M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionCrowdsentinel MCP ServerAI-powered threat hunting & incident response MCP server for Elasticsearch/OpenSearch.DBHubBytebase's official, minimalist two-tool database MCP server
FMRS59 / 100 · C74 / 100 · B
Reliability8 / 2013 / 20
Security and permissions12 / 2013 / 20
Maintenance13 / 2016 / 20
Documentation12 / 2015 / 20
Setup experience14 / 2017 / 20
Best for
  • Security analysts conducting threat hunting in Elasticsearch or OpenSearch environments
  • Incident responders needing AI-assisted investigation workflows
  • Red teams/security testers analyzing attack simulation data
  • Researchers using cyber range environments like crowdsentinel-range
  • Scenarios wanting the smallest possible tool count and lowest context-window overhead for database access
  • Cases needing to grant non-technical teammates safe, read-only database access
Not for
  • Production environments (explicitly warned not for production)
  • Users without security background (targets DFIR professionals)
  • Users needing Splunk integration (still on roadmap)
  • Users relying on a single data source (integrates with multiple)
  • Scenarios needing database administration operations (creating indexes, altering schema) rather than just querying (DBHub is positioned as a query tool, not a DBA management tool)
Required permissions
  • Requires Elasticsearch/OpenSearch credentials (API key or username/password)
  • Can read and write Elasticsearch indices (can be restricted via DISABLE_HIGH_RISK_OPERATIONS)
  • Optional API keys for external threat intelligence services (VirusTotal, Shodan, etc.)
  • Requires local system permissions to run tools like osquery and tshark
  • Requires Velociraptor API configuration for endpoint forensics
  • Requires a database connection string (DSN), which may contain sensitive credentials
  • execute_sql can run arbitrary SQL (including writes) by default — must be constrained via read-only mode or the underlying database account's own permissions
Risks and side effects
  • High-risk operations: can create/delete indices, documents, data streams, and aliases
  • Potential sensitive data exposure: searches may return documents containing PII or sensitive security data
  • TLS verification disabled by default (VERIFY_CERTS default false), risk of man-in-the-middle attacks
  • External service dependencies: requires access to threat intelligence APIs, may incur costs or rate limits
  • Active development status: APIs may change, not suitable for production
  • Under default settings, if the connected database account has write access, execute_sql could let the assistant perform an unintended write or delete — pair with a read-only database account in production
  • The DSN contains a plaintext password — pay attention to the access permissions on wherever the config is stored
Supported clientsClaude Code, Claude Desktop, VS Code, Cursor, Roo Code, 5ireClaude Desktop, Claude Code, VS Code, Cursor, Zed
Tools02