{"name":"io.github.thomasxm/crowdsentinel-mcp-server","slug":"thomasxm-crowdsentinel-mcp-server","title":null,"description":"AI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics","url":"https://mcp.market/server/thomasxm-crowdsentinel-mcp-server","rating":null,"grade":"B","score":78,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":41,"stars":206,"forks":32,"downloads_week":67,"last_push_at":"2026-07-19T21:09:49.000Z","license":"GPL-3.0"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/thomasxm/CrowdSentinels-AI-MCP","website":null,"version":"0.6.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"crowdsentinel-mcp-server","version":"0.6.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Comma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)","format":"string","default":"https://localhost:9200","name":"ELASTICSEARCH_HOSTS"},{"description":"Elastic Cloud deployment ID (alternative to ELASTICSEARCH_HOSTS for cloud deployments)","format":"string","name":"ELASTICSEARCH_CLOUD_ID"},{"description":"API key for authentication (recommended for production and Elastic Cloud)","format":"string","isSecret":true,"name":"ELASTICSEARCH_API_KEY"},{"description":"Username for basic authentication (alternative to API key)","format":"string","name":"ELASTICSEARCH_USERNAME"},{"description":"Password for basic authentication (used with ELASTICSEARCH_USERNAME)","format":"string","isSecret":true,"name":"ELASTICSEARCH_PASSWORD"},{"description":"Bearer/service token for authentication (alternative to API key)","format":"string","isSecret":true,"name":"ELASTICSEARCH_BEARER_TOKEN"},{"description":"TLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)","format":"string","default":"false","name":"VERIFY_CERTS"},{"description":"Request timeout in seconds (e.g., 60 or 10.5)","format":"string","name":"REQUEST_TIMEOUT"}]}],"tools":[{"name":"add_iocs_to_investigation","description":"Manually add IoCs to an investigation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analyze_failed_logins","description":"Analyze failed login attempts to detect potential brute force attacks. This tool aggregates failed login events (Event ID 4625) and identifies suspicious patterns.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analyze_kill_chain_stage","description":"","write_action":true,"price_micros":0,"input_schema":null},{"name":"analyze_process_creation","description":"Analyze process creation events (Event ID 4688) for suspicious activity. This is crucial for detecting malicious process execution and LOLBins usage.","write_action":false,"price_micros":0,"input_schema":null},{"name":"analyze_search_results","description":"Analyze search results and provide intelligent insights with follow-up recommendations. This is a critical tool for incident response - it acts like an experienced analyst by extracting IoCs, mapping to MITRE ATT&CK, assessing severity, and recommending next steps.","write_action":false,"price_micros":0,"input_schema":null},{"name":"build_unified_timeline","description":"Build a unified chronological timeline merging events from all sources.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_esql_support","description":"Check if the connected Elasticsearch cluster supports ES|QL.","write_action":false,"price_micros":0,"input_schema":null},{"name":"cleanup_storage","description":"Cleanup investigation storage and enforce size limits.","write_action":false,"price_micros":0,"input_schema":null},{"name":"close_investigation","description":"Close an investigation with a resolution summary.","write_action":false,"price_micros":0,"input_schema":null},{"name":"correlate_by_time","description":"Find co-occurring SIEM + endpoint activity in a time window.","write_action":false,"price_micros":0,"input_schema":null},{"name":"correlate_siem_with_endpoint","description":"Cross-correlate SIEM IoCs with live endpoint data via Velociraptor.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_data_stream","description":"Create a new data stream.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_index","description":"Create a new index.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_investigation","description":"Create a new investigation and make it active.","write_action":true,"price_micros":0,"input_schema":null},{"name":"decode_command","description":"Decode an obfuscated/encoded command line and recover the IoCs + ATT&CK techniques it conceals. Encoded payloads (e.g. `powershell -EncodedCommand <base64>`) hide their C2 IP/URL from plaintext hunting and from analyze_search_results — this tool peels the encoding (stdlib base64/UTF-16LE/gzip/hex; optional `chepy` for the long tail) so the hidden indicators become visible.","write_action":false,"price_micros":0,"input_schema":null},{"name":"delete_alias","description":"Delete an alias for a specific index.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_by_query","description":"Deletes documents matching the provided query.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_data_stream","description":"Delete one or more data streams.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_document","description":"Delete a document by ID.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_index","description":"Delete an index.","write_action":true,"price_micros":0,"input_schema":null},{"name":"detect_schema_for_index","description":"Detect which schema to use for an index pattern.","write_action":false,"price_micros":0,"input_schema":null},{"name":"discover_all_assets","description":"Discover all assets in the Elasticsearch cluster including indices, data streams, and their metadata. This will scan all indices and extract metadata like OS type, log source, field mappings, etc.","write_action":false,"price_micros":0,"input_schema":null},{"name":"discover_esql_indices","description":"Discover available indices for ES|QL hunting.","write_action":false,"price_micros":0,"input_schema":null},{"name":"endpoint_hunt_from_ioc","description":"Pivot an Elastic IoC into a targeted Velociraptor hunt (Elastic -> endpoint).","write_action":false,"price_micros":0,"input_schema":null},{"name":"endpoint_to_siem_pivot","description":"Collect an endpoint artifact, extract