Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
- 517 ★ on the repository
- Last commit
Extended access
Why this level
- The server reads local rule directories at the paths set in environment variables and builds an index from them
- The hosted version sends the agent's requests to an external server and requires a token
- APT emulation and test plans describe attack techniques and should be run only in your own lab
Install
- Works in
Manual install
claude mcp add security-detections -- npx -y security-detections-mcpThen set SIGMA_PATHS, SPLUNK_PATHS and the other paths to your rule repository clones.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads local rule directories at the paths set in environment variables and builds an index from them
- The hosted version sends the agent's requests to an external server and requires a token
- APT emulation and test plans describe attack techniques and should be run only in your own lab
This is third-party code. Review the repository files before installing.
What it does
The server indexes detection rules from seven sources: Sigma, Splunk ESCU, Elastic, KQL, Sublime, CrowdStrike CQL and Jamf Protect. The agent searches them by full text and filters results by MITRE ATT&CK technique, tactic, CVE number, process name, severity and data source. A separate layer works with ATT&CK data in STIX format: threat groups and malware are linked to techniques, coverage and gaps are computed from them, and ATT&CK Navigator layers are exported as JSON. Eleven ready-made prompts start common tasks: a ransomware threat assessment, APT emulation, a purple team plan and an executive briefing. The local version exposes 81 tools and builds its database from your clones of the rule repositories. The hosted version at detect.michaelhaag.org offers about 25 read-only tools and needs no installation.
Who it is for. Detection engineers and SOC analysts who write and maintain rules for several SIEMs and want to check existing rules from inside an agent.
Good fit when
- Before writing your own rule for technique T1059.001, you want to see how Sigma, Splunk and Elastic already catch it
- The team received a report on a new campaign and needs to see which techniques of the group have no detections
- An analyst ports a rule from Sigma to Splunk or KQL and compares how other formats describe the same behavior
- An ATT&CK Navigator layer with coverage by source and tactic is being prepared for a leadership meeting
- A purple team exercise is under way and each stage's technique needs a list of rules to test
Not a fit when
- The rules must run against live logs: the server works with rule text and does not analyze events itself
- You need a SIEM whose format is not on the list: Sigma, Splunk, Elastic, KQL, Sublime, CrowdStrike CQL and Jamf Protect are supported
- Node.js is not on the machine and you would rather not install it: the local version runs through npx, and the hosted one needs signup and a token
Example request
Show the rules for technique T1059.001 in Sigma and Splunk, then list the APT29 techniques that have no detections in the database.MCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
SIGMA_PATHS- Sigma rule directories, comma-separated.
SPLUNK_PATHS- Splunk ESCU detection directories.
ELASTIC_PATHS- Elastic detection rule directories.
KQL_PATHS- KQL hunting query directories.
ATTACK_STIX_PATH- Path to enterprise-attack.json with ATT&CK threat actor data, optional.
Limitations
The package contains no rules itself. Sigma, Splunk, Elastic and other repositories are cloned separately with the sparse checkout commands from the docs, and their paths are set in SIGMA_PATHS, SPLUNK_PATHS and similar variables.
The hosted version works by token: the free plan gives 200 calls per day.
The repository also holds automation and agents folders with an autonomous pipeline that goes from threat intelligence to a draft pull request. They are not part of the server installation, and this card does not cover them.
How to disable. In Claude Code run claude mcp remove security-detections; in Cursor, VS Code and Claude Desktop delete the security-detections block from the MCP configuration. The cloned rule repositories stay on disk and are removed by hand.
FAQ
How do I install Security Detections MCP in Claude Code?
Run claude mcp add security-detections -- npx -y security-detections-mcp, then set the rule directory paths in SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS and KQL_PATHS. For Codex the command is the same with codex mcp add. Node.js is required.
Where do the rules come from?
From repositories you clone yourself: SigmaHQ, Splunk security_content, Elastic detection-rules and others. The docs suggest a sparse checkout to download only the rule directories.
How does the hosted version differ from the local one?
The hosted one lives at https://detect.michaelhaag.org/api/mcp/mcp, works by token with no installation, offers about 25 read-only tools and gives 200 free calls per day. The local one installs via npx, indexes your repositories and exposes 81 tools.
Do I need a Claude or OpenAI key?
The MCP server itself does not. Claude, OpenAI or OpenRouter keys belong to the web chat on the project's site, where you can supply your own key.
Will the server work with Cursor and VS Code?
Yes. The docs have install buttons for Cursor, VS Code and VS Code Insiders and a configuration block for Claude Desktop. In every client the server starts with one command, npx -y security-detections-mcp.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
README in short
The author, GitHub user MHaggis, also runs the hosted detection catalog at detect.michaelhaag.org. The server pairs with mitre-attack-mcp, and together they cover threat coverage analysis. The npm build is version 3.3.0, licensed Apache-2.0.