CrowdSentinel MCP Server provides comprehensive AI-driven threat hunting and incident response capabilities for Elasticsearch/OpenSearch, with a rich set of tools, extensive detection rules, and multi-source integration. However, its development status, security configuration defaults, and potential sensitive data access make it better suited for research and testing environments rather than production.
CrowdSentinel MCP Server is an open-source threat hunting orchestrator that connects large language models to enterprise security data via the Model Context Protocol (MCP). It provides 139 MCP tools for natural language threat hunting, detection rule execution (6,060 built-in rules), endpoint forensics (Velociraptor), host forensics (osquery), EVTX log analysis (Chainsaw), and PCAP network analysis (Wireshark). It supports multiple security frameworks (Cyber Kill Chain, Pyramid of Pain, Diamond Model, MITRE ATT&CK) and features persistent investigation state, cross-tool IoC correlation, and encoded-command deobfuscation. The server is intended for security testing, research, and educational purposes only, and is not production-ready.
Install via pip: pip install crowdsentinel-mcp-server. Run 'crowdsentinel setup' to download detection rules and tools. Set environment variables (ELASTICSEARCH_HOSTS, etc.) and run the server via uvx. Optional extras: velociraptor and deobf. For standard MCP clients use stdio transport; for web clients use SSE or HTTP.
{
"mcpServers": {
"crowdsentinel": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_HOSTS": "https://localhost:9200",
"ELASTICSEARCH_API_KEY": "your_api_key",
"VERIFY_CERTS": "false"
}
}
}
}