Blumira

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.2.12Updated Oct 24, 2026

MCP server for Blumira SIEM — query findings, evidence, and detection data via the Blumira API.

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

MCP server for Blumira SIEM that lets an assistant query findings, evidence, devices, users and MSP accounts through the Blumira API.

What you can do
Navigate domains and load the matching tool set via blumira_navigate (findings, agents, users, resolutions, msp). List, get and inspect findings, resolve them, assign owners and read or add comments. List devices and agent keys, and list users. List available resolutions. Manage MSP accounts: list and get accounts, findings, devices, keys and users across tenants. Apply rich filters such as status.eq, severity.in, created_at.gt, name.contains and negation on list endpoints.
When to use it
Useful when an assistant should work with Blumira security data: triaging and resolving findings, reviewing evidence and comments, checking devices and users, or handling multi-tenant MSP accounts without switching to the Blumira console.
Requirements
Runs as a local stdio process (MCPB bundle for Claude Desktop, npx, Docker image, or build from source with Node.js). Requires a Blumira JWT token in BLUMIRA_JWT_TOKEN. HTTP mode additionally needs CONDUIT_S2S_SECRET and signed X-Gateway-S2S requests; AUTH_MODE selects env or gateway credentials. Network access to the Blumira API.
Before you install
Needs a Blumira JWT token (BLUMIRA_JWT_TOKEN) and, for HTTP, the HMAC secret CONDUIT_S2S_SECRET; keep both out of logs and shared configs. Tools can resolve findings, assign owners and add comments, which change data in Blumira. Gateway mode expects vendor credentials per request and never falls back to environment values. MCP_ALLOW_INSECURE_DEV=1 disables request signing and is for local development only.

Installation

In SourceWeft

  1. Open Blumira in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Blumira MCP Server

[Build Status] [License] [Node.js]

A Model Context Protocol (MCP) server that provides AI assistants with structured access to Blumira SIEM platform data and operations.

Note: This project is maintained by Wyre Technology.

Quick Start

Claude Desktop — download, open, done:

  1. Download blumira-mcp.mcpb from the latest release
  2. Open the file (double-click or drag into Claude Desktop)
  3. Enter your Blumira JWT token when prompted

No terminal, no JSON editing, no Node.js install required.

Claude Code (CLI):

bash
claude mcp add blumira-mcp \  -e BLUMIRA_JWT_TOKEN=your-jwt-token \  -- npx -y github:WYRE-AI/blumira-mcp

See Installation for Docker and from-source methods.

Features

  • 🔌 MCP Protocol Compliance: Full support for MCP resources and tools
  • 🛡️ Comprehensive SIEM Coverage: Tools spanning findings, agents/devices, users, resolutions, and MSP account management
  • 🔍 Decision-Tree Navigation: Start with blumira_navigate to explore domains, then dynamically load domain-specific tools
  • 🏢 MSP Multi-Tenant Support: Full MSP endpoint coverage for managing findings, agents, and users across accounts
  • 🔒 Secure Authentication: JWT token or API key (pax8ApiTokenV1) authentication
  • 🌐 Dual Transport: Supports both stdio (local) and HTTP Streamable (remote/Docker) transports
  • 📦 MCPB Packaging: One-click installation via MCP Bundle for desktop clients
  • 🐳 Docker Ready: Containerized deployment with HTTP transport and health checks
  • ⚡ Rate Limiting: Built-in rate limiter respects Blumira API limits
  • 🔎 Rich Filtering: Support for .eq, .in, .gt, .lt, .contains, .regex, and negation operators

Installation

Option 1: MCPB Bundle (Claude Desktop)

The simplest method — no terminal, no JSON editing, no Node.js install required.

  1. Download blumira-mcp.mcpb from the latest release
  2. Open the file (double-click or drag into Claude Desktop)
  3. Enter your Blumira JWT token when prompted

For Claude Code (CLI), one command:

bash
claude mcp add blumira-mcp \  -e BLUMIRA_JWT_TOKEN=your-jwt-token \  -- npx -y github:WYRE-AI/blumira-mcp

Option 2: Docker

bash
docker compose up

Compose will not start until CONDUIT_S2S_SECRET is set. See Docker Deployment.

