ReliaQuest GreyMatter MCP Server

A Model Context Protocol server that exposes the ReliaQuest GreyMatter Self-Service GraphQL API to AI assistants.

AModel Context Protocolserver that exposes theReliaQuest GreyMatterSelf-Service GraphQL API to AI assistants. It provides146 tools across 22 domains— Incidents, Tasks, Detections, Playbooks, Cases, DRP Alerts, Assets, Identities, Reference Lists, Users, and more — plus a genericgraphql_queryescape hatch for anything not covered by a dedicated tool. The tool set is generated directly from the vendor's API collection, so it stays faithful to the real API surface, and it has been verified against the live GraphQL schema.

[!IMPORTANT]Unofficial project.This is an independent, community-built MCP server developed against ReliaQuest's published API documentation. It isnotan official ReliaQuest product and is not affiliated with, endorsed by, or supported by ReliaQuest, LLC. "ReliaQuest" and "GreyMatter" are trademarks of ReliaQuest, LLC. For official support of the GreyMatter platform or the API itself, contact ReliaQuest directly atgreymattersupport@reliaquest.com.

[!WARNING]Beta software — not yet recommended for production environments.This project is under active development. The tool surface and individual tool body shapes may still change between minor versions, and not every endpoint has been exhaustively exercised against every account/entitlement configuration. Use against a non-production scope until you're confident in the behavior for your use case.

This server can perform destructive actions against your GreyMatter environment.Tools can close and cancel incidents/cases/tasks, run response playbooks, and create or delete users, API keys, access-control policies, and reference lists. A hallucinated tool argument from your AI assistant could change incident state or modify your tenant configuration.

- Run read-only first.SetGREYMATTER_READ_ONLY=trueto register only query tools and makegraphql_queryreject mutations. Lift it only when you need to write.
- Use a GreyMatter API key scoped to theminimum permissionsyour use case requires.
- Review every mutating tool call before allowing execution. Claude Desktop requires tool-call approval by default — keep that enabled.
- Treat the API key with the same care as portal admin credentials, because functionally it is one.
- The HTTP transport binds to127.0.0.1by default. Do not expose it to the public internet without adding authentication.

146 tools across 22 domains (56 queries + 90 mutations), plus thegraphql_queryescape hatch. In read-only mode only the 56 queries (and a query-onlygraphql_query) are registered.

- List queries(incidents,tasks,assets,detection_rules,cases, …) are Relay-paginated — passfirst/afterand readedges,pageInfo, andtotalCount. Most accept a domain filter and order input (e.g.incidentFilter,incidentOrder).
- Single-item queries(incident,task,case,user, …) take abyargument (e.g. an id or ticket number) to fetch one record with its full detail and comments.
- Incident workflowmutations cover the GreyMatter Investigate lifecycle:acknowledge_incident,assign_incident,add_incident_comment,update_incident_state, andclose_incident. Incident close codes includeCUSTOMER_TRUE_POSITIVE,CUSTOMER_FALSE_POSITIVE,CUSTOMER_ANOMALOUS_SAFE,FALSE_POSITIVE_CREATE_TUNING_TICKET,CUSTOMER_SECURITY_CONTROL_TESTING,CUSTOMER_CANCELLED; states includePENDING_CUSTOMER,PENDING_RQ,RESOLVED,CANCELLED.
- Respond / playbooks:run_playbookexecutes a predefined playbook;playbook_runsandplaybook_runread execution results.
- graphql_queryescape hatchruns an arbitrary GraphQL document for anything without a dedicated tool. In read-only mode it rejects mutations.
- customer_slugon every tooloverrides thex-reliaquest-customer(OpCo) header for that single call — seeMulti-OpCo.
- rate_limitreports your remaining API budget (the API allows 5000 points/hour per company account; each returned node counts as one point).

Seedocs/ENDPOINTS.mdfor the full tool ↔ GraphQL-operation mapping.

# with uv (recommended) uv tool install greymatter-mcp # or with pip pip install greymatter-mcp

git clone https://github.com/Space-C0wboy/Reliaquest-Greymatter-MCP-Server cd Reliaquest-Greymatter-MCP-Server uv venv && uv pip install -e ".[dev]"

Generate a GreyMatter API key from the portal:
- In GreyMatter, go toSettings → API Key Management.
- ClickNew API Key, choose anExpiration Date(default is 1 year), thenCreate Key.
- Copy the key — it is shownonly once. This is yourGREYMATTER_API_KEY.

