Fleak joins the Databricks startup accelerator. See the announcement

Build pipelines in plain English. Let your agents run them over MCP.

Describe the pipeline and Fleak's copilot builds it for your review. Connect Claude Code, Cursor, or your own agents to Fleak's MCP server to build, inspect, and operate pipelines, and to pull OCSF-ready data on demand.

Book a demo See how it works
  • Copilot
  • MCP server
  • Claude Code
  • Cursor
  • Bring your own model
  • Human approval

T1 → T3

Detection fidelity

same AI engine, fed OCSF instead of raw logs

~40%

Lower token cost

after OCSF normalization, Gruve benchmark

0

Model or prompt changes

only the shape of the data changed

MCP gives agents access.
It doesn't make the data make sense.

Connecting an agent to a log source takes an afternoon. Getting it to reason correctly over fifty vendor dialects is the part that never ships.

Every field name is a guess

Agents hallucinate against vendor-specific field names or burn tokens retrying ambiguous queries. The same user shows up as three entities.

Parsing eats the budget

Tokens spent working out what a field means are tokens not spent on the investigation, and the cost repeats on every call.

AI in the data path is a risk

Letting a model rewrite production events means output you can't reproduce, inference cost on every event, and records nobody can audit.

A copilot for your engineers,
an MCP server for your agents.

The same Brain that writes mappings and routing rules for your team is available to your agents over MCP. The Muscle stays deterministic either way.

Pipelines from plain English

Describe what you want, such as failed logons to Sentinel and the rest to the lake, and the copilot builds the DAG for your review.

A copilot that knows your pipelines

Ask why a node fails, what a field means, or where volume is going. The copilot answers from your pipelines, your data, and the docs.

An MCP server for every agent

Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, and Gemini CLI connect over OAuth or an API key to build, inspect, and operate pipelines.

OCSF as an agent tool

Agents call create_mapping, segregate_logs, transform_logs, and validate_logs to get OCSF-shaped data on demand. An Agent Skill gives them the playbook.

Bring your own model

The Brain is LLM-agnostic. Run it on OpenAI, Anthropic, Azure OpenAI, or a model you host, under your own keys and governance.

No model in the data path

Whatever the copilot or an agent decides, the logic runs with your permissions on a deterministic engine. No model sits between your sources and your SIEM.

A governed gateway for every agent

Give first- and third-party agents just-in-time access to your systems, scoped by system, action, and data, with every call audited.

Build your own agents

Create micro-agents that run inside the pipeline for your team's own workflows, on the same deterministic engine.

Choose the autonomy

Run in assist mode with every change approved, or let agents act on their own within the guardrails you set.

Give your agents a schema.

One MCP server. Changes your team approves. Deterministic execution on every event.

Read the MCP docs Book a demo

The Brain proposes.
The Muscle runs it every time.

Engineers and agents ask the Brain for a pipeline, a mapping, or a fix, in plain English or over MCP. Once your team approves the result, the Muscle executes it deterministically on every production event. No agent ever sits in the live stream.

MCP clients

  • Claude Code
  • Claude Desktop
  • Cursor
  • VS Code
  • Windsurf
  • Gemini CLI

An AI SOC agent meets a log source it has never seen.
What happens next?

Without Fleak

Guessing

The agent reads raw vendor JSON, guesses what each field means, and spends tokens parsing before it can investigate.

With Fleak

OCSF

The agent calls Fleak over MCP, gets OCSF-shaped events back, and reasons over fields with defined meanings.

Trust model

Reviewed

Mapping rules are validated against the schema and approved by your team before they run on production data.

A top-tier observability platform runs this pattern in production: its AI agents call Fleak's MCP server for OCSF-ready data, agent to agent.

"Same AI engine, same SOC, same prompts. Only the data shape changed. After OCSF normalization, detection fidelity moved from Tier 1 to Tier 3 with about 40% lower token cost."
Read the benchmark →

Joint Fleak + Gruve benchmark, 2026

Bring the log source your agent struggles with.

30-minute working session. We'll connect an MCP client and map it live.

Read the docs Book a demo

Explore Related

AI observability

Every agent session on the record

Normalize, mask, and route AI agent telemetry.

See Detail →
Collection

Every source, one ingestion layer

Receivers, API connectors, and cloud log discovery.

See Detail →
Edge

Collect and filter at the source

One agent, managed centrally, cutting volume before it moves.

See Detail →