CloudSEK MCP v1.0 setup guide

CloudSEK MCP connects your AI client to live CloudSEK data. You can inspect alerts, investigate incidents, enrich IOCs, review threat intelligence, and update incidents or events without opening the dashboard.

MCP stands for Model Context Protocol. It is an open standard that lets an AI client call external tools. The client controls whether tool calls require approval, so review its permission settings before enabling write tools. CloudSEK MCP is bidirectional:

• Read tools return alerts, incidents, events, evidence, audit history, IOCs, CVEs, threat actors, and threat feeds.
• Write tools update status, priority, ownership, comments, and remediation state. They can also run bulk updates.

Write access requires an Alerts API token with permission to update incidents and events. Each write returns an operation ID or job ID that you can verify.

Who this guide is for

This guide is for CloudSEK analysts, security researchers, SOC specialists, and threat intelligence teams connecting an MCP-compatible client to XVigil, BeVigil, and CloudSEK Global Threat Intelligence (GTI).

Setup checklist

1. Create an Alerts API token and copy your Org ID.
2. Confirm the Alerts API configuration is set as Default if it should receive all new alerts and incidents.
3. Install Node.js 20 or newer if your client uses npx and mcp-remote.
4. Follow the setup page for your client.
5. Verify read tools, then test write access on a known test record.

Pick your client

If you...	Use this guide
Want a desktop app with no terminal commands	Claude Desktop
Use Claude in a terminal	Claude Code
Use Google Gemini	Gemini CLI
Use OpenAI Codex CLI	OpenAI Codex CLI
Use Kiro	Kiro
Use Cursor, Continue, Amazon Q, or a custom client	Other MCP clients

If you do not have a client, download Claude Desktop.

Prerequisites

1. CloudSEK credentials

You need these values from the CloudSEK Platform:

Credential	Where to find it
Bearer token (CLOUDSEK_BEARER_TOKEN)	Integrations → Alerts API → Create token or Rotate Token
Org ID (CLOUDSEK_ORG_ID)	Open the platform and check the org value in the URL. In https://app.cloudsek.com/overview?org=12345, the Org ID is 12345.

Write tools need a token issued from 30 July 2026 or later, which every Alerts API token created from that date carries natively. An older token can use the read tools but cannot update incidents or events until you rotate it.

Keep credentials private

A Bearer token grants API access to your CloudSEK organization. Do not commit it to version control, paste it into a ticket, or share it in chat. Use environment variables when your client supports them.

New configurations start empty

A new Alerts API configuration only exposes alerts pushed to it after creation. Empty alert results are expected until a new alert arrives. GTI tools are not affected and should work immediately.

When you create or edit the configuration, turn on Default if all new alerts and incidents should route to it. Alerts routed to another configuration do not appear through this token.

2. Node.js for mcp-remote

Claude Desktop and some other clients launch the connector through npx, which ships with Node.js. Node.js 20 is the minimum supported version. Use a current Node.js LTS release when possible.

Check your installation:

node --version
npx --version

If either command is missing, install Node.js:

OS	Installation
macOS	Download the LTS installer from nodejs.org, or run brew install node with Homebrew.
Windows	Download the LTS installer from nodejs.org, or run winget install OpenJS.NodeJS.LTS.
Linux	Use your distribution package manager or install with nvm: nvm install --lts.

If your organization requires npm 12, first install a compatible current Node.js release, then run:

npm install --global npm@12
npx --version

Restart your MCP client after changing Node.js or npm so the client sees the new executable path.

3. Client plan and policy

Plan	MCP support
Free, Pro, or Max	Supported
Team	Supported. An admin may need to enable connectors.
Enterprise	Supported. An admin may need to configure access.

Your organization may restrict third-party connectors or write-capable tools. Ask your CloudSEK or AI client administrator if the server connects but no tools appear.

4. Hosted endpoint

All clients use:

https://api.cloudsek.com/mcp

Manage credentials

Rotate a token

Rotate tokens according to your organization's policy, and immediately after suspected exposure:

1. Open CloudSEK Platform → Integrations → Alerts API.
2. Select Rotate Token.
3. Update the token in every MCP client that uses it.
4. Restart clients that do not reload configuration automatically. Claude Desktop requires a full quit and reopen. Kiro reloads the file after save.

Revoke MCP access

To remove MCP access, revoke or rotate the token under Integrations → Alerts API. Disabling the Alerts API configuration does not invalidate its token. It only stops new alerts from entering that configuration's queue. An active token can still read data already present in the queue.

Exposed token

Revoke an exposed token immediately, then create a replacement. Removing the token from a config file or disabling the integration does not revoke it.

Security checklist

• Use environment variable references where the client supports them.
• Keep user-level configuration files readable only by your account.
• Add project configuration files containing credentials to .gitignore.
• Use --scope user or --scope local in Claude Code when a project is shared.
• Revoke or rotate the token to remove access. Do not rely on disabling the Alerts API configuration.
• Review requested writes before approving them, especially bulk updates.

Verify the connection

Run read-only checks first:

Prompt	Expected result
What CloudSEK tools do you have available?	Lists CloudSEK platform, update, and GTI tools allowed for your token.
Show me example prompts for a SOC analyst.	Returns prompts from the CloudSEK prompt library.
Give me a daily triage brief for the last 7 days.	Returns alert counts, priorities, and recommended actions. A fresh Alerts API configuration may return no alerts.
Who are the most active threat actors right now?	Returns a ranked GTI list with activity and last-seen data.
Check whether this IP is malicious: 1.2.3.4.	Returns GTI labels, confidence, and threat context.

To verify write access, use a known test incident and ask:

Add this comment to test incident XVA-1234: "MCP write access verification."
Then show me the audit entry.

Replace XVA-1234 with your test incident. Do not use a random production record. A successful write returns an operation ID, and the audit trail should show the comment.

Next, review the available tools, try a workflow, or open troubleshooting.