Rapid7 InsightOps MCP Server
An MCP (Model Context Protocol) server that wraps the Rapid7 InsightOps REST API for log search and analysis. Designed for use with Devin Web (app.devin.ai) as an STDIO MCP server, enabling AI agents to search, query, and analyze production logs directly.
Region: EU only (
eu.rest.logs.insight.rapid7.com). Other regions are not supported.
Installation
# From PyPI (once published)
pip install rapid7-mcp-server
# Or directly via uvx
uvx rapid7-mcp-server
# Or from source
pip install git+https://github.com/YOUR_ORG/rapid7-mcp-server.git
Devin Web Setup
- Open app.devin.ai and go to Settings > MCP Marketplace
- Click "Add Your Own"
- Paste this configuration:
{
"transport": "STDIO",
"command": "uvx",
"args": ["rapid7-mcp-server"],
"env_variables": {
"RAPID7_API_KEY": "<your Rapid7 API key>"
}
}
- Save. The server will start automatically when Devin uses any Rapid7 tool.
Environment Variables
| Variable | Required | Description |
|---|---|---|
RAPID7_API_KEY |
Yes | Your Rapid7 InsightOps API key (read-only permission is sufficient) |
If RAPID7_API_KEY is not set, the server starts but every tool returns a clear error message.
Available Tools
| Tool | Description |
|---|---|
rapid7_list_logs |
List all available logs to discover log key UUIDs. Optional name filter. |
rapid7_list_log_sets |
List all log sets. Optional name filter. |
rapid7_query_log |
Search a single log using a LEQL query with time range, pagination. |
rapid7_query_multiple_logs |
Search across multiple logs simultaneously (POST-based). |
rapid7_query_log_set |
Search all logs within a log set by name or ID. |
rapid7_get_context |
Get surrounding log lines before/after a specific log entry. |
rapid7_download_logs |
Download raw log data as plain text (max 10 logs). |
rapid7_search_trace |
High-level convenience: search for a traceId across multiple logs. |
LEQL Quick Reference
LEQL (Log Entry Query Language) is used in the query parameter:
# Text search (case-insensitive substring)
where(error)
where(NullPointerException)
# Key-value search
where(traceId=abc-123-def)
where(statusCode>=400 AND statusCode<500)
# Regex search
where(/timeout.*connection/i)
# Boolean operators
where(error AND NOT healthcheck)
where(level=ERROR OR level=FATAL)
# Statistical queries (returns counts/aggregates, not log lines)
calculate(COUNT)
where(level=ERROR) calculate(COUNT)
where(statusCode>=500) calculate(COUNT) groupby(service)
calculate(AVERAGE:responseTime) groupby(endpoint)
Time Range Examples
Relative: last 5 minutes, last 1 hour, last 24 hours, last 7 days, yesterday, today
Absolute: Use from_timestamp and to_timestamp (UNIX milliseconds).
Development
# Install with dev dependencies
pip install -e ".[dev]"
# Run tests
pytest tests/
# Run the server locally (for testing)
RAPID7_API_KEY=your-key rapid7-mcp-server
License
MIT
Metadata
Release files for rapid7-mcp-server 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| rapid7_mcp_server-0.1.1.tar.gz | 14.4 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| rapid7_mcp_server-0.1.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 24.7 kB
Release files / rapid7_mcp_server-0.1.1.tar.gz
| Download URL | rapid7_mcp_server-0.1.1.tar.gz |
|---|---|
| Size | 14.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8c298eabae4e1af47c1e958669aaa2b7340a6caa107a5532f01586f1b79e8eca
|
|
BLAKE2b-256 checksum How to use checksums |
38473f15e221c2cbbe0e33c60f44d627dce74de0198dc9487080447722b3358a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.7
|
Release files / rapid7_mcp_server-0.1.1-py3-none-any.whl
| Download URL | rapid7_mcp_server-0.1.1-py3-none-any.whl |
|---|---|
| Size | 10.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
049c64963d52b8307c7ff32b11f1b7eacc99cb8e124ee35905621ee5e56031fb
|
|
BLAKE2b-256 checksum How to use checksums |
6792805a88c7f9fb16213a947a4bfb10550bbf7a4f4f01ccd41647f095506fa9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.7
|
Security for rapid7-mcp-server 0.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.