M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionCrowdsentinel MCP ServerAI-powered threat hunting & incident response MCP server for Elasticsearch/OpenSearch.MCP ClickHouseConnect ClickHouse to your AI assistants
FMRS59 / 100 · C79 / 100 · B
Reliability8 / 2012 / 20
Security and permissions12 / 2018 / 20
Maintenance13 / 2017 / 20
Documentation12 / 2017 / 20
Setup experience14 / 2015 / 20
Best for
  • Security analysts conducting threat hunting in Elasticsearch or OpenSearch environments
  • Incident responders needing AI-assisted investigation workflows
  • Red teams/security testers analyzing attack simulation data
  • Researchers using cyber range environments like crowdsentinel-range
  • Teams already using ClickHouse who want AI assistants to access data directly.
  • Scenarios requiring fast, read-only data queries and schema exploration.
Not for
  • Production environments (explicitly warned not for production)
  • Users without security background (targets DFIR professionals)
  • Users needing Splunk integration (still on roadmap)
  • Users relying on a single data source (integrates with multiple)
  • Scenarios requiring write access to the database without explicit opt-in.
  • Production environments with stringent security requirements that avoid default permission settings.
Required permissions
  • Requires Elasticsearch/OpenSearch credentials (API key or username/password)
  • Can read and write Elasticsearch indices (can be restricted via DISABLE_HIGH_RISK_OPERATIONS)
  • Optional API keys for external threat intelligence services (VirusTotal, Shodan, etc.)
  • Requires local system permissions to run tools like osquery and tshark
  • Requires Velociraptor API configuration for endpoint forensics
  • Requires read-only access to ClickHouse database (default).
  • Optional: write access via CLICKHOUSE_ALLOW_WRITE_ACCESS.
  • Optional: destructive operations via CLICKHOUSE_ALLOW_DROP.
Risks and side effects
  • High-risk operations: can create/delete indices, documents, data streams, and aliases
  • Potential sensitive data exposure: searches may return documents containing PII or sensitive security data
  • TLS verification disabled by default (VERIFY_CERTS default false), risk of man-in-the-middle attacks
  • External service dependencies: requires access to threat intelligence APIs, may incur costs or rate limits
  • Active development status: APIs may change, not suitable for production
  • If write access is enabled, AI might make unintended modifications.
  • If DROP access is enabled, data deletion could occur accidentally.
  • Credentials may be exposed via environment variables.
Supported clientsClaude Code, Claude Desktop, VS Code, Cursor, Roo Code, 5ireClaude Desktop
Tools04