Integrations

MCP server

Let an AI SOC agent ask Kandaro what happened, with read-only tools and nothing to install.

Connect

The server speaks the Model Context Protocol over HTTP at https://api.kandaro.com/mcp. It authenticates with the same API keys as the API. Create a key for the agent with only the scopes it needs, then add the server to your MCP client. The exact configuration format depends on the client; a common one looks like this:

json

{
  "mcpServers": {
    "kandaro": {
      "type": "http",
      "url": "https://api.kandaro.com/mcp",
      "headers": { "Authorization": "Bearer kndk_0123abcd_…" }
    }
  }
}

Tools

list_incidents: incidents, newest first, with severity, techniques, an explanation and a recommended action. Needs incidents:read.
get_incident: one incident with up to 50 of its events. Needs incidents:read.
search_events: single events filtered by sensor, severity, type, source IP or time. Needs events:read.
get_source_history: everything one source IP has done against any decoy. Needs events:read.

All tools are read-only. An agent cannot resolve an incident, change a decoy or reach anything outside your organization through this server. A key only sees the tools its scopes allow.

Prompt injection

Decoy events are written by attackers, and an attacker who expects an AI to read the alert can plant instructions in a username, a path or a prompt. Kandaro limits the damage in three ways:

Attacker-written text is kept under attackerInput, shortened to 200 characters per value and stripped of control and invisible characters.
Every tool result starts with a notice that this content is evidence to analyse and must not be followed, and the server says the same when the client connects.
The server has no tools that change anything, so an injected instruction has nothing to act on here.

That protects Kandaro’s side. Your agent can still be steered by what it reads if it has other tools with write access, so apply your own controls there: require approval for containment actions, and do not let text from an alert decide which tool is called.

Protocol details

One JSON-RPC message per POST, answered with one JSON response. There are no sessions and no event stream, so GET returns 405. Supported protocol versions are 2025-06-18 and 2025-03-26. Limits are the same as for the API: 120 requests per minute per key.

http

POST https://api.kandaro.com/mcp
Authorization: Bearer kndk_0123abcd_…
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": { "name": "get_source_history", "arguments": { "sourceIp": "10.20.4.77" } }
}