntsc4rn/anysoar

Install

pip install anysoar                       # models, driver interface, policy layer, mock SOAR
pip install "anysoar[mcp]"                # + the MCP server (anysoar-mcp)
pip install "anysoar[shuffle]"            # + the Shuffle driver
pip install "anysoar[tines]"              # + the Tines driver
pip install "anysoar[thehive]"            # + the TheHive driver
pip install "anysoar[testing]"            # + the contract test suite for driver authors

Python 3.12 or newer.

What's in it

• Drivers: a mock SOAR with a synthetic phishing scenario, Shuffle, Tines and TheHive (alerts, cases, and enrichment by Cortex analyzers). SwitchableDriver switches between SOARs while agents keep running. Other packages can add drivers through the anysoar.drivers entry point group.
• OCSF data model: alerts are Detection Findings, cases are Incident Findings, indicators are observables (OCSF 1.9.0), whatever the SOAR.
• Policy layer: GuardedDriver wraps any driver with approvals (from the MCP client or an approval service over HTTP), an audit log and a kill switch.
• MCP server: anysoar-mcp offers each SOAR operation as a tool to any MCP client.
• Driver contract tests: anysoar.testing.DriverContract, which every driver passes.

Use it from Python

The mock driver needs no SOAR:

import asyncio

from anysoar.drivers.mock import MockDriver
from anysoar.interface import CaseQuery
from anysoar.models import IncidentFindingStatusId, Observable, ObservableTypeId
from anysoar.policy import GuardedDriver


async def main() -> None:
    # GuardedDriver applies the policy: reads run, writes would need an approver.
    async with GuardedDriver(MockDriver()) as soar:
        open_cases = await soar.list_cases(
            CaseQuery(status_ids=frozenset({IncidentFindingStatusId.NEW}))
        )
        for case in open_cases.items:
            print(case.metadata.uid, case.message)

        sender = Observable(type_id=ObservableTypeId.EMAIL_ADDRESS, value="it-support@example.net")
        result = await soar.enrich_indicator(sender)
        print(result.observable.reputation)


asyncio.run(main())

Use ShuffleDriver(url, api_key) from anysoar.drivers.shuffle for Shuffle, TinesDriver(url, api_key) from anysoar.drivers.tines for Tines, or TheHiveDriver(url, api_key) from anysoar.drivers.thehive for TheHive; the rest of the code stays the same.

Use it from an MCP client

{
  "mcpServers": {
    "anysoar": {
      "command": "uvx",
      "args": ["--from", "anysoar[mcp]", "anysoar-mcp"]
    }
  }
}

The agent gets one tool per operation the SOAR supports, plus describe_soar. Write actions ask you in your MCP client, or in a web console with anysoar-mcp --approver http. Run anysoar-mcp --help for the options, including --driver mock,shuffle,thehive,tines and --policy.

Learn more

• Repository and full README
• The end-to-end demo
• Writing a driver
• Building an approval service
• Changelog

Licensed under Apache 2.0.