Malcolm MCP server

mcp-server-malcolm

<!-- mcp-name: io.github.nagameTW/mcp-server-malcolm -->

English | 繁體中文

The first MCP server for Malcolm, the open-source network traffic analysis platform (Zeek + Suricata + Arkime + OpenSearch, with optional NetBox).

It gives any MCP-compatible AI agent structured access to Malcolm: search and aggregate network traffic, discover field names, query Suricata alerts, browse Arkime sessions, resolve NetBox assets, and check system health. Turn on the write classes and it can also create alerts, tag sessions, launch hunts, and upload PCAP. It is read-only until you turn one on.

Contents

• Why an MCP layer
• Quick start
• 1. Install
• 2. Register it with your client
• 3. Connection settings
• 4. Enabling write tools (optional)
• Other ways to install
• Read-only until you opt in
• Read tools
• Write tools (opt-in)
• Trimming the read surface
• Security model

Why an MCP layer

Malcolm keeps all network metadata in one OpenSearch index (arkimesessions3-) with non-standard field names and its own filter syntax. An LLM asked to write raw OpenSearch DSL against that index gets it wrong more often than not. This server takes that job off the model:

• It exposes Malcolm's filter syntax instead of raw DSL.
• It provides field discovery so the model checks field names before it queries.
• It provides value enumeration so the model sees what values a field actually holds.
• It covers both field vocabularies. Arkime expressions take Arkime's own names (ip.src), the rest of Malcolm takes ECS names (source.ip), and Malcolm's own field list carries only the second set. arkimefieldsearch supplies the first.
• It wraps Suricata alert queries and handles the field mapping (suricata.alert. vs rule.).
• It adds NetBox asset context (IP-to-device, network segments).

The failure mode this is built against is a quiet one. Malcolm answers a query against a field it does not index with an empty result rather than an error, so a model that guesses a plausible-but-wrong name reads "no such traffic" and moves on. When a search comes back empty, this server checks the fields the query named and reports the name Malcolm actually stores the value under. That lookup runs only after a result set is already empty, so nothing is added to the model's context on queries that worked.

Shortened. The full README is on GitHub.