LabscoMCP early access ↗
Space-C0wboyMCP SERVER

ReliaQuest GreyMatter MCP Server

Work a ReliaQuest GreyMatter queue from your assistant — read incidents, tasks, detections and DRP alerts, comment, assign, close, and run response playbooks.

by Space-C0wboy ↗Threat Intelligence & Digital ForensicsCommunity

LABSCO SUMMARY

The whole GreyMatter API surface, with a read-only switch that decides how much of it is loaded.

Because the tools are generated from the vendor's own API collection, coverage goes well past incidents into cases, DRP alerts, reference lists, access groups and user administration — and the mutations there are real: closing incidents, running response playbooks, creating and deleting users, API keys and access-control policies. GREYMATTER_READ_ONLY=true is the setting that matters on a production tenant; it registers only the 56 queries, so a hallucinated argument has nothing destructive to reach.

What it is

A community-built server over the ReliaQuest GreyMatter Self-Service GraphQL API. The tool set is generated from the vendor's API collection, so each tool maps to one GraphQL query or mutation.

What you get

  • 146 tools across 22 domains — 56 queries and 90 mutations — plus a graphql_query escape hatch for operations without a dedicated tool
  • Incidents listed and filtered by state, severity and updated time, one fetched with its comments, artifacts and metadata, then acknowledged, assigned, commented on, state-changed or closed
  • Tasks — the non-security engineering items — read, assigned, commented on, resolved with a close code, and bulk-resolved
  • Deployed detection rules across GreyMatter integrations including their MITRE ATT&CK mappings, plus customer detections and their activity logs
  • Playbooks listed and recommended, past runs inspected, a playbook executed against inputs, and failed tasks in a run re-run
  • Cases created, commented on, re-owned, given a due date, linked to children, and closed or cancelled
  • DRP alerts assigned, watched, commented and state-changed, individually or in bulk
  • Reference lists, access groups, pods and roles, emergency contacts, API keys, users, assets, identities and indicators — read and maintained
  • Current API rate-limit usage, against a limit of 5000 points per hour per company account

Requirements

A GreyMatter API key, generated from Settings → API Key Management in the portal. It is shown once, each user holds one, and creating a new one invalidates the old — treat it as portal admin credentials, because functionally it is. Pass it as GREYMATTER_API_KEY. Python 3.10 or newer; pip install greymatter-mcp from PyPI, currently 0.1.6, and run greymatter-mcp over stdio, or --transport http --port 8765 which binds 127.0.0.1 by default. GREYMATTER_READ_ONLY=true registers only the 56 query tools and makes graphql_query reject mutations. GREYMATTER_TIMEOUT defaults to 60 seconds; customer_slug on any call overrides the default OpCo header. This is an independent project, not a ReliaQuest product, and it describes itself as beta.

Setup effort

One command plus a key — uv tool install greymatter-mcp, then supply credentials

See installation options