I maintain the mcp‑soc repository on GitHub under @nikhil9622. It is a cloud‑native, multi‑tenant Security Operations Center written in Python.
The project started in March 2026 and was last updated in October 2026.
- Core stack: FastAPI + Uvicorn, ARQ async task queue, Redis Streams, MongoDB (Motor), AWS S3, Anthropic Claude API, SendGrid.
The test suite contains 64+ tests located in the tests/ directory.
POST /api/tenants/create
{
"email": "admin@example.com",
"plan": "pro"
}
Response:
{
"user_id": "tenant_abc123",
"api_key": "sk_live_...",
"created_at": "2024-06-15T14:30:00Z"
}
To get the service running locally I clone the repo, set up a virtual environment, copy .env.example to .env with my API keys, launch Redis and MongoDB with docker‑compose up -d, start the FastAPI broker via uvicorn main:app --reload --host <redacted> --port 8000, and then launch each ARQ worker in separate terminals.
Open questions include scaling ARQ workers beyond Docker‑compose, integrating a Prometheus/Grafana monitoring stack, handling multi‑region S3 storage for large tenants, and versioning custom Sigma rule sets.
- Pipeline agents: Ingestion → Detection → Correlation → Investigation → Alerting.
- Detection rules: 5 Sigma YAML rules.