Skip to directory

RunReveal MCP

RunReveal

Remote Streamable HTTP; local stdio4 documented tools0

About RunReveal MCP

A security investigation MCP server for querying RunReveal log data, inspecting schemas, and managing detections, agents, investigations, notifications, dashboards, and related workspace resources.

What you can use it for

  • Query logs and inspect available data sources
  • Inspect table schemas before writing queries
  • Review, create, or manage SQL detections and scheduled agents
  • Investigate security events using workspace telemetry
Connection and setup
Hosting
Both: vendor-hosted remote server and local CLI server
Transport
Remote Streamable HTTP; local stdio
Endpoint
https://api.runreveal.com/mcp
Authentication
Remote: OAuth authorization to a selected RunReveal workspace. Local CLI server: uses the same credential resolution as the RunReveal CLI and requires an API token with permissions for intended tools. OAuth scopes and API token permissions are workspace-specific.

Requirements

  • RunReveal account with API access
  • For remote setup: MCP client supporting HTTP MCP and OAuth
  • For local setup: RunReveal CLI installed and configured with API token

Setup steps

  1. For hosted remote use, add https://api.runreveal.com/mcp as an HTTP MCP integration.
  2. Authorize in the browser, select the intended workspace, and approve the connection.
  3. For Claude Code, run `claude mcp add -t http runreveal https://api.runreveal.com/mcp`, then authorize on first tool use.
  4. For local/on-prem use, configure the RunReveal CLI credentials and run `runreveal mcp` as a stdio server using the documented CLI integration.
  5. Use read tools first (for example list_tables/get_table_schema/run_query); review data permissions and avoid write-capable operations unless explicitly needed.
Tools 4

The current official external MCP guide lists exactly four tools. Other detections/agents/managed-detection mutations described elsewhere belong to additional product/agent workflows and are not asserted as external MCP tools by this list.

  • source_list

    List available data sources, optionally filtered by type.

    01
  • run_query

    Execute ClickHouse SQL against workspace log data.

    02
  • list_tables

    List available data tables.

    03
  • get_table_schema

    Get table columns, types, indexes, and primary key.

    04
Limitations and notes
  • Tool calls require matching workspace OAuth scopes or API token permissions.
  • Some tools write or delete resources, including detections, agents, investigations, notifications, dashboards and agent skills; Sigma rule creation is documented as UI-only in the referenced guide.
  • RunReveal recommends validating schemas and sample data before writing detections; tool availability depends on workspace and permission configuration.
Original sources

Documentation checked 2026-10-28T00:00:00Z. Connection has not been runtime tested.