Security Detections MCP

An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL security detection rules.

New here? Start with the Setup Guide -- covers macOS, Windows (WSL & native), and Linux step by step.

Want it hosted? Skip the install entirely: Hosted MCP Setup Guide

Two Ways to Run It

Local (full power) — the npm package you're looking at. Runs on your machine, indexes your own detection repos, exposes all 81 tools. You need Node.js and ~10 minutes.

Hosted (zero setup) — a Streamable HTTP server at detect.michaelhaag.org/api/mcp/mcp. Sign up, generate a token, paste one URL into your MCP client. ~25 read-only tools, always in sync with the latest content, 200 calls/day free. Read on for quick-install buttons.

Install — Local

Claude Code (CLI one-liner):

claude mcp add security-detections -- npx -y security-detections-mcp

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"]
    }
  }
}

OpenAI Codex (CLI):

codex mcp add security-detections -- npx -y security-detections-mcp

After install, configure env vars (SIGMA_PATHS, SPLUNK_PATHS, etc.) to point at your detection repos. See the Setup Guide for full details.

Install — Hosted (no setup, token required)

1. Create a token at detect.michaelhaag.org/account/tokens. Free tier: 200 calls/day, all read-only tools.
2. Click the button for your client — replace sdmcp_YOUR_TOKEN_HERE in the resulting config with the token you just generated.

Claude Code (CLI one-liner):

claude mcp add --transport http security-detections https://detect.michaelhaag.org/api/mcp/mcp --header "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"

Claude Desktop (via mcp-remote — Desktop doesn't speak remote HTTP natively yet):

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://detect.michaelhaag.org/api/mcp/mcp",
        "--header",
        "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"
      ]
    }
  }
}

OpenAI Codex (CLI):

export SDMCP_TOKEN="sdmcp_YOUR_TOKEN_HERE" && codex mcp add security-detections --url https://detect.michaelhaag.org/api/mcp/mcp --bearer-token-env-var SDMCP_TOKEN

See the Hosted MCP Setup Guide for the full table of clients, the complete tool inventory, and troubleshooting tips.

AI Model Routing (Web App)

The web chat supports Free, Pro/Admin, and BYOK (Bring Your Own Key) routing. You can also see the active model at the top of the chat UI.

Free Tier (default)

• Default model: nvidia/nemotron-3-super-120b-a12b:free
• Automatic fallback order if the first model is busy:
  1. nvidia/nemotron-3-super-120b-a12b:free
  2. nousresearch/hermes-3-llama-3.1-405b:free
  3. meta-llama/llama-3.3-70b-instruct:free
  4. openai/gpt-oss-120b:free

Pro/Admin (no BYOK key set)

Uses app-managed OpenRouter routing with your Preferred Model setting in /account:

Preferred Model	Routed model
auto	Free model pool (default: nvidia/nemotron-3-super-120b-a12b:free)
claude	anthropic/claude-sonnet-4-6
claude-opus	anthropic/claude-opus-4-6
gpt	openai/gpt-5.4
gpt-codex	openai/gpt-5.3-codex

BYOK behavior (takes precedence over tier routing)

If you set your own API key(s), routing priority is:

1. Claude key (sk-ant-...) -> claude-sonnet-4-6-20250514 via Anthropic
2. OpenAI key (sk-...) -> gpt-5.4 via OpenAI
3. OpenRouter key (sk-or-...) -> uses the same Preferred Model mapping table above

If multiple keys are present, the first match in that order is used.

Features

• 8,200+ detections across 6 formats — Sigma, Splunk ESCU, Elastic, KQL, Sublime, CrowdStrike CQL
• MITRE ATT&CK STIX — 172 threat actors, 784 software, 4,362 actor-technique relationships
• Procedure-level coverage — auto-extracted behavioral clusters from every detection rule
• ATT&CK Navigator layers — export coverage/gap JSON, filterable by source/tactic/severity/actor
• Autonomous pipeline — CTI ingestion → gap analysis → detection generation → Atomic testing → DRAFT PR (see Autonomous docs)
• 81 local tools / ~25 hosted tools — unified search, MITRE mapping, coverage analysis, knowledge graph, pattern learning, sprint planning
• 11 MCP Prompts — ransomware assessment, APT emulation, purple team, executive briefing, and more
• MCP Resources & Completions — readable context, autocomplete for technique IDs, CVEs, process names

Quick Start

npx -y security-detections-mcp

Or clone and build: git clone https://github.com/MHaggis/Security-Detections-MCP.git && cd Security-Detections-MCP && npm install && npm run build

Configure env vars to point at your detection repos:

Variable	Description
SIGMA_PATHS	Sigma rule directories
SPLUNK_PATHS	Splunk ESCU detection directories
ELASTIC_PATHS	Elastic detection rule directories
KQL_PATHS	KQL hunting query directories
SUBLIME_PATHS	Sublime Security rule directories
CQL_HUB_PATHS	CQL Hub (CrowdStrike) query directories
JAMF_PROTECT_PATHS	Jamf Protect custom analytic detection directories (macOS)
STORY_PATHS	Splunk analytic story directories (optional)
ATTACK_STIX_PATH	Path to enterprise-attack.json for threat actor data (optional)

See the Setup Guide for full per-client config examples (Cursor, VS Code, Claude Desktop, WSL).