Or pull the pre-built image:

bash
# Generate the secret first: openssl rand -hex 32docker run -d \  -e CONDUIT_S2S_SECRET \  -e BLUMIRA_JWT_TOKEN \  -e AUTH_MODE=env \  -p 127.0.0.1:8080:8080 \  ghcr.io/wyre-ai/blumira-mcp:latest

The image defaults to AUTH_MODE=gateway and binds 0.0.0.0 inside the container. HTTP startup refuses to run unless CONDUIT_S2S_SECRET is a real secret (empty values and known placeholders such as replace-with-a-real-secret exit non-zero). Publish the port on 127.0.0.1 (as above). In gateway mode, send vendor credentials on each /mcp request (X-Blumira-Client-ID + X-Blumira-Client-Secret, or X-Blumira-JWT-Token); the server does not fall back to environment credentials. Set AUTH_MODE=env only for a single-tenant container that should use BLUMIRA_JWT_TOKEN.

Every /mcp request must also send X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 of the literal string t=<unix seconds> keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header is HTTP 401, before vendor credentials are read.

bash
TS=$(date +%s)SIG=$(printf 't=%s' "$TS" | openssl dgst -sha256 -hmac "$CONDUIT_S2S_SECRET" -hex | awk '{print $NF}')curl -sS http://127.0.0.1:8080/mcp \  -H 'Content-Type: application/json' \  -H 'Accept: application/json, text/event-stream' \  -H "X-Gateway-S2S: t=${TS},v1=${SIG}" \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

With AUTH_MODE=env, that signed request uses BLUMIRA_JWT_TOKEN from the container. With AUTH_MODE=gateway, add X-Blumira-JWT-Token or X-Blumira-Client-ID and X-Blumira-Client-Secret as well.

Standalone local use that cannot sign requests: set MCP_ALLOW_INSECURE_DEV=1 and do not set CONDUIT_S2S_SECRET. Startup logs a warning, skips the S2S check, and binds 127.0.0.1 only. The image sets MCP_HTTP_HOST=0.0.0.0, so this bypass also requires -e MCP_HTTP_HOST=127.0.0.1. Any other bind address refuses to start. Do not publish that port off loopback.

Option 3: From Source

bash
git clone https://github.com/WYRE-AI/blumira-mcp.gitcd blumira-mcpnpm cinpm run build

Configuration

VariableDescriptionDefault
BLUMIRA_JWT_TOKENJWT token for authentication (stdio and AUTH_MODE=env)—
MCP_TRANSPORTTransport mode (stdio or http)stdio
MCP_HTTP_PORTHTTP server port8080
MCP_HTTP_HOSTInterface the HTTP server binds127.0.0.1
CONDUIT_S2S_SECRETRequired for HTTP. HMAC secret checked against X-Gateway-S2S on /mcp. Generate with openssl rand -hex 32. If empty or a known placeholder, the HTTP server logs an error and exits non-zero. The value is never logged.—
MCP_ALLOW_INSECURE_DEVSet to 1 to start HTTP without CONDUIT_S2S_SECRET. Logs a warning, does not enforce S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST refuses to start. Local development only.unset
AUTH_MODEenv uses process environment credentials (stdio and single-tenant HTTP). gateway requires per-request vendor headers and never falls back to the environment. The Docker image and Compose file default to gateway.env when unset; gateway in Docker and Compose
LOG_LEVELLog level (debug, info, warn, error)info

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

Domains

The server uses decision-tree navigation. Start with blumira_navigate to pick a domain:

DomainTools
findingsList findings, get finding, get finding details, resolve finding, assign owners, list/add comments
agentsList devices, get device, list agent keys, get agent key
usersList users
resolutionsList available resolutions
mspList/get accounts, list/get/resolve findings, assign owners, comments, list devices/keys, list users

Filtering

Blumira supports rich query filtering on list endpoints:

status.eq=10              # Exact matchseverity.in=HIGH,CRITICAL # Multiple valuescreated_at.gt=2026-01-01  # Greater thanname.contains=malware     # Substring match!status.eq=30             # Negation

Pass filters as tool input parameters — the server handles query string construction.

Docker Deployment

Copy .env.example to .env and fill in your credentials, including CONDUIT_S2S_SECRET. Compose will not start if that variable is missing, and it publishes the HTTP port on 127.0.0.1 only.

bash
cp .env.example .env# Edit .env with your Blumira JWT token and CONDUIT_S2S_SECRETdocker compose up -d

Development

bash
npm cinpm run build       # Build the projectnpm run dev         # Watch modenpm run test        # Run testsnpm run lint        # Type-checknpm run clean       # Remove dist/

Contributing

See CONTRIBUTING.md for guidelines.

License

Apache 2.0 — Copyright WYRE Technology

Source: README.md at commit 9b67355

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.12LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.