Skip to content

Install the Sekoia plugins in Claude Code

This article explains how to connect Claude Code, Anthropic's command-line agent, to the Sekoia MCP Server with the Sekoia plugins. The plugins come from the Sekoia marketplace for Claude Code. Each one connects the server and adds skills that guide the assistant through Sekoia data.

Early Access

This feature is currently in Early Access and is only available for Beta testers. Sekoia plans to roll out this functionality to all environments soon.

Plugin For Skills
sekoia-cti CTI analysts, detection engineers, anyone who needs Sekoia threat intelligence query, exposure-assessment, threat-horizon-assessment, intelligence-delta, evidence-protocol, report-hunt
sekoia-soc SOC analysts working alerts, cases and hunts on their community alert-details, case-summary, sol-hunt

Install the plugin that matches your work, or both. See Plugins and skills for what each skill does.

Prerequisites

  • Claude Code installed and authenticated.
  • A Sekoia API key with the permissions of the plugin you install. See Permissions.

Only admins can create API keys

If you are not an admin, ask one to create the key for you. See Manage API keys.

Permissions

Plugin Permissions on the API key
sekoia-cti View intelligence. Add View query builder data sources and Execute query to check your own telemetry (exposure checks and FLINT hunt packs)
sekoia-soc View alerts, View cases, View events, View Rules Catalog, View query builder data sources, Execute query. Add View intelligence for the threat intelligence context of alerts

A key with fewer permissions still works: the skills say which step they skipped and which permission is missing.

Install the plugins

Keep the key out of your files

The plugins read the key from the SEKOIA_API_KEY environment variable when Claude Code starts. Never write the key into a .mcp.json file, a dotfiles repository or any file that could be committed. If the key is ever shared in plain text, revoke it and create a new one.

  1. Export your API key in the shell that starts Claude Code:

    export SEKOIA_API_KEY="YOUR_API_KEY"

  2. Start Claude Code.

  3. Add the Sekoia marketplace, the catalogue that distributes the Sekoia plugins:

    /plugin marketplace add SEKOIA-IO/claude-marketplace

  4. Install one or both plugins:

    /plugin install sekoia-cti@sekoia
/plugin install sekoia-soc@sekoia

    Not sure which one you need? See the SOC how-to guides for sekoia-soc and the Threat intelligence how-to guides for sekoia-cti.

  5. Restart Claude Code to load the plugins.

Installing both plugins registers the server once per plugin. This is harmless: the tools are namespaced per plugin.

Verify the connection

Type /mcp in Claude Code. The sekoia server is listed as connected, with its tools.

The tools listed depend on the permissions of your API key. If only the threat intelligence tools appear, the key lacks the SOC permissions listed above.

Use the skills

Ask in plain language. Claude Code picks the matching skill, which calls the tools for you:

What does Sekoia know about TeamTNT?

Get everything on alert AL2h7Kq9pXmW.

You can also call a skill by name, for example /sekoia-cti:query or /sekoia-soc:sol-hunt.

See the SOC how-to guides and the Threat intelligence how-to guides for more prompts.

Update the plugins

From a terminal, refresh the marketplace and update each installed plugin:

claude plugin marketplace update sekoia
claude plugin update sekoia-cti@sekoia
claude plugin update sekoia-soc@sekoia

Inside Claude Code:

  1. Run /plugin marketplace update sekoia.
  2. Open /plugin manage and update the installed plugins.
  3. Restart Claude Code to load the new version.

Remove the plugins

/plugin uninstall sekoia-cti@sekoia
/plugin uninstall sekoia-soc@sekoia

Revoke the API key in Settings > Workspace > API Keys if it is no longer needed.

Connect without the plugins

To use the tools without the skills, add the server to Claude Code directly. The assistant then chooses the tools on its own, without the guidance of the skills.

Keep the trailing slash

The URL must end with /. Without it, the server redirects and the connection fails with an error that looks like an authentication problem.

export SEKOIA_API_KEY="YOUR_API_KEY"
claude mcp add --transport http --scope user sekoia-mcp \
  https://api.sekoia.io/v1/generative/mcp/ \
  --header "Authorization: Bearer $SEKOIA_API_KEY"

The --scope user option makes the server available in every project; omit it to register the server for the current project only. Run claude mcp list to check the connection, and claude mcp remove sekoia-mcp to remove it.