Security Detections MCP Server

What the code does

We read the source, 2 d ago · rules 995398eba69f

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    'CurrentVersion\\Run',

  'https://cursor.com/en/install-mcp?name=security-detections-hosted&config=eyJ1cmwiOiJodHRwczovL2RldGVjdC5taