Command Zero Adds APIs and MCP Server for Autonomous SOC Integration

Command Zero has released a set of API endpoints and a Model Context Protocol (MCP) server for its Autonomous and AI-Assisted SOC platform, announced in a press release. The update enables Security Operations teams to build custom tools, automate investigations, and connect threat response processes directly to Command Zero’s large language model based agents.

The new endpoints include investigation, business context, catalog, schema, and remediation APIs. These allow users to start, extend, and retrieve investigations, manage contextual data from systems such as ServiceNow, and execute remediation actions from external platforms. The MCP server acts as a wrapper that lets AI agents like Claude access Command Zero directly to query investigations, triage cases, and generate reports through a conversational interface.

Customers can integrate the platform into SOAR playbooks, orchestration pipelines, or internal dashboards. Technical partners can also use the APIs to build integrations and workflows that connect Command Zero’s capabilities with other tools. The company plans to expand the available endpoints and publish reference integrations in the weeks following the launch.