Agents & MCP
Two MCP servers that drive nano from Claude Code: nanodac for detection-as-code, nano-investigator for SOC operations
Agents & MCP
nano exposes two MCP (Model Context Protocol) servers that let Claude Code, or any MCP client, drive the platform through natural language. They cover the two halves of detection work:
- nanodac runs detection-as-code. An agent drafts parsers, detections, and searches, validates them, and ships them to nano through pull requests. It writes to the platform.
- nano-investigator runs SOC operations. An agent searches logs, triages alerts, investigates cases, and hunts threats. It reads first, but can also author cases, notebooks, and log-source parsers.
The hosted product builds these workflows into pivt AI. The open-source build ships without pivt, so these MCP servers are how you get agent-driven authoring and investigation. Both read the same NANOSIEM_API_URL and NANOSIEM_API_KEY, and you can run them side by side as separate MCP servers.
Which one do I want?
| nanodac (Detection-as-Code) | nano-investigator | |
|---|---|---|
| Job | Author and deploy detections, parsers, searches | Search, triage, investigate, hunt, build parsers |
| Direction | Writes rules to nano | Mostly reads; writes cases, notebooks, saved searches, and parsers |
| Workflow | GitOps: draft, validate, PR, sync | Interactive: ask a question, follow the investigation |
| Surface | nanodac CLI plus MCP server | 69 MCP tools plus 5 workflow prompts |
| Who | Detection engineers | SOC analysts and threat hunters |
The two cross over in one direction: when a hunt in nano-investigator surfaces something that deserves a standing rule, author that rule with nanodac.
Both can produce parsers, by different means. The detection-as-code flow drafts a version-controlled parser.yaml — validated with the vector vrl CLI and shipped by PR or UI import — while nano-investigator authors and deploys a parser interactively against a live tenant. Reach for the first when a parser should be reviewed and version-controlled, the second to stand one up fast on a running deployment. Detections, by contrast, are nanodac's alone.