MCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch): threat-hunting access for AI agents
Runs locally over stdio
This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).
Run
uvx mcp-server-malcolm
MCP client config
{
"mcpServers": {
"mcp-server-malcolm": {
"command": "uvx",
"args": [
"mcp-server-malcolm"
]
}
}
}