MCP_AI_SOC_Sher is a powerful AI-driven Security Operations Center (SOC) framework built on MCP Server, focusing on Text2SQL conversion and security threat analysis. Its main features and usage are as follows.
[Purpose] This tool is used to dynamically convert natural language prompts into SQL queries, and in the process integrates security threat analysis and monitoring, targeting security operations scenarios.
[Main Capabilities]
- Text2SQL conversion: converts natural language queries into optimized SQL statements.
- Multi-interface support: supports three interfaces: STDIO, SSE, and REST API.
- Security threat analysis: built-in SQL query security analysis functionality.
- Multi-database support: can connect to SQLite or Snowflake databases.
- Streaming responses: provides real-time query processing feedback.
- SOC monitoring: has Security Operations Center monitoring capabilities.
[Security Features]
- Rule-based and AI-driven SQL query security analysis
- Detects potential SQL injection attacks
- Sensitive table access monitoring
- Configurable security levels and actions
[Usage] Command-line usage: a .env file needs to be created for configuration; please refer to the documentation for specific configuration options.
[Applicable Scenarios] Suitable for threat analysis and monitoring tasks in a Security Operations Center (SOC), especially scenarios that require converting natural language queries into SQL and interacting with databases.
[Limitations] The project uses the MIT License with additional conditions, copyright owned by Akram Sheriff (2025). Other limitation information is not yet provided.
