Graylog MCP Conversational AI for Modern Security Operations
A practical guide to Graylog 7.1 MCP. Connect Claude to your SIEM enable the endpoint use the tools and handle the prompt injection risk.
Overview#
Graylog 7.1 shipped in the Spring 2026 release on 5 May 2026 and it brought one feature that changes how a SOC talks to its data. Graylog now exposes a Model Context Protocol endpoint so a language model like Claude can query your SIEM in plain English. Instead of building a search and remembering the query language you ask a question and the model calls the right tool against your live Graylog instance.
This guide walks through what the feature is and how it works and how to turn it on safely. It also covers the parts that the marketing pages skip which are the write capable tools and the prompt injection risk that comes with feeding hostile log data to a model. The feature is powerful but it is still experimental so it deserves a careful setup.
Quick Facts#
Product: Graylog 7.1 (Security and Enterprise)
Released: 5 May 2026
Feature status: Experimental
Endpoint: /api/mcp
Transport: Streamable HTTP
Authentication: Authorization: Basic with a base64 API token
Supported clients: Claude and LM Studio
Permission model: Inherits the Graylog user role
New network ports: None
Recommended: A dedicated read only user
What is Graylog MCP#
Model Context Protocol is an open standard that lets a language model call external tools through a structured interface. Graylog implements it as an embedded server that lives inside the deployment you already run. When you enable it Graylog publishes a set of tools that map onto its own REST API. A connected model can then list inputs or search messages or open an investigation by calling those tools rather than by hitting raw endpoints.
The important design choice is that the model never gets special access. Every tool call runs as the Graylog user whose token you connected with so the model can only see and do what that user could already see and do. The conversation is a new front door onto the same house with the same locks.
Why It Matters for the SOC#
Most SIEM work is repetitive. An analyst checks input health and pulls the newest security events and asks which assets carry a given vulnerability dozens of times a day. Each of those is a few clicks or a saved search. A conversational layer collapses them into a single sentence and returns the answer without any dashboard navigation. The stated payoffs are faster triage and less alert fatigue and quicker investigations.
There is also a training benefit. A junior analyst who does not yet know the Graylog query language can still ask useful questions on day one. The model translates intent into the correct tool call so the learning curve flattens. For a lean team that cannot staff every shift with a senior this matters a lot.
How It Works#
The flow is simple. Your client opens a streamable HTTP connection to the endpoint at /api/mcp on the same port as the Graylog web interface. It authenticates with a base64 encoded API token in a Basic authorization header. Graylog checks the token resolves it to a user and then serves only the tools and data that the user is permitted to touch. No extra port is opened and no separate service runs because the server is embedded in Graylog itself.
Setup Step by Step#
Step 1. Enable the MCP Endpoint#
Open System then Configurations then MCP and switch Enable MCP to On and save. Graylog now serves the endpoint at /api/mcp on the existing web port so you are not exposing anything new at the network level.
Step 2. Create a Read Only User and Token#
Create a dedicated Graylog user with a read only role and do not reuse an admin account. Then open System then Users and Teams then Tokens and generate an API token for that user. The MCP server enforces exactly what this user can see so a tight role here is your primary control. After you have the token encode it for the Basic scheme.
echo -n "<api_token>:token" | base64The word token stays literal. Replace only the api_token part with the value you generated. The output is the credential you hand to the client.
Step 3. Connect Your Client#
For Claude Code one command registers the server. Swap the host and port for your own Graylog address and use the base64 value from the previous step.
claude mcp add --transport http graylog http://127.0.0.1:9000/api/mcp \
--header "Authorization: Basic BASE64_TOKEN_HERE"For LM Studio add the server to the client configuration instead.
{
"mcpServers": {
"graylog-mcp-server": {
"url": "http://localhost:9000/api/mcp",
"headers": {
"Authorization": "Basic BASE64_TOKEN_HERE"
}
}
}
}Once the client connects it can list the tools and call them right away. A quick way to confirm the link works is to ask which inputs are active and watch the model return a real answer from your instance.
The Tools You Get#
Graylog 7.1 exposes a broad tool set grouped by domain. Most are read only but a handful in the security events and investigations groups can change state so read the next section before you grant those.
System Information
get_system_status
get_formatted_system_status
get_current_time
get_mitre_threat_coverage
list_illuminate_content_packs
list_resource
describe_resource
Streams and Index
list_streams
list_index_sets
list_indices
list_inputs
Search and Aggregation
search_messages
aggregate_messages
list_fields
Security Events
list_new_security_events
describe_security_events
list_security_events_by_asset
update_security_events
describe_event_procedures
Investigations
list_investigations
create_investigation
update_investigation
get_possible_investigation_values
Assets and Vulnerabilities
list_assets
describe_asset
list_vulnerabilitiesReal Triage Prompts#
The point of this interface is that you ask in plain English and the client picks the right tool. These prompts map cleanly onto the tools above.
Which inputs are active right now?
How much disk space is my Graylog server using?
Show me the new security events from the last hour.
Which assets have open critical vulnerabilities?
Open an investigation for the failed logins against the finance host.Behind each of those the client calls list_inputs or get_system_status or list_new_security_events or list_vulnerabilities or create_investigation. You get the answer without touching the search bar and without remembering the query syntax.
Security Model and Caveats#
Every call runs as the user behind the token so the MCP server can never do more than that user could do in the web interface. This is the whole reason a read only role is the right default. Keep admin accounts away from this feature and scope the token to the smallest role that still answers your questions.
Notice that a few tools are not read only. The update_security_events tool and the create_investigation and update_investigation tools all change state. If you want a pure analyst assistant give the token a role that cannot reach those actions. Grant write access only when you actually want the model to manage cases for you.
There is a deeper risk that is easy to miss. Logs are attacker controlled data. An adversary who can land a crafted line into any source that Graylog ingests can try to plant text that the model reads as an instruction when it summarizes that log. This is prompt injection and a SIEM is an ideal target for it because collecting hostile input is its entire job. A SIEM that pipes raw log data into a language model is exactly the kind of place where AI tooling turns into an attack surface. The same lesson showed up when an AI workflow builder became an unauthenticated remote code execution path in the Langflow case. Treat anything the model says about log content as a lead rather than as ground truth and never wire its output straight into an automated action that you would not let a stranger trigger.
Finally this is an experimental feature in Graylog 7.1. The tool names and their behavior can shift between versions so pin your workflows to a known version and retest them after every upgrade.
When to Use It and When Not To#
Graylog MCP shines for fast triage and for the questions you ask all day long. Checking input health and pulling the latest security events and asking which assets carry a given vulnerability are all quicker through a prompt than through the interface. It also lowers the barrier for junior analysts who do not yet know the query language.
It is not a detection engine and it is not a replacement for written detection content. The model does not watch your data and it does not page you. It answers when you ask. Keep your alerting and your Sigma rules and your correlation exactly where they are and treat the conversational layer as a faster way to ask questions on top of them.
Related Reading#
CVE-2026-33017 Unauthenticated RCE in Langflow and the 20 Hour Exploit
CVE-2026-45777 Unauthenticated RCE in Open XDMoD and the Chart Export Behind It
Building an AI Chatbot Interface with Vercel AI SDK and Next.js
Building AI Features in Modern Web Applications
References#
Graylog Spring 2026 Release Announcement