AI安全运维协同工具

┌────────────────────────────────────────────────────────────┐
│              Analyst Interface                              │
│   Browser UI  │  CLI  │  HTTP (SSE)  │  WebSocket  │  SIEM │
└───────────────┴───────┴──────────────┴─────────────┴───────┘
                              │
                         server.py
                         FastAPI app
                              │
                         agent.py
                    run_investigation()
                    (async generator)
                              │
               ┌──────────────┴──────────────┐
               │                             │
          AI_PROVIDER=demo            AI_PROVIDER=anthropic
          (pre-recorded)              or openai (Ollama etc.)
                                             │
                                    MCP_MODE=mock     MCP_MODE=live
                                    (sample data)     mcp_client.py
                                                      MCPClientPool
                                                      asyncio.gather()
                                                           │
              ┌──────┬─────────┬──────────┬──────────┬──────┐
              │      │         │          │          │      │
           npx/uvx subprocess per MCP server (stdio JSON-RPC)
              │      │         │          │          │      │
          Sentinel  GHAS  GreyNoise   OpenCTI    Vault   Jira
          Splunk    Snyk  VirusTotal  Prowler    Okta    Slack
          …         …    …           …          …       …

mcp-security-ops-suite/
├── agent.py            ← Core agent: run_investigation() + CLI + demo scenarios
├── server.py           ← FastAPI app: REST + WebSocket + UI serving + session store
├── mcp_client.py       ← Async MCP subprocess client (JSON-RPC over stdio)
├── config.py           ← Centralised configuration (reads .env)
├── onboard.py          ← CLI onboarding wizard (also powers the web wizard)
├── mcp_config.json     ← MCP server spawn commands + env var references
├── .env.example        ← Template for credentials (copy → .env)
├── requirements.txt    ← Python dependencies
├── Dockerfile          ← Python 3.12 + Node 20 + uv, non-root user
├── docker-compose.yml  ← Private-subnet deployment
├── ui/
│   └── index.html      ← Single-file SPA (served at GET /)
├── sessions/           ← Persisted WebSocket session history (auto-created)
├── reports/            ← Generated investigation reports (auto-created)
├── playbooks/          ← SOC workflow documentation
├── architecture/       ← Reference architecture diagrams
├── mcp-configs/        ← Example MCP server configuration snippets
└── scripts/            ← Helper scripts

git clone <this-repo> && cd mcp-security-ops-suite

# Create a virtual environment and install dependencies
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

# Start the server in demo mode
AI_PROVIDER=demo MCP_MODE=mock uvicorn server:app --host 0.0.0.0 --port 8000

# Open http://localhost:8000 in your browser

# Anthropic (cloud)
export AI_PROVIDER=anthropic
export AI_API_KEY=sk-ant-api03-...

# OR local Ollama (fully air-gapped)
export AI_PROVIDER=openai
export AI_BASE_URL=http://localhost:11434/v1
export AI_MODEL=qwen2.5:7b
export AI_API_KEY=ollama   # any non-empty string

export MCP_MODE=mock

uvicorn server:app --host 0.0.0.0 --port 8000
# Open http://localhost:8000

# 1. Run the onboarding wizard to pick tools and collect credentials
python onboard.py
# OR use the web wizard: start the server and click "🔌 MCP Tools" in the UI header

# 2. The wizard writes .env with your selections. MCP_MODE=live is set automatically.

# 3. Load the .env and start
source .env
uvicorn server:app --host 0.0.0.0 --port 8000

# 4. Or use the CLI directly
python agent.py --playbook incident-response "suspicious login 185.220.101.34"

# 1. Generate .env (via wizard or copy from .env.example)
python onboard.py   # or: cp .env.example .env && edit .env

# 2. Build and start
docker compose up -d

# 3. Check health
curl http://localhost:8000/health

# 4. Tail logs
docker compose logs -f

python onboard.py

python onboard.py --check              # Show which credentials are set / missing
python onboard.py --add splunk         # Add or reconfigure a single tool
python onboard.py --list               # List all available tools with tiers
python onboard.py --env-file /etc/socpilot/.env   # Use a different .env file