IoCs, then search SIEM for those IoCs across all hosts.","write_action":false,"price_micros":0,"input_schema":null},{"name":"enrich_iocs","description":"Enrich IoCs from the active investigation with external threat intelligence.","write_action":false,"price_micros":0,"input_schema":null},{"name":"eql_delete","description":"Delete an async EQL search by ID.","write_action":true,"price_micros":0,"input_schema":null},{"name":"eql_get_status","description":"Get the status of an async EQL search.","write_action":false,"price_micros":0,"input_schema":null},{"name":"eql_search","description":"Execute an EQL (Event Query Language) query for advanced threat hunting. EQL is designed for event-based data and is excellent for detecting attack patterns and sequences.","write_action":true,"price_micros":0,"input_schema":null},{"name":"esql_query","description":"Execute a raw ES|QL query for ad-hoc threat hunting.","write_action":true,"price_micros":0,"input_schema":null},{"name":"execute_detection_rule","description":"Execute a specific detection rule against Elasticsearch.","write_action":true,"price_micros":0,"input_schema":null},{"name":"execute_esql_hunt","description":"Execute a curated ES|QL hunting query from the rule library.","write_action":true,"price_micros":0,"input_schema":null},{"name":"execute_multiple_rules","description":"Execute multiple detection rules in batch.","write_action":true,"price_micros":0,"input_schema":null},{"name":"export_iocs","description":"Export IoCs from an investigation in various formats.","write_action":false,"price_micros":0,"input_schema":null},{"name":"export_to_misp","description":"Export investigation IoCs as a MISP event.","write_action":false,"price_micros":0,"input_schema":null},{"name":"general_api_request","description":"Perform a general HTTP API request. Use this tool for any Elasticsearch/OpenSearch API that does not have a dedicated tool.","write_action":false,"price_micros":0,"input_schema":null},{"name":"generate_investigation_report","description":"Generate a comprehensive investigation report from multiple analyses. This tool aggregates results from multiple queries and analyses to create a complete incident response report.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_alias","description":"Get alias information for a specific index.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_cluster_health","description":"Returns basic information about the health of the cluster.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_cluster_stats","description":"Returns high-level overview of cluster statistics.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_data_stream","description":"Get information about one or more data streams.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_diamond_model_guide","description":"Get the Diamond Model of Intrusion Analysis guide.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_document","description":"Get a document by ID.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_enrichment_status","description":"Check which threat intelligence providers are configured.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_esql_execution_history","description":"Get ES|QL query execution history for token usage analysis.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_esql_hunt_details","description":"Get detailed information about a specific ES|QL hunting rule.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_event_type_fields","description":"Get all fields available for a specific event type.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_field_mapping","description":"Get the actual field name for a semantic field concept.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_host_activity_timeline","description":"Get a complete timeline of all activity for a specific host. This is essential for forensic analysis and incident investigation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_index","description":"Returns information (mappings, settings, aliases) about one or more indices.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_index_metadata","description":"Get metadata for a specific index pattern.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_indices_by_type","description":"Get indices matching a specific log type.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_investigation_query","description":"Get the Elasticsearch query for an investigation prompt.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_investigation_summary","description":"Get a comprehensive summary of an investigation.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_kill_chain_overview","description":"Get a complete overview of the Cyber Kill Chain framework.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_progressive_disclosure","description":"Get progressive disclosure prompt for session start.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_pyramid_of_pain_guide","description":"Get the Pyramid of Pain framework guide for IoC prioritization.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_rule_details","description":"Get detailed information about a specific detection rule.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_rule_statistics","description":"Get comprehensive statistics about the detection rule library.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_saved_assets","description":"Retrieve previously discovered assets from the saved file.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_schema_details","description":"Get detailed information about a specific schema.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_shared_iocs","description":"Get IoCs shared across investigations and tools.