Getting Detection Content

Download all sources with sparse checkout (rules only, not full repos):

mkdir -p detections && cd detections
git clone --depth 1 --filter=blob:none --sparse https://github.com/SigmaHQ/sigma.git && cd sigma && git sparse-checkout set rules rules-threat-hunting && cd ..
git clone --depth 1 --filter=blob:none --sparse https://github.com/splunk/security_content.git && cd security_content && git sparse-checkout set detections stories && cd ..
git clone --depth 1 --filter=blob:none --sparse https://github.com/elastic/detection-rules.git && cd detection-rules && git sparse-checkout set rules && cd ..
git clone --depth 1 https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git kql-bertjanp
git clone --depth 1 https://github.com/jkerai1/KQL-Queries.git kql-jkerai1
git clone --depth 1 --filter=blob:none --sparse https://github.com/sublime-security/sublime-rules.git && cd sublime-rules && git sparse-checkout set detection-rules && cd ..
git clone --depth 1 https://github.com/ByteRay-Labs/Query-Hub.git cql-hub

MCP Tools

Core Detection Tools

Tool	Description
search(query, limit)	Full-text search across all detection fields
get_by_id(id)	Get a single detection by ID
list_all(limit, offset)	Paginated list of all detections
list_by_source(source_type)	Filter by source (sigma, splunk_escu, elastic, kql, sublime, crowdstrike_cql, jamf_protect)
get_stats()	Index statistics
rebuild_index()	Force re-index from configured paths

MITRE ATT&CK & Filtering

Tool	Description
list_by_mitre(technique_id)	Filter by technique ID (e.g., T1059.001)
list_by_mitre_tactic(tactic)	Filter by tactic (execution, persistence, etc.)
list_by_cve(cve_id)	Find detections for a CVE
list_by_process_name(process_name)	Find detections referencing a process
list_by_severity(level)	Filter by severity level
list_by_data_source(data_source)	Filter by data source

Coverage & Analysis (Token-Optimized)

Tool	Description
analyze_coverage(source_type?)	Coverage stats by tactic, top techniques, weak spots (~2KB)
identify_gaps(threat_profile)	Find gaps for ransomware, apt, persistence, etc. (~500B)
suggest_detections(technique_id)	Detection ideas for a technique (~2KB)
get_coverage_summary(source_type?)	Tactic percentages (~200B)
analyze_actor_coverage(actor)	Coverage against a specific threat actor
compare_actor_coverage(actors)	Compare coverage across multiple actors
analyze_procedure_coverage(technique_id)	Behavioral procedure breakdown
generate_navigator_layer(...)	Export ATT&CK Navigator JSON layers

Engineering, Knowledge Graph & More

81 tools total including pattern learning, template generation, knowledge graph, dynamic tables, and autonomous analysis. See the Tools Reference for the complete list.

MCP Prompts

11 pre-built expert workflows. Just ask by name:

Prompt	Description
ransomware-readiness-assessment	Full kill-chain analysis with risk scoring
apt-threat-emulation	Coverage against specific threat actors (APT29, Lazarus, etc.)
purple-team-exercise	Complete test plans with procedures and expected detections
soc-investigation-assist	Triage guidance, hunting queries, escalation criteria
detection-engineering-sprint	Prioritized backlog with user stories
executive-security-briefing	C-level report with business risk language
cve-response-assessment	Rapid assessment for emerging CVEs
data-source-gap-analysis	Telemetry requirements analysis
detection-quality-review	Deep-dive quality analysis for a technique
threat-landscape-sync	Align priorities with current threats
detection-coverage-diff	Compare coverage against actors or baseline

You: "Run apt-threat-emulation for APT29"
→ Technique-by-technique coverage, gaps, and purple team test plan

Using with MITRE ATT&CK MCP

Pairs with mitre-attack-mcp for complete threat coverage analysis. Install both:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": { "SIGMA_PATHS": "/path/to/sigma/rules" }
    },
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": { "ATTACK_DOMAIN": "enterprise-attack" }
    }
  }
}

Stats

Source	Count
Sigma Rules	~3,200+
Splunk ESCU	~2,000+
Elastic Rules	~1,500+
KQL Queries	~420+
Sublime Rules	~900+
CrowdStrike CQL	~139+
Total	~8,200+

Development

npm install && npm run build && npm test

Documentation

• Setup Guide — Full install walkthrough for all platforms
• Hosted MCP Guide — Hosted setup, token management, tool inventory
• Autonomous Platform — CTI-to-detection pipeline
• E2E Testing Guide — Per-SIEM setup (Splunk, Sentinel, Elastic, Sigma)
• Architecture — System design decisions
• Knowledge Graph — Tribal knowledge and analytical memory
• Engineering Intelligence — Pattern learning and templates
• Tools Reference — Complete reference for all 81 tools

License

Apache 2.0