Crowdsentinel Mcp Server
This server bridges Claude to your Elasticsearch or OpenSearch cluster for security operations. It exposes 79 MCP tools covering threat hunting queries, EVTX log analysis with Chainsaw, PCAP inspection via tshark, and live endpoint forensics through Velociraptor integration. The server bundles 6,060 preconverted detection rules (Lucene, EQL, ES|QL) and maintains an 8GB investigation memory for IoC correlation across tools. It's built for IR workflows where you need an LLM to pivot through logs, network captures, and endpoint artifacts using natural language while preserving investigative context. Includes a standalone CLI mode and structured prompts that guide agents through proper DFIR methodology. Ships with Sigma rule support and forensic playbooks exposed as MCP resources.
- tools
- 30
- auth
- Secret needed
- transport
- STDIO
- env vars
- 8
- last updated
- Jul 19, 2026
Tools
30 toolsPublic tool metadata for what this MCP can expose to an agent.
velociraptor_client_infoResolve hostnames, enumerate enrolled endpoints, discover available artefacts
Resolve hostnames, enumerate enrolled endpoints, discover available artefacts
No parameter schema in public metadata yet.
velociraptor_list_clientsResolve hostnames, enumerate enrolled endpoints, discover available artefacts
Resolve hostnames, enumerate enrolled endpoints, discover available artefacts
No parameter schema in public metadata yet.
velociraptor_list_artifactsResolve hostnames, enumerate enrolled endpoints, discover available artefacts
Resolve hostnames, enumerate enrolled endpoints, discover available artefacts
No parameter schema in public metadata yet.
velociraptor_collect_artifactCollect any Velociraptor artefact and fetch its results
Collect any Velociraptor artefact and fetch its results
No parameter schema in public metadata yet.
velociraptor_get_collection_resultsCollect any Velociraptor artefact and fetch its results
Collect any Velociraptor artefact and fetch its results
No parameter schema in public metadata yet.
velociraptor_pslistRunning processes, active network connections, accounts, groups, mounted volumes
Running processes, active network connections, accounts, groups, mounted volumes
No parameter schema in public metadata yet.
velociraptor_netstatRunning processes, active network connections, accounts, groups, mounted volumes
Running processes, active network connections, accounts, groups, mounted volumes
No parameter schema in public metadata yet.
velociraptor_usersRunning processes, active network connections, accounts, groups, mounted volumes
Running processes, active network connections, accounts, groups, mounted volumes
No parameter schema in public metadata yet.
velociraptor_groupsRunning processes, active network connections, accounts, groups, mounted volumes
Running processes, active network connections, accounts, groups, mounted volumes
No parameter schema in public metadata yet.
velociraptor_mountsRunning processes, active network connections, accounts, groups, mounted volumes
Running processes, active network connections, accounts, groups, mounted volumes
No parameter schema in public metadata yet.
velociraptor_prefetchForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_amcacheForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_shimcacheForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_userassistForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_bamForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_srumForensic proof of programme execution and resource usage
Forensic proof of programme execution and resource usage
No parameter schema in public metadata yet.
velociraptor_servicesService, scheduled task, and autorun persistence mechanisms
Service, scheduled task, and autorun persistence mechanisms
No parameter schema in public metadata yet.
velociraptor_scheduled_tasksService, scheduled task, and autorun persistence mechanisms
Service, scheduled task, and autorun persistence mechanisms
No parameter schema in public metadata yet.
velociraptor_autorunsService, scheduled task, and autorun persistence mechanisms
Service, scheduled task, and autorun persistence mechanisms
No parameter schema in public metadata yet.
velociraptor_shellbagsUser browsing, document access, link files, file downloads
User browsing, document access, link files, file downloads
No parameter schema in public metadata yet.
velociraptor_recentdocsUser browsing, document access, link files, file downloads
User browsing, document access, link files, file downloads
No parameter schema in public metadata yet.
velociraptor_lnkUser browsing, document access, link files, file downloads
User browsing, document access, link files, file downloads
No parameter schema in public metadata yet.
velociraptor_evidence_of_downloadUser browsing, document access, link files, file downloads
User browsing, document access, link files, file downloads
No parameter schema in public metadata yet.
velociraptor_ntfs_mftMFT search by name/path/timestamp, remote EVTX queries
MFT search by name/path/timestamp, remote EVTX queries
No parameter schema in public metadata yet.
velociraptor_evtxMFT search by name/path/timestamp, remote EVTX queries
MFT search by name/path/timestamp, remote EVTX queries
No parameter schema in public metadata yet.
correlate_siem_with_endpointValidate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
Validate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
No parameter schema in public metadata yet.
endpoint_to_siem_pivotValidate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
Validate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
No parameter schema in public metadata yet.
endpoint_hunt_from_iocValidate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
Validate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
No parameter schema in public metadata yet.
correlate_by_timeValidate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
Validate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
No parameter schema in public metadata yet.
build_unified_timelineValidate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
Validate SIEM findings on endpoints, pivot from endpoint IoCs to fleet-wide SIEM searches, unified timelines
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ELASTICSEARCH_HOSTSdefault: https://localhost:9200Comma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)
ELASTICSEARCH_CLOUD_IDElastic Cloud deployment ID (alternative to ELASTICSEARCH_HOSTS for cloud deployments)
ELASTICSEARCH_API_KEYsecretAPI key for authentication (recommended for production and Elastic Cloud)
ELASTICSEARCH_USERNAMEUsername for basic authentication (alternative to API key)
ELASTICSEARCH_PASSWORDsecretPassword for basic authentication (used with ELASTICSEARCH_USERNAME)
ELASTICSEARCH_BEARER_TOKENsecretBearer/service token for authentication (alternative to API key)
VERIFY_CERTSdefault: falseTLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)
REQUEST_TIMEOUTRequest timeout in seconds (e.g., 60 or 10.5)
Readme
CrowdSentinel MCP Server
AI-Powered Threat Hunting & Incident Response Framework
Details
- Repository
- github.com/thomasxm/crowdsentinels-ai-mcp
- Categories
- Databases, Monitoring & Observability
- Package
crowdsentinel-mcp-server- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
Related Databases MCP servers
View all
MCP Supersetbintocher/mcp-supersetApache Superset MCP server — 135+ tools for dashboards, charts, datasets, SQL Lab, and security45stars
Saga Mcpspranab/saga-mcpJira-like project tracker for AI agents with SQLite, full task hierarchy, and dashboard42stars
Local FAISS MCP Servernonatofabio/local_faiss_mcpLocal FAISS vector database for RAG with document ingestion, semantic search, and MCP prompts.30stars
Run402kychee-com/run402x402 pay-per-call infra for agents: $0.03 image generation, Postgres, auth, storage, functions.24stars
hmem — Humanlike Memory for AI Agentsbumblebiber/hmemPersistent 5-level hierarchical memory for AI agents. SQLite-backed, lazy-loaded.20stars