AiSOC — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track security-telemetry and agent-response integrations as the platform changes

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Security teams running a self-hosted AI-assisted SOC.

What we know

A self-hostable AI SOC for telemetry ingestion, threat correlation, auditable investigations and human-approved responses.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)chore(deps): bump actions/checkout from 4 to 7 ( 1149)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Tenant isolation/RBAC and connector scopes. Writes: Response actions are proposed for human approval.
Local admin; optional SAML/OIDC/SCIM
Sensitive access: Telemetry, Credentials, Alerts, Investigation records

The platform processes sensitive security telemetry and can coordinate response workflows; access and connector credentials require strong controls.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

2,385 repository stars

Stars observed Oct 6, 2026.

All limitations / Review context

What MCP endpoints and human-approval boundaries does the current AiSOC release document?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The platform processes sensitive security telemetry and can coordinate response workflows; access and connector credentials require strong controls.
Tenant isolation/RBAC and connector scopes.
Local admin; optional SAML/OIDC/SCIM
Security telemetry is stored/processed in the self-hosted deployment.
Reviewed write actions: Response actions are proposed for human approval
Sensitive access: Telemetry, Credentials, Alerts, Investigation records
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Resource classification remains unresolved.
Requires substantial Docker resources and first-run model download.
Not a drop-in SIEM replacement.

Original activity observations

2026-10-05T15:56:35Z: chore(deps): bump actions/checkout from 4 to 7 ( 1149)

Technical identity

github.com/beenuar/aisoc

Exact implementation source: https://github.com/beenuar/aisoc ↗
Reviewed resource type: Gateway
Repository identity: beenuar/AiSOC

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
beenuar/aisoc
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
beenuar.github.io/AiSOC/docs/installation
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Self-hosted gateway service setup

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Warning

Runs multiple services and processes security telemetry; do not launch automatically.
MCP client connection parameters require platform-specific doc, not implied by make up.
CLI and host are not automatically equivalent
A server registration is not a functional authenticated check
Credential revocation is external-provider-specific or not documented in examined official project Setup/README; do not assert exact revocation CLI.
No unique structured client config confirmed for this mode; may be inapplicable to Host/SDK/Framework.
Requires review of install side effects, credentials, remote scripts, or privileged application/database access before execution. Multiple publisher-documented README steps combined as an ordered excerpt; not a verbatim single publisher code block.
DO NOT use `make clean` for routine stopping: README says it removes the locally downloaded model and can affect volumes.
Back up `.env` secrets, telemetry and datastore before destructive reset.

Install / connect
Publisher instructions
AiSOC is a security operations application/gateway. Publisher has a deterministic offline sandbox demonstration, Codespaces path and multi-service Docker stack. Do not blindly execute curl | bash bootstrap before reviewing it.
Advanced configuration · self hosted install or run
self hosted install or run · Review before use
git clone https://github.com/beenuar/AiSOC && cd AiSOC make doctor make up
Configure / authenticate
Publisher instructions
Self-hosted AI SOC stack. Requires Docker Compose v2, ~8GB memory, ~20GB Docker disk and Python 3.9+. First launch generates 15 secrets and administrator password; safeguard them.
Check connection
Suggested check
For a safe demonstration use the official aisoc-sandbox demo in an isolated checkout; live stack acceptance requires a configured local deployment and may create events. An offline demo does not prove the MCP service is registered.
Remove / uninstall / revoke
MCP100 setup guide
Stop only this AiSOC self-hosted Docker Compose stack by its documented operator instructions; do not run destructive reset targets or delete investigation data.

Official Documentation & Sources

What it does

A self-hostable AI SOC for telemetry ingestion, threat correlation, auditable investigations and human-approved responses.

Capability: Security & Testing
Industry: Cybersecurity
Best fit: Security teams running a self-hosted AI-assisted SOC.

Representative uses

Ingest security telemetry
Correlate alerts and incidents
Use threat intelligence
Propose responses for approval

Limitations

Requires substantial Docker resources and first-run model download.
Not a drop-in SIEM replacement.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local admin; optional SAML/OIDC/SCIM
Permissions: Tenant isolation/RBAC and connector scopes.
Data handling: Security telemetry is stored/processed in the self-hosted deployment.
Cost: free
Risk and cautions: The platform processes sensitive security telemetry and can coordinate response workflows; access and connector credentials require strong controls.

Access scope and cautions

Write actions: Response actions are proposed for human approval
Sensitive access: Telemetry Credentials Alerts Investigation records
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Ingest security telemetry; Correlate alerts and incidents; Use threat intelligence; Propose responses for approval.

What authentication is documented?

Generated local admin; optional SAML/OIDC/SCIM.

Can it modify data or perform write operations?

Documented write actions include: Response actions are proposed for human approval. Recorded permission boundary: Tenant isolation/RBAC and connector scopes.

What data-handling boundary should I consider?

Security telemetry is stored/processed in the self-hosted deployment. Recorded sensitive-access context: Telemetry; Credentials; Alerts; Investigation records.

What limitations and risks should I check before use?

The platform processes sensitive security telemetry and can coordinate response workflows; access and connector credentials require strong controls. Requires substantial Docker resources and first-run model download. Not a drop-in SIEM replacement. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

beenuar / Cyble-supported project is listed as Community implementation in MCP100’s current evidence.