Category              Tool                           Tiers            Credentials
────────────────────────────────────────────────────────────────────────────────
SIEM                  Microsoft Sentinel             team, enterprise  7
SIEM                  Splunk                         team, enterprise  2
SIEM                  Elastic Security               enterprise        2
SIEM                  Datadog                        enterprise        2
Vuln Scanning         GHAS                           solo+             2  (free)
Vuln Scanning         Semgrep                        solo+             1  (free)
Vuln Scanning         Snyk                           team+             2
Vuln Scanning         Trivy                          team+             0  (free)
Vuln Scanning         StackHawk                      enterprise        1
Threat Intelligence   GreyNoise                      solo+             1  (free)
Threat Intelligence   OpenCTI                        team+             2
Threat Intelligence   VirusTotal                     enterprise        1
Cloud Security        Prowler                        team+             3  (free)
Cloud Security        Cloudflare                     enterprise        2
Secrets & Identity    HashiCorp Vault                team+             2
Secrets & Identity    Vault Radar                    team+             3
Secrets & Identity    Okta                           enterprise        2
Compliance            Drata                          enterprise        1
Compliance            Vanta                          enterprise        1
Detection Eng.        Security Detections            solo+             0  (free)
Ticketing             Jira                           team+             3
Ticketing             Slack                          team+             2

python agent.py [OPTIONS] [QUERY]

# Free-form investigation
python agent.py "Is CVE-2024-50623 being actively exploited? Check payments-api."

# Run a structured playbook
python agent.py --playbook vuln-triage "CVE-2024-50623 in payments-api"
python agent.py --playbook incident-response "alert SEC-7721"
python agent.py --playbook threat-hunting "Cl0p ransomware TTPs"
python agent.py --playbook secret-leak-response "AWS key leaked in payments-service"
python agent.py --playbook cloud-posture-review "AWS prod account"
python agent.py --playbook compliance-audit "SOC 2 readiness"

# Save a report
python agent.py --playbook compliance-audit "AWS prod" --output reports/audit-$(date +%F).md

# Interactive multi-turn session
python agent.py
SOCPilot> --playbook vuln-triage CVE-2024-50623 in payments-api
SOCPilot> now check if auth-service is also affected
SOCPilot> create a P1 Jira ticket for both findings
SOCPilot> clear     ← resets session history
SOCPilot> exit

uvicorn server:app --host 0.0.0.0 --port 8000 --reload

{"status": "ok", "mode": "mock", "provider": "demo", "model": "claude-opus-4-6", "ts": "2026-02-24T10:30:00+00:00"}

{"provider": "anthropic", "model": "claude-opus-4-6", "status": "ok", "latency_ms": 420, "response": "pong"}

{"playbooks": ["vuln-triage", "incident-response", "threat-hunting", "compliance-audit", "secret-leak-response", "cloud-posture-review"]}

curl -X POST http://localhost:8000/query \
  -H "Content-Type: application/json" \
  -d '{"query": "Check GreyNoise for IP 185.220.101.34", "verbose": false}' \
  --no-buffer

data: {"type": "text",        "text": "Checking GreyNoise for..."}
data: {"type": "tool_call",   "name": "check_greynoise", "inputs": {"query": "185.220.101.34"}}
data: {"type": "tool_result", "name": "check_greynoise", "content": "Classification: MALICIOUS..."}
data: {"type": "text",        "text": "The IP is classified as malicious..."}
data: {"type": "done",        "turns": 2}

curl -X POST http://localhost:8000/playbook \
  -H "Content-Type: application/json" \
  -d '{"playbook": "vuln-triage", "target": "CVE-2024-50623 in payments-api"}' \
  --no-buffer

curl -X POST http://localhost:8000/report \
  -H "Content-Type: application/json" \
  -d '{"playbook": "compliance-audit", "target": "AWS prod"}'

{"status": "ok", "file": "reports/compliance-audit-20260224-103000.md", "turns": 4, "bytes": 8423}

{"values": {"AI_API_KEY": "sk-ant-...", "AI_PROVIDER": "anthropic"}}

import httpx, json

with httpx.Client(timeout=300) as client:
    with client.stream("POST", "http://localhost:8000/query",
                       json={"query": "Is CVE-2024-50623 exploited?"}) as r:
        for line in r.iter_lines():
            if line.startswith("data: "):
                event = json.loads(line[6:])
                if event["type"] == "text":
                    print(event["text"], end="", flush=True)