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_system_status","description":"Report local CrowdSentinel system status and connector readiness.","write_action":false,"price_micros":0,"input_schema":null},{"name":"hunt_adjacent_stages","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"hunt_by_kill_chain_stage","description":"","write_action":true,"price_micros":0,"input_schema":null},{"name":"hunt_by_timeframe","description":"Hunt for specific attack patterns within a timeframe. This tool automatically searches for common attack indicators based on predefined patterns.","write_action":false,"price_micros":0,"input_schema":null},{"name":"hunt_for_ioc","description":"Hunt for a specific Indicator of Compromise (IoC) across logs. This tool searches multiple fields based on the IoC type.","write_action":false,"price_micros":0,"input_schema":null},{"name":"hunt_suspicious_process_activity","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"hunt_with_rule_category","description":"Execute all rules in a specific category for comprehensive hunting.","write_action":true,"price_micros":0,"input_schema":null},{"name":"hunt_with_sigma_rules","description":"Hunt for threats in EVTX logs using Sigma rules.","write_action":false,"price_micros":0,"input_schema":null},{"name":"index_document","description":"Creates or updates a document in the index.","write_action":true,"price_micros":0,"input_schema":null},{"name":"investigate_with_prompt","description":"Execute a specific investigation prompt against Elasticsearch.","write_action":true,"price_micros":0,"input_schema":null},{"name":"iterative_hunt","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_aliases","description":"List all aliases.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_available_capabilities","description":"List available CrowdSentinel capabilities grouped by category.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_available_schemas","description":"List all available log source schemas in the registry.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_detection_rules","description":"List available detection rules with optional filtering.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_esql_hunts","description":"List available ES|QL hunting queries from the curated rule library.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_indices","description":"List all indices.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_investigations","description":"List recent investigations with optional filtering.","write_action":false,"price_micros":0,"input_schema":null},{"name":"lookup_ioc","description":"Look up a single IoC across all configured threat intelligence providers.","write_action":false,"price_micros":0,"input_schema":null},{"name":"map_events_to_kill_chain","description":"Map Elasticsearch events to Cyber Kill Chain stages.","write_action":true,"price_micros":0,"input_schema":null},{"name":"osquery_processes","description":"List running processes via osquery (current host state).","write_action":false,"price_micros":0,"input_schema":null},{"name":"osquery_query","description":"Run an ad-hoc READ-ONLY osquery SQL query.","write_action":true,"price_micros":0,"input_schema":null},{"name":"osquery_sockets","description":"List process network sockets via osquery (active connections + listeners).","write_action":false,"price_micros":0,"input_schema":null},{"name":"osquery_users","description":"List user accounts via osquery. Captures username IoCs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"put_alias","description":"Create or update an alias for a specific index.","write_action":true,"price_micros":0,"input_schema":null},{"name":"quick_count","description":"Fast triage aggregation - counts without returning documents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"quick_triage","description":"Quick triage: Run top N priority prompts for fast initial assessment.","write_action":false,"price_micros":0,"input_schema":null},{"name":"resume_investigation","description":"Resume an existing investigation and make it active.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_documents","description":"Search for documents.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_ioc_in_evtx","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_rules_by_mitre_attack","description":"Search detection rules by MITRE ATT&CK tactic.","write_action":false,"price_micros":0,"input_schema":null},{"name":"search_with_lucene","description":"Execute a Lucene query string search for flexible threat hunting. Use this for custom queries that don't fit predefined patterns.","write_action":true,"price_micros":0,"input_schema":null},{"name":"show_investigation_prompts","description":"Display investigation triage questions for SIEM/SOAR.","write_action":false,"price_micros":0,"input_schema":null},{"name":"smart_search","description":"Token-efficient search with automatic summarization and PAGINATION.","write_action":false,"price_micros":0,"input_schema":null},{"name":"start_guided_investigation","description":"Start a guided investigation with all triage prompts for a platform.","write_action":false,"price_micros":0,"input_schema":null},{"name":"suggest_rules_for_data","description":"Analyze your data and suggest applicable detection rules.","write_action":false,"price_micros":0,"input_schema":null},{"name":"threat_hunt_search","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"validate_rule_for_data","description":"Validate if a detection rule is applicable to your data.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":78,"grade":"B","scanned_at":"2026-09-25T17:24:30.136Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-25T17:24:30.079Z","components":{"code":{"score":25,"max":25,"notes":["123 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 68 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"pypi","identifier":"crowdsentinel-mcp-server","version":"0.6.0","found":true,"weeklyDownloads":67,"license":"GPL-3.0-only","dependencyCount":16,"publishedAt":"2026-07-19T21:10:30.025412Z","repositoryUrl":"https://github.com/thomasxm/CrowdSentinels-AI-MCP"}],"repo":{"found":true,"owner":"thomasxm","repo":"CrowdSentinels-AI-MCP","archived":false,"pushedAt":"2026-07-19T21:09:49Z","stars":206,"forks":32,"openIssues":1,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/44269971?v=4","ownerCreatedAt":"2018-10-18T16:05:03Z","license":"GPL-3.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/44269971?v=4&s=128","source":"github"},"presence":{"stars":206,"forks":32,"downloadsWeek":67,"license":"GPL-3.0","lastPushAt":"2026-07-19T21:09:49.000Z","score":41}}}},"grade_history":[],"reviews":[]}