nano-investigator MCP

@nano-rs/investigator-mcp-server is an MCP server that exposes nano's analyst surfaces to a coding agent over stdio. It registers ~70 tools, five prompts, and a set of resources, then proxies each call to your nano API and search service — so you can search logs, triage alerts, investigate cases, hunt threats, and even author parsers through natural language.

{
  "mcpServers": {
    "nano-investigator": {
      "command": "npx",
      "args": ["-y", "@nano-rs/investigator-mcp-server"],
      "env": {
        "NANOSIEM_API_URL": "https://your-nano.example.com",
        "NANOSIEM_API_KEY": "your-api-key"
      }
    }
  }
}

Drop that into your MCP config (~/.claude/settings.json, or a project .mcp.json), restart your agent, and run /mcp to confirm it's connected. npx fetches the published package on first launch — nothing to clone or build.

What you can ask

> how many alerts fired today?
> investigate alert 456
> what do we know about 10.5.2.40?
> search for failed logins in the last 24 hours
> who are the riskiest entities right now?
> create a case for the DNS exfil from 10.5.2.40
> hunt for lateral movement in the last 7 days
> build a parser for these logs

Configuration

The server reads exactly three environment variables:

How it differs from nanodac

nanodac writes detection rules; nano-investigator operates the SIEM — search, triage, investigate, hunt, and build parsers. They run side by side as separate MCP servers sharing the same environment variables. nano-investigator reads detections but never edits them (that's nanodac's job), and it's read-first overall: it only writes cases, notebooks, and parsers.

Next steps

• Investigator overview — the full tool surface and what writes vs reads
• Setup — config, API key permissions, and verification
• Triage · Investigate · Hunt — work the queue and run investigations
• Tool Reference — every tool, prompt, and resource