Because the tools are generated from the vendor's own API collection, coverage goes well past incidents into cases, DRP alerts, reference lists, access groups and user administration — and the mutations there are real: closing incidents, running response playbooks, creating and deleting users, API keys and access-control policies. GREYMATTER_READ_ONLY=true is the setting that matters on a production tenant; it registers only the 56 queries, so a hallucinated argument has nothing destructive to reach.
A community-built server over the ReliaQuest GreyMatter Self-Service GraphQL API. The tool set is generated from the vendor's API collection, so each tool maps to one GraphQL query or mutation.
- 146 tools across 22 domains — 56 queries and 90 mutations — plus a graphql_query escape hatch for operations without a dedicated tool
- Incidents listed and filtered by state, severity and updated time, one fetched with its comments, artifacts and metadata, then acknowledged, assigned, commented on, state-changed or closed
- Tasks — the non-security engineering items — read, assigned, commented on, resolved with a close code, and bulk-resolved
- Deployed detection rules across GreyMatter integrations including their MITRE ATT&CK mappings, plus customer detections and their activity logs
- Playbooks listed and recommended, past runs inspected, a playbook executed against inputs, and failed tasks in a run re-run
- Cases created, commented on, re-owned, given a due date, linked to children, and closed or cancelled
- DRP alerts assigned, watched, commented and state-changed, individually or in bulk
- Reference lists, access groups, pods and roles, emergency contacts, API keys, users, assets, identities and indicators — read and maintained
- Current API rate-limit usage, against a limit of 5000 points per hour per company account
A GreyMatter API key, generated from Settings → API Key Management in the portal. It is shown once, each user holds one, and creating a new one invalidates the old — treat it as portal admin credentials, because functionally it is. Pass it as GREYMATTER_API_KEY. Python 3.10 or newer; pip install greymatter-mcp from PyPI, currently 0.1.6, and run greymatter-mcp over stdio, or --transport http --port 8765 which binds 127.0.0.1 by default. GREYMATTER_READ_ONLY=true registers only the 56 query tools and makes graphql_query reject mutations. GREYMATTER_TIMEOUT defaults to 60 seconds; customer_slug on any call overrides the default OpCo header. This is an independent project, not a ReliaQuest product, and it describes itself as beta.
One command plus a key — uv tool install greymatter-mcp, then supply credentials