Crowdsentinel MCP server

Read from the package source without running it. The installed server may list more.

• add_iocs_to_investigation

  Manually add IoCs to an investigation.

• analyze_failed_logins

  Analyze failed login attempts to detect potential brute force attacks. This tool aggregates failed login events (Event ID 4625) and identifies suspicious patterns.

• analyze_kill_chain_stagewrite action
• analyze_process_creation

  Analyze process creation events (Event ID 4688) for suspicious activity. This is crucial for detecting malicious process execution and LOLBins usage.

• analyze_search_results

  Analyze search results and provide intelligent insights with follow-up recommendations. This is a critical tool for incident response - it acts like an experienced analyst by extracting IoCs, mapping to MITRE ATT&CK, assessing severity, and recommending next steps.

• build_unified_timeline

  Build a unified chronological timeline merging events from all sources.

• check_esql_support

  Check if the connected Elasticsearch cluster supports ES|QL.

• cleanup_storage

  Cleanup investigation storage and enforce size limits.

• close_investigation

  Close an investigation with a resolution summary.

• correlate_by_time

  Find co-occurring SIEM + endpoint activity in a time window.

• correlate_siem_with_endpoint

  Cross-correlate SIEM IoCs with live endpoint data via Velociraptor.

• create_data_streamwrite action

  Create a new data stream.

• create_indexwrite action

  Create a new index.

• create_investigationwrite action

  Create a new investigation and make it active.

• decode_command

  Decode an obfuscated/encoded command line and recover the IoCs + ATT&CK techniques it conceals. Encoded payloads (e.g. `powershell -EncodedCommand <base64>`) hide their C2 IP/URL from plaintext hunting and from analyze_search_results — this tool peels the encoding (stdlib base64/UTF-16LE/gzip/hex; optional `chepy` for the long tail) so the hidden indicators become visible.

• delete_aliaswrite action

  Delete an alias for a specific index.

• delete_by_querywrite action

  Deletes documents matching the provided query.

• delete_data_streamwrite action

  Delete one or more data streams.

• delete_documentwrite action

  Delete a document by ID.

• delete_indexwrite action

  Delete an index.

• detect_schema_for_index

  Detect which schema to use for an index pattern.

• discover_all_assets

  Discover all assets in the Elasticsearch cluster including indices, data streams, and their metadata. This will scan all indices and extract metadata like OS type, log source, field mappings, etc.

• discover_esql_indices

  Discover available indices for ES|QL hunting.

• endpoint_hunt_from_ioc

  Pivot an Elastic IoC into a targeted Velociraptor hunt (Elastic -> endpoint).

• endpoint_to_siem_pivot

  Collect an endpoint artifact, extract IoCs, then search SIEM for those IoCs across all hosts.

• enrich_iocs

  Enrich IoCs from the active investigation with external threat intelligence.

• eql_deletewrite action

  Delete an async EQL search by ID.

• eql_get_status

  Get the status of an async EQL search.

• eql_searchwrite action

  Execute an EQL (Event Query Language) query for advanced threat hunting. EQL is designed for event-based data and is excellent for detecting attack patterns and sequences.

• esql_querywrite action

  Execute a raw ES|QL query for ad-hoc threat hunting.

• execute_detection_rulewrite action

  Execute a specific detection rule against Elasticsearch.

• execute_esql_huntwrite action

  Execute a curated ES|QL hunting query from the rule library.

• execute_multiple_ruleswrite action

  Execute multiple detection rules in batch.

• export_iocs

  Export IoCs from an investigation in various formats.

• export_to_misp

  Export investigation IoCs as a MISP event.

• general_api_request

  Perform a general HTTP API request. Use this tool for any Elasticsearch/OpenSearch API that does not have a dedicated tool.

• generate_investigation_report

  Generate a comprehensive investigation report from multiple analyses. This tool aggregates results from multiple queries and analyses to create a complete incident response report.

• get_alias

  Get alias information for a specific index.

• get_cluster_health

  Returns basic information about the health of the cluster.

• get_cluster_stats

  Returns high-level overview of cluster statistics.

• get_data_stream

  Get information about one or more data streams.

• get_diamond_model_guide

  Get the Diamond Model of Intrusion Analysis guide.

• get_document

  Get a document by ID.

• get_enrichment_status

  Check which threat intelligence providers are configured.

• get_esql_execution_history

  Get ES|QL query execution history for token usage analysis.

• get_esql_hunt_details

  Get detailed information about a specific ES|QL hunting rule.

• get_event_type_fields

  Get all fields available for a specific event type.

• get_field_mapping

  Get the actual field name for a semantic field concept.

• get_host_activity_timeline

  Get a complete timeline of all activity for a specific host. This is essential for forensic analysis and incident investigation.

