Ask the question. The tools do the looking.

An assistant that can only read what you paste is a search engine with extra steps.

Bolt a chat window onto a security console and you get fluent answers about nothing in particular. The model has no access to the case, so the analyst becomes a courier — exporting records, trimming them to fit, pasting them in, and then checking whether the reply actually matches the data they sent.

An MCP server closes that loop. The model is handed a set of tools and decides which to call; the calls run against the Incident Engine on your appliance. What comes back is your environment, current as of the moment the question was asked, and every figure in it is one you can go and verify.

Twenty tools, grouped by what an analyst does

• Search the evidence

  Query the artifact graph directly — the records themselves, the entities built from them, and the relationships between them.

  • search_artifacts
  • search_nodes
  • search_edges
  • get_artifact_details
  • get_node_details
  • get_graph_neighbors

• Work the incidents

  Read incidents, work units, collections and observations the way an analyst reads them in the console.

  • list_incidents
  • get_incident
  • search_work_units
  • get_work_unit
  • list_work_collections
  • get_work_collection
  • list_observations
  • get_observation
  • get_lead_rules

• Check the system

  Inspect platform health and the rules in force, and post findings back to the channels the team already watches.

  • get_system_health
  • get_notification_channels
  • get_classification_rules
  • send_chat_message

Each tool's parameters, required permissions and error responses are documented in the tool reference.

Questions

What is an MCP server, and why does a SIEM need one?

Model Context Protocol is an open standard for connecting AI models to external data and tools. Without it, an assistant can only reason about what someone pasted into the conversation. With it, the model can call defined tools against live data — so the answer describes your environment rather than a plausible-sounding environment.

Can the AI see data the analyst using it cannot see?

No. Every MCP tool call is authenticated with the same JWT-based system as the REST API and is checked against the user’s permissions before it executes. Calls are also scoped to the organization in the token’s claims, so a tool can only reach that org’s data. If the user lacks the permission behind an endpoint, the tool returns a permission error instead of the data.

Which AI provider does it use, and who holds the key?

You choose. Anthropic’s Claude family is the recommended provider for security analysis, and OpenAI’s GPT family is supported as an alternative. You supply your own API key, which is encrypted at rest on the appliance, and you pick the model, temperature and token limit.

Can we limit what the assistant is allowed to touch?

Yes. An administrator enables MCP and selects which tool categories are available: Search, Incidents and Reports are on by default, and Admin — the administrative operations — is off by default. The setting is in Admin > AI > MCP Configuration and is also exposed on the API for anyone who wants it in configuration management.

Does an AI answer mean giving up a defensible number?

The tools query a deterministic evidence graph: WitFoo processes every record rather than sampling, so the figures behind an answer are reproducible and can be traced back to the artifacts they came from. The model shapes how the answer reads; the platform decides what it says.