Auth and security - official IBM server
IBM QRadar SIEM MCP server
MCP server for IBM QRadar SIEM with 83 tools covering offenses, AQL searches, reference data, data classification, analytics rules, log sources, assets, forensics and configuration. It runs locally; the notes below cover how it authenticates.
Last verified 2 sources
Install
IBM publishes no copyable client config for this server. Setup steps are in the vendor's docs.
Notes and caveats
- Titled 'IBM QRadar MCP Server - Official'.
- Deployed via Docker Compose or a manual Docker build (HTTP on port 5001, endpoint /mcp) or a stdio entry point; can also be exposed through QRadar Investigation Assistant.
- Authenticates with QRadar SEC/CSRF session tokens, an authorized service token or HTTP Basic.
More MCP servers for auth and security
- IBM
Carbon MCP server
IBM Cloud-hosted MCP server that gives agents Carbon Design System components, icons, charts and documentation, plus a code audit against Carbon guidelines.
Transport: Streamable HTTPAuth: OAuth - IBM
ContextForge MCP Gateway
Open source registry and proxy from IBM that federates MCP servers, A2A agents and REST/gRPC APIs behind one MCP-compliant endpoint with auth, rate limiting, observability and an admin UI.
Transport: Streamable HTTP, SSE, stdioAuth: Other - IBM
IBM API Connect MCP server
MCP server that exposes IBM API Connect analytics, governance, management and GenAI capabilities (for example OpenAPI validation and generation, catalog and consumer app management) to MCP clients.
Transport: stdioAuth: API key - IBMStatus: Preview
IBM Content Services MCP server
MCP server that exposes IBM FileNet Content Manager capabilities to AI models in four configurations: core document and folder management, property extraction and classification, legal hold, and AI document insight.
Transport: stdioAuth: Other - IBM
IBM Data Intelligence MCP server
MCP server for IBM watsonx.data intelligence (SaaS or Cloud Pak for Data 5.2.1) that exposes data intelligence services as MCP tools, prompts and optional agent skills.
Transport: stdio, Streamable HTTPAuth: API key - IBM
IBM i MCP server
MCP server for IBM i systems that exposes YAML-defined SQL tools over Db2 for i (via Mapepire) for tasks such as performance monitoring, security auditing and database administration.
Transport: stdio, Streamable HTTPAuth: Other
Related reading
- What's New in Mastra (Late 2026): Harness, AgentController GA, Eval Gates and MCP 2.xMastra in late 2026: goals, schedules, signals, AgentController GA, eval gates and MCP 2.x, with type-checked TypeScript examples and honest tradeoffs.
- MCP vs A2A vs Function Calling: Which Layer Does What in 2026MCP vs A2A vs function calling compared on the 2026-07-28 MCP spec and A2A 1.0: what each protocol does, where they overlap, and how to stack them.
- Pydantic AI V2 in Late 2026: Capabilities, Graphs, Evals and MCPPydantic AI V2 explained through v2.57.0: capabilities, typed output, Conversation storage, caching, graphs, evals, MCP Apps and Logfire, with checked code.
- Reverse Engineer Anything (REA): What the MCP Server Does and Where the Line IsREA (Reverse Engineer Anything) is an MIT-licensed MCP server that lets Claude Code, Codex or Cursor inspect binaries, Electron apps and APKs. How to try it.
- Claude Opus 5.5 Built a Browser 3D World: The Higgsfield MCP WorkflowClaude Opus 5.5 and Higgsfield MCP built an interactive 3D Library of Alexandria in the browser. The verified connector setup and where the workflow holds up.
- Pi 1.0 Release Guide: MCP, Codemode and Pi DurablePi 1.0 adds built-in MCP through Codemode, a fullscreen TUI by default and Pi Durable. What changed, how to install it, and what breaks on upgrade.
FAQ
What does the IBM QRadar SIEM MCP server do?
MCP server for IBM QRadar SIEM with 83 tools covering offenses, AQL searches, reference data, data classification, analytics rules, log sources, assets, forensics and configuration.
How do I install the IBM QRadar SIEM MCP server?
IBM publishes no copyable client config. Build it from https://github.com/IBM/qradar-mcp. Setup steps are at https://github.com/IBM/qradar-mcp.
Does the IBM QRadar SIEM MCP server need authentication?
It uses a scheme other than OAuth or an API key, such as the session of the app or instance it runs in; the notes on this page describe it. Transport: Streamable HTTP, stdio. Status: Unlabelled, last checked October 17, 2026.
Sources
Last verified against 2 IBM pages, then re-checked independently.
- raw.githubusercontent.comhttps://raw.githubusercontent.com/IBM/qradar-mcp/main/README.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/IBM/mcp/main/README.md
Newsletter
New MCP servers, the week they ship
One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.