Security Detections MCP

An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, KQL, Sublime (Sublime Security and delivr.to), and CrowdStrike CQL security detection rules.

New here? Start with the Setup Guide -- covers macOS, Windows (WSL & native), and Linux step by step.

Want it hosted? Skip the install entirely: Hosted MCP Setup Guide

Two Ways to Run It

Local (full power) — the npm package you're looking at. Runs on your machine, indexes your own detection repos, exposes all 81 tools. You need Node.js and ~10 minutes.

Hosted (zero setup) — a Streamable HTTP server at detect.michaelhaag.org/api/mcp/mcp. Sign up, generate a token, paste one URL into your MCP client. ~25 read-only tools, always in sync with the latest content, 200 calls/day free. Read on for quick-install buttons.

Install — Local

Claude Code (CLI one-liner):

claude mcp add security-detections -- npx -y security-detections-mcp

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"]
    }
  }
}

OpenAI Codex (CLI):

codex mcp add security-detections -- npx -y security-detections-mcp

After install, configure env vars (SIGMA_PATHS, SPLUNK_PATHS, etc.) to point at your detection repos. See the Setup Guide for full details.

Install — Hosted (no setup, token required)

1. Create a token at detect.michaelhaag.org/account/tokens. Free tier: 200 calls/day, all read-only tools.
2. Click the button for your client — replace sdmcp_YOUR_TOKEN_HERE in the resulting config with the token you just generated.

Claude Code (CLI one-liner):

claude mcp add --transport http security-detections https://detect.michaelhaag.org/api/mcp/mcp --header "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"

Claude Desktop (via mcp-remote — Desktop doesn't speak remote HTTP natively yet):

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://detect.michaelhaag.org/api/mcp/mcp",
        "--header",
        "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"
      ]
    }
  }
}

OpenAI Codex (CLI):

export SDMCP_TOKEN="sdmcp_YOUR_TOKEN_HERE" && codex mcp add security-detections --url https://detect.michaelhaag.org/api/mcp/mcp --bearer-token-env-var SDMCP_TOKEN

See the Hosted MCP Setup Guide for the full table of clients, the complete tool inventory, and troubleshooting tips.

AI Model Routing (Web App)

The web chat supports Free, Pro/Admin, and BYOK (Bring Your Own Key) routing. You can also see the active model at the top of the chat UI.

Free Tier (default)

• Default model: nvidia/nemotron-3-super-120b-a12b:free
• Automatic fallback order if the first model is busy:
  1. nvidia/nemotron-3-super-120b-a12b:free
  2. nousresearch/hermes-3-llama-3.1-405b:free
  3. meta-llama/llama-3.3-70b-instruct:free
  4. openai/gpt-oss-120b:free

Pro/Admin (no BYOK key set)

Uses app-managed OpenRouter routing with your Preferred Model setting in /account:

BYOK behavior (takes precedence over tier routing)

If you set your own API key(s), routing priority is:

1. Claude key (sk-ant-...) -> claude-sonnet-4-6-20250514 via Anthropic
2. OpenAI key (sk-...) -> gpt-5.4 via OpenAI
3. OpenRouter key (sk-or-...) -> uses the same Preferred Model mapping table above

If multiple keys are present, the first match in that order is used.

Features

• 8,200+ detections across 6 formats — Sigma, Splunk ESCU, Elastic, KQL, Sublime, CrowdStrike CQL
• MITRE ATT&CK STIX — 172 threat actors, 784 software, 4,362 actor-technique relationships
• Procedure-level coverage — auto-extracted behavioral clusters from every detection rule
• ATT&CK Navigator layers — export coverage/gap JSON, filterable by source/tactic/severity/actor
• Autonomous pipeline — CTI ingestion → gap analysis → detection generation → Atomic testing → DRAFT PR (see Autonomous docs)
• 81 local tools / ~25 hosted tools — unified search, MITRE mapping, coverage analysis, knowledge graph, pattern learning, sprint planning
• 11 MCP Prompts — ransomware assessment, APT emulation, purple team, executive briefing, and more
• MCP Resources & Completions — readable context, autocomplete for technique IDs, CVEs, process names

Quick Start

npx -y security-detections-mcp

Or clone and build: git clone https://github.com/MHaggis/Security-Detections-MCP.git && cd Security-Detections-MCP && npm install && npm run build

Configure env vars to point at your detection repos:

See the Setup Guide for full per-client config examples (Cursor, VS Code, Claude Desktop, WSL).

Getting Detection Content

Download all sources with sparse checkout (rules only, not full repos):

mkdir -p detections && cd detections
git clone --depth 1 --filter=blob:none --sparse https://github.com/SigmaHQ/sigma.git && cd sigma && git sparse-checkout set rules rules-threat-hunting && cd ..
git clone --depth 1 --filter=blob:none --sparse https://github.com/splunk/security_content.git && cd security_content && git sparse-checkout set detections stories && cd ..
git clone --depth 1 --filter=blob:none --sparse https://github.com/elastic/detection-rules.git && cd detection-rules && git sparse-checkout set rules && cd ..
git clone --depth 1 https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git kql-bertjanp
git clone --depth 1 https://github.com/jkerai1/KQL-Queries.git kql-jkerai1
git clone --depth 1 --filter=blob:none --sparse https://github.com/sublime-security/sublime-rules.git && cd sublime-rules && git sparse-checkout set detection-rules && cd ..
git clone --depth 1 --filter=blob:none --sparse https://github.com/delivr-to/detections.git delivr-detections && cd delivr-detections && git sparse-checkout set sublime-rules && cd ..
git clone --depth 1 https://github.com/ByteRay-Labs/Query-Hub.git cql-hub

MCP Tools

Core Detection Tools

MITRE ATT&CK & Filtering

Coverage & Analysis (Token-Optimized)

Engineering, Knowledge Graph & More

81 tools total including pattern learning, template generation, knowledge graph, dynamic tables, and autonomous analysis. See the Tools Reference for the complete list.

MCP Prompts

11 pre-built expert workflows. Just ask by name:

You: "Run apt-threat-emulation for APT29"
→ Technique-by-technique coverage, gaps, and purple team test plan

Using with MITRE ATT&CK MCP

Pairs with mitre-attack-mcp for complete threat coverage analysis. Install both:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": { "SIGMA_PATHS": "/path/to/sigma/rules" }
    },
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": { "ATTACK_DOMAIN": "enterprise-attack" }
    }
  }
}

Stats

Development

npm install && npm run build && npm test

npm test builds a disposable SQLite index and requires SIGMA_PATHS, SPLUNK_PATHS, and STORY_PATHS to point to the cloned content described above. The database lifecycle and content tests never modify your normal user cache. For checks without external content, run npm run test:platform, npm run test:jamf, and npm run test:mcp. Set DETECTIONS_DB_PATH to select a separate database for server instances or automation; otherwise the normal ~/.cache/security-detections-mcp/detections.sqlite location is used.

Documentation

• Setup Guide — Full install walkthrough for all platforms
• Hosted MCP Guide — Hosted setup, token management, tool inventory
• Autonomous Platform — CTI-to-detection pipeline
• E2E Testing Guide — Per-SIEM setup (Splunk, Sentinel, Elastic, Sigma)
• Architecture — System design decisions
• Knowledge Graph — Tribal knowledge and analytical memory
• Engineering Intelligence — Pattern learning and templates
• Tools Reference — Complete reference for all 81 tools

License

Apache 2.0

Maintainer releases

The automatic release guide covers npm trusted publishing, the CI-to-release pipeline, MCP Registry updates, and failed-run recovery.