[!IMPORTANT] Each user can holdoneAPI key, and keyscannot be renewed— creating a new key invalidates the old one. Requests authenticate with theX-API-KEYheader (not your email/password login).

- stdio (default):uv run greymatter-mcp(or justgreymatter-mcpif installed as a tool)
- HTTP:greymatter-mcp --transport http --port 8765

SetGREYMATTER_READ_ONLY=trueto run the server safely against production. In this mode:

- No mutation tools are registered— only the 56 query tools are exposed.
- Thegraphql_queryescape hatch rejects mutations, so it can only run read operations (robust against fragment- or BOM-prefixed mutation documents).

Read-only mode is strongly recommended for analyst-assistant, dashboard, and reporting use cases where the model should never be able to change state.

- macOS:~/Library/Application Support/Claude/claude_desktop_config.json
- Windows:%APPDATA%\Claude\claude_desktop_config.json

{ "mcpServers": { "greymatter": { "command": "greymatter-mcp", "env": { "GREYMATTER_API_KEY": "your-key-here", "GREYMATTER_READ_ONLY": "true" } } } }

If running from source instead of an installed tool, useuvwith--directory:

{ "mcpServers": { "greymatter": { "command": "uv", "args": ["run", "--directory", "/absolute/path/to/Reliaquest-Greymatter-MCP-Server", "greymatter-mcp"], "env": { "GREYMATTER_API_KEY": "your-key-here", "GREYMATTER_READ_ONLY": "true" } } } }

Restart Claude Desktop, then confirmgreymatterappears in the tools menu.

claude mcp add greymatter \ --env GREYMATTER_API_KEY=your-key-here \ --env GREYMATTER_READ_ONLY=true \ -- greymatter-mcp

GreyMatter accounts that manage multiple operating companies (OpCos) use thex-reliaquest-customerheader ("Header Slug") to select which company a request targets:

- SetGREYMATTER_CUSTOMER_SLUGto apply a default slug to every request.
- Passcustomer_slugon any individual tool call to override the default for that call. Both set thex-reliaquest-customerheader.

The GreyMatter API enforces a limit of5000 points/hour per company account. Each node entity returned counts as1 point, so large paginated queries consume points quickly. Use therate_limittool to check your current usage.

Entitlement-gated tools.Some tools return"You don't have access to this item"unless your account/API key is licensed for the relevant module — e.g.drp_alerts,access_control_policies,access_control_resources,discover_tasks,audits. These work normally for entitled accounts.

Multi-connection queries.A few queries page several nested connections and expose multiplefirst/afterparameters (e.g.casesusesfirst3/after3for the top-level list andfirst/first1/first2for nested connections). Always set theouterpage-size parameter to bound results; leaving it unset can return very large responses and time out. For heavy queries (e.g.playbook_run_filter_data), raiseGREYMATTER_TIMEOUT.

- "Show me incidents pending customer action."→incidents(filter onstate: PENDING_CUSTOMER).
- "Acknowledge incident<id>and assign it to me."→acknowledge_incident→assign_incident.
- "Resolve incident<id>as a false positive with a tuning note."→close_incident(closeCode: CUSTOMER_FALSE_POSITIVE).
- "What detection rules are deployed, and which map to MITRE techniques?"→detection_rules.
- "List the 25 most recent open cases."→cases(setfirst3: 25).
- "How much of my API rate-limit budget is left?"→rate_limit.

The tools are generated from the vendor's API collection:

python scripts/generate_from_collection.py

This regenerates the modules undersrc/greymatter_mcp/tools/_generated/and the catalog atdocs/ENDPOINTS.md. The generated files arenot hand-edited— change the generator (itsOVERRIDES/FIELD_EXCLUSIONSmaps) and regenerate.

The API collection and other ReliaQuest reference material live in theDevelopment Reference/directory, which isgitignored: it is ReliaQuest proprietary material and is not redistributed in this public repository. To verify the generated tools against the live API,scripts/introspect.pyfetches the current GraphQL schema.

uv run pytest # full suite (HTTP fully mocked; no live calls) uv run ruff check . # lint uv run python scripts/generate_from_collection.py # regenerate tools

Releases publish to PyPI when av*tag is pushed (see.github/workflows/release.yml).

This is an unofficial community project. For GreyMatter platform or API questions, contact ReliaQuest atgreymattersupport@reliaquest.com. For issues with this MCP server, open an issue on theGitHub repository.

Agent-ready global image CDN that AI agents can install and operate through MCP.