• get_index

  Returns information (mappings, settings, aliases) about one or more indices.

• get_index_metadata

  Get metadata for a specific index pattern.

• get_indices_by_type

  Get indices matching a specific log type.

• get_investigation_query

  Get the Elasticsearch query for an investigation prompt.

• get_investigation_summary

  Get a comprehensive summary of an investigation.

• get_kill_chain_overviewwrite action

  Get a complete overview of the Cyber Kill Chain framework.

• get_progressive_disclosure

  Get progressive disclosure prompt for session start.

• get_pyramid_of_pain_guide

  Get the Pyramid of Pain framework guide for IoC prioritization.

• get_rule_details

  Get detailed information about a specific detection rule.

• get_rule_statistics

  Get comprehensive statistics about the detection rule library.

• get_saved_assets

  Retrieve previously discovered assets from the saved file.

• get_schema_details

  Get detailed information about a specific schema.

• get_shared_iocs

  Get IoCs shared across investigations and tools.

• get_system_status

  Report local CrowdSentinel system status and connector readiness.

• hunt_adjacent_stages
• hunt_by_kill_chain_stagewrite action
• hunt_by_timeframe

  Hunt for specific attack patterns within a timeframe. This tool automatically searches for common attack indicators based on predefined patterns.

• hunt_for_ioc

  Hunt for a specific Indicator of Compromise (IoC) across logs. This tool searches multiple fields based on the IoC type.

• hunt_suspicious_process_activity
• hunt_with_rule_categorywrite action

  Execute all rules in a specific category for comprehensive hunting.

• hunt_with_sigma_rules

  Hunt for threats in EVTX logs using Sigma rules.

• index_documentwrite action

  Creates or updates a document in the index.

• investigate_with_promptwrite action

  Execute a specific investigation prompt against Elasticsearch.

• iterative_hunt
• list_aliases

  List all aliases.

• list_available_capabilities

  List available CrowdSentinel capabilities grouped by category.

• list_available_schemas

  List all available log source schemas in the registry.

• list_detection_rules

  List available detection rules with optional filtering.

• list_esql_hunts

  List available ES|QL hunting queries from the curated rule library.

• list_indices

  List all indices.

• list_investigations

  List recent investigations with optional filtering.

• lookup_ioc

  Look up a single IoC across all configured threat intelligence providers.

• map_events_to_kill_chainwrite action

  Map Elasticsearch events to Cyber Kill Chain stages.

• osquery_processes

  List running processes via osquery (current host state).

• osquery_querywrite action

  Run an ad-hoc READ-ONLY osquery SQL query.

• osquery_sockets

  List process network sockets via osquery (active connections + listeners).

• osquery_users

  List user accounts via osquery. Captures username IoCs.

• put_aliaswrite action

  Create or update an alias for a specific index.

• quick_count

  Fast triage aggregation - counts without returning documents.

• quick_triage

  Quick triage: Run top N priority prompts for fast initial assessment.

• resume_investigation

  Resume an existing investigation and make it active.

• search_documents

  Search for documents.

• search_ioc_in_evtx
• search_rules_by_mitre_attack

  Search detection rules by MITRE ATT&CK tactic.

• search_with_lucenewrite action

  Execute a Lucene query string search for flexible threat hunting. Use this for custom queries that don't fit predefined patterns.

• show_investigation_prompts

  Display investigation triage questions for SIEM/SOAR.

• smart_search

  Token-efficient search with automatic summarization and PAGINATION.

• start_guided_investigation

  Start a guided investigation with all triage prompts for a platform.

• suggest_rules_for_data

  Analyze your data and suggest applicable detection rules.

• threat_hunt_search
• validate_rule_for_data

  Validate if a detection rule is applicable to your data.

• Code scan123 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 68 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

78/100

higher than 57% of 48,273 servers

Tools

100

the typical server has 7

Tools that change things

24%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

206

more than 95% of 28,534 servers

Downloads a week

67

more than 54% of 11,915 servers with a package

Crowdsentinel: common questions

Is Crowdsentinel MCP server safe?

Mostly: it is graded B (78/100). Read the Crowdsentinel safety report

How do I install Crowdsentinel?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Crowdsentinel need an API key?

Yes. The registry entry asks for ELASTICSEARCH_API_KEY, ELASTICSEARCH_PASSWORD, ELASTICSEARCH_BEARER_TOKEN.

Is Crowdsentinel maintained?

The last commit was 106 days ago (2026-07-19). The latest release is v0.6.0.

How does Crowdsentinel compare with other MCP servers?

safety score 78/100 (higher than 57% of 48,273 servers); tools 100 (the typical server has 7); tools that change things 24% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.