security-detections-mcp
bymhaggis· 1 MCP server
An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL security detection rules.
How to install security-detections-mcp?
mhaggis/security-detections-mcp
$git clone https://github.com/mhaggis/security-detections-mcpInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install security-detections-mcp by running `git clone https://github.com/mhaggis/security-detections-mcp`, then use it for the current task and follow its documentation at https://github.com/mhaggis/security-detections-mcp.
README.md
| 1 | # Security Detections MCP |
| 2 | |
| 3 | An MCP (Model Context Protocol) server that lets LLMs query a unified database of **Sigma**, **Splunk ESCU**, **Elastic**, **KQL**, **Sublime**, and **CrowdStrike CQL** security detection rules. |
| 4 | |
| 5 | > **New here? Start with the [Setup Guide](./SETUP.md)** -- covers macOS, Windows (WSL & native), and Linux step by step. |
| 6 | > |
| 7 | > **Want it hosted? Skip the install entirely: [Hosted MCP Setup Guide](./docs/HOSTED_MCP.md)** |
| 8 | |
| 9 | ## Two Ways to Run It |
| 10 | |
| 11 | **Local (full power)** — the npm package you're looking at. Runs on your machine, indexes your own detection repos, exposes all 81 tools. You need Node.js and ~10 minutes. |
| 12 | |
| 13 | **Hosted (zero setup)** — a Streamable HTTP server at [`detect.michaelhaag.org/api/mcp/mcp`](https://detect.michaelhaag.org/mcp). Sign up, generate a token, paste one URL into your MCP client. ~25 read-only tools, always in sync with the latest content, 200 calls/day free. Read on for quick-install buttons. |
| 14 | |
| 15 | ### Install — Local |
| 16 | |
| 17 | [](https://cursor.com/en/install-mcp?name=security-detections&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInNlY3VyaXR5LWRldGVjdGlvbnMtbWNwIl0sImVudiI6eyJTSUdNQV9QQVRIUyI6Ii9wYXRoL3RvL3NpZ21hL3J1bGVzLC9wYXRoL3RvL3NpZ21hL3J1bGVzLXRocmVhdC1odW50aW5nIiwiU1BMVU5LX1BBVEhTIjoiL3BhdGgvdG8vc2VjdXJpdHlfY29udGVudC9kZXRlY3Rpb25zIiwiU1RPUllfUEFUSFMiOiIvcGF0aC90by9zZWN1cml0eV9jb250ZW50L3N0b3JpZXMiLCJFTEFTVElDX1BBVEhTIjoiL3BhdGgvdG8vZGV0ZWN0aW9uLXJ1bGVzL3J1bGVzIiwiS1FMX1BBVEhTIjoiL3BhdGgvdG8va3FsLXJ1bGVzIiwiU1VCTElNRV9QQVRIUyI6Ii9wYXRoL3RvL3N1YmxpbWUtcnVsZXMvZGV0ZWN0aW9uLXJ1bGVzIiwiQ1FMX0hVQl9QQVRIUyI6Ii9wYXRoL3RvL2NxbC1odWIvcXVlcmllcyJ9fQ==) |
| 18 | [](https://vscode.dev/redirect?url=vscode:mcp/install?name=security-detections&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22security-detections-mcp%22%5D%7D) |
| 19 | [](https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?name=security-detections&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22security-detections-mcp%22%5D%7D) |
| 20 | |
| 21 | **Claude Code** (CLI one-liner): |
| 22 | |
| 23 | ```bash |
| 24 | claude mcp add security-detections -- npx -y security-detections-mcp |
| 25 | ``` |
| 26 | |
| 27 | **Claude Desktop** — add to `claude_desktop_config.json`: |
| 28 | |
| 29 | ```json |
| 30 | { |
| 31 | "mcpServers": { |
| 32 | "security-detections": { |
| 33 | "command": "npx", |
| 34 | "args": ["-y", "security-detections-mcp"] |
| 35 | } |
| 36 | } |
| 37 | } |
| 38 | ``` |
| 39 | |
| 40 | **OpenAI Codex** (CLI): |
| 41 | |
| 42 | ```bash |
| 43 | codex mcp add security-detections -- npx -y security-detections-mcp |
| 44 | ``` |
| 45 | |
| 46 | > After install, configure env vars (`SIGMA_PATHS`, `SPLUNK_PATHS`, etc.) to point at your detection repos. See the [Setup Guide](./SETUP.md) for full details. |
| 47 | |
| 48 | ### Install — Hosted (no setup, token required) |
| 49 | |
| 50 | 1. **Create a token** at [detect.michaelhaag.org/account/tokens](https://detect.michaelhaag.org/account/tokens). Free tier: 200 calls/day, all read-only tools. |
| 51 | 2. **Click the button for your client** — replace `sdmcp_YOUR_TOKEN_HERE` in the resulting config with the token you just generated. |
| 52 | |
| 53 | [](https://cursor.com/en/install-mcp?name=security-detections-hosted&config=eyJ1cmwiOiJodHRwczovL2RldGVjdC5taWNoYWVsaGFhZy5vcmcvYXBpL21jcC9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIgc2RtY3BfWU9VUl9UT0tFTl9IRVJFIn19) |
| 54 | [](https://vscode.dev/redirect?url=vscode:mcp/install?name=security-detections&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fdetect.michaelhaa |
Related
6 picksType
- mcp-scannerA tool to scan MCP servers and tools for security findingsJul 2026
- hol-guardOpen-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs.Jul 2026
- agent-scanAgent supply chain security scanner.Jul 2026
- falcon-mcpConnects AI agents with CrowdStrike Falcon for security analysis and automation.Jul 2026
- pythonPlug-and-play auth for Python MCP servers.Aug 2025
- auth0-mcp-serverAuth0 MCP Server: Manage Auth0 applications, APIs, actions, logs, and forms using natural languageJul 2026