# Using wscat
wscat -c ws://localhost:8000/ws/analyst-session-1
> {"query": "Check GreyNoise for 185.220.101.34"}
< {"type": "text", "text": "..."}
< {"type": "done", "turns": 2}
> {"query": "Now check if OpenCTI has any threat actor campaigns using this IP"}
< {"type": "text", "text": "Based on my earlier GreyNoise findings..."}   ← remembers context

import asyncio, json, websockets

async def session():
    async with websockets.connect("ws://localhost:8000/ws/my-session") as ws:
        queries = [
            "Check GreyNoise for 185.220.101.34",
            "What threat actors use IPs in this range?",
            "Create a Jira ticket summarising these findings",
        ]
        for query in queries:
            await ws.send(json.dumps({"query": query}))
            while True:
                msg = json.loads(await ws.recv())
                if msg["type"] == "text":
                    print(msg["text"], end="", flush=True)
                elif msg["type"] == "done":
                    print(f"\n--- Turn {msg['turns']} complete ---\n")
                    break

asyncio.run(session())

HTTP POST https://your-server:8000/webhook/siem
Content-Type: application/json
Body: {
  "alert_id":    "@{triggerBody()?['SystemAlertId']}",
  "title":       "@{triggerBody()?['AlertDisplayName']}",
  "severity":    "@{triggerBody()?['AlertSeverity']}",
  "description": "@{triggerBody()?['Description']}",
  "raw":         @{triggerBody()}
}

curl -X POST https://your-server:8000/webhook/siem \
  -d '{"alert_id":"$name$","title":"$name$","severity":"$result.severity$","description":"$result.description$"}'

"actions": {
  "notify_socpilot": {
    "webhook": {
      "method": "post",
      "url": "https://your-server:8000/webhook/siem",
      "body": "{\"alert_id\": \"{{ctx.id}}\", \"title\": \"{{ctx.metadata.name}}\", \"severity\": \"high\", \"raw\": {{#toJson}}ctx{{/toJson}}}"
    }
  }
}

"mythic": {
  "command": "npx",
  "args": ["-y", "@mythic/mcp-server"],
  "env": {
    "MYTHIC_URL":   "${MYTHIC_URL}",
    "MYTHIC_TOKEN": "${MYTHIC_TOKEN}"
  }
}

{
    "name": "query_mythic",
    "description": "Query the Mythic C2 framework for active implants and agent activity.",
    "input_schema": {
        "type": "object",
        "properties": {
            "operation": {"type": "string", "description": "Operation name"},
            "filter":    {"type": "string", "description": "Filter expression"},
        },
        "required": ["operation"],
    },
},

TOOL_TO_SERVER: dict[str, str] = {
    ...
    "query_mythic": "mythic",
}

"query_mythic": (
    f"Mythic — {inputs.get('operation','default')}:\n"
    f"  3 active agents | 1 stale (last seen 48 h)\n"
    f"  [Mock — set MYTHIC_URL for live data]"
),

"mythic": Tool(
    id="mythic", display="Mythic C2", category="Incident Response",
    description="Active implant tracking, agent management",
    tiers=["enterprise"],
    credentials=[
        Cred("MYTHIC_URL",   "Mythic URL",   secret=False),
        Cred("MYTHIC_TOKEN", "Mythic Token", secret=True),
    ],
),

_MCP_TOOL_NAMES: dict[str, str] = {
    ...
    "query_mythic": "get_agents",  # the actual tool name the MCP server exposes
}

AI_PROVIDER=demo MCP_MODE=mock uvicorn server:app --host 0.0.0.0 --port 8000

export AI_API_KEY=sk-ant-...
# or add to .env: AI_API_KEY=sk-ant-...
# or switch to demo mode: AI_PROVIDER=demo

pip install -r requirements.txt

curl -LsSf https://astral.sh/uv/install.sh | sh
source ~/.bashrc   # or restart your shell

SERVER_PORT=8001 uvicorn server:app --host 0.0.0.0 --port 8001
# or update SERVER_PORT in .env

docker compose logs socpilot
# Most common cause: AI_API_KEY not set (use AI_PROVIDER=demo to avoid this)

python onboard.py --check