SOCRadar expands MCP server with 126 tools for security teams

SOCRadar’s MCP Server has expanded to include 126 tools across 16 families, with 107 read-only tools and 19 capable of acting, each behind a preview and a one-time confirmation code. The platform, in operation since 2025, now supports a multi-tenant MSSP variant—MSSP MCP—that brings portfolio-wide operations and tenant management into a single conversation.

Customers can sign in with SOCRadar (including 2FA, passkeys or SAML SSO) or use API keys, and a shared Copilot credit model means a company’s own data costs nothing extra for queries, with advanced lookups drawing on existing Copilot credits.

SOCRadar emphasises grounded threat intelligence and human-approved actions: every write action requires a preview and a one-time confirmation code, with bulk actions listing items before approval and irreversible steps flagged. The MSSP and multi-entity use case are supported by 75 tools for portfolio-wide work, and the platform’s support for 13 AI clients—including a mix of chat assistants and developer tools—enables tools to be connected through a single server URL (mcp.socradar[.]com).

Evidence of the approach is shown in demonstrations such as answering a question about impersonation from a user’s own tenant and providing an enrichment pivot, or previewing takedowns for multiple domains before confirmation. The system logs actions per user, with per-user activity in the audit trail and revocable connections, and maintains explicit controls over who can deploy what within integrated teams. Notably, among its FAQ, it references CVE-2024-3400 in user prompts as an operational example of actor exploitation visibility.