Skip to main content

Rapid7 InsightOps MCP Server

An MCP (Model Context Protocol) server that wraps the Rapid7 InsightOps REST API for log search and analysis. Designed for use with Devin Web (app.devin.ai) as an STDIO MCP server, enabling AI agents to search, query, and analyze production logs directly.

Region: EU only (eu.rest.logs.insight.rapid7.com). Other regions are not supported.

Installation

# From PyPI (once published)
pip install rapid7-mcp-server

# Or directly via uvx
uvx rapid7-mcp-server

# Or from source
pip install git+https://github.com/YOUR_ORG/rapid7-mcp-server.git

Devin Web Setup

  1. Open app.devin.ai and go to Settings > MCP Marketplace
  2. Click "Add Your Own"
  3. Paste this configuration:
{
  "transport": "STDIO",
  "command": "uvx",
  "args": ["rapid7-mcp-server"],
  "env_variables": {
    "RAPID7_API_KEY": "<your Rapid7 API key>"
  }
}
  1. Save. The server will start automatically when Devin uses any Rapid7 tool.

Environment Variables

Variable Required Description
RAPID7_API_KEY Yes Your Rapid7 InsightOps API key (read-only permission is sufficient)

If RAPID7_API_KEY is not set, the server starts but every tool returns a clear error message.

Available Tools

Tool Description
rapid7_list_logs List all available logs to discover log key UUIDs. Optional name filter.
rapid7_list_log_sets List all log sets. Optional name filter.
rapid7_query_log Search a single log using a LEQL query with time range, pagination.
rapid7_query_multiple_logs Search across multiple logs simultaneously (POST-based).
rapid7_query_log_set Search all logs within a log set by name or ID.
rapid7_get_context Get surrounding log lines before/after a specific log entry.
rapid7_download_logs Download raw log data as plain text (max 10 logs).
rapid7_search_trace High-level convenience: search for a traceId across multiple logs.

LEQL Quick Reference

LEQL (Log Entry Query Language) is used in the query parameter:

# Text search (case-insensitive substring)
where(error)
where(NullPointerException)

# Key-value search
where(traceId=abc-123-def)
where(statusCode>=400 AND statusCode<500)

# Regex search
where(/timeout.*connection/i)

# Boolean operators
where(error AND NOT healthcheck)
where(level=ERROR OR level=FATAL)

# Statistical queries (returns counts/aggregates, not log lines)
calculate(COUNT)
where(level=ERROR) calculate(COUNT)
where(statusCode>=500) calculate(COUNT) groupby(service)
calculate(AVERAGE:responseTime) groupby(endpoint)

Time Range Examples

Relative: last 5 minutes, last 1 hour, last 24 hours, last 7 days, yesterday, today

Absolute: Use from_timestamp and to_timestamp (UNIX milliseconds).

Development

# Install with dev dependencies
pip install -e ".[dev]"

# Run tests
pytest tests/

# Run the server locally (for testing)
RAPID7_API_KEY=your-key rapid7-mcp-server

License

MIT

Metadata

Release files for rapid7-mcp-server 0.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for rapid7-mcp-server 0.1.1
File Size Uploaded Provenance
rapid7_mcp_server-0.1.1.tar.gz 14.4 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for rapid7-mcp-server 0.1.1
File Interpreter ABI Platform
rapid7_mcp_server-0.1.1-py3-none-any.whl Python 3 none any Details

Total release size: 24.7 kB

Release files / rapid7_mcp_server-0.1.1.tar.gz

Download URL rapid7_mcp_server-0.1.1.tar.gz
Size 14.4 kB
Tags Source
SHA-256 checksum
How to use checksums
8c298eabae4e1af47c1e958669aaa2b7340a6caa107a5532f01586f1b79e8eca
BLAKE2b-256 checksum
How to use checksums
38473f15e221c2cbbe0e33c60f44d627dce74de0198dc9487080447722b3358a
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.13.7

Release files / rapid7_mcp_server-0.1.1-py3-none-any.whl

Download URL rapid7_mcp_server-0.1.1-py3-none-any.whl
Size 10.4 kB
Tags Python 3
SHA-256 checksum
How to use checksums
049c64963d52b8307c7ff32b11f1b7eacc99cb8e124ee35905621ee5e56031fb
BLAKE2b-256 checksum
How to use checksums
6792805a88c7f9fb16213a947a4bfb10550bbf7a4f4f01ccd41647f095506fa9
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.13.7

Security for rapid7-mcp-server 0.1.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Release history Release notifications | RSS feed

This release

0.1.1 This release

2 release files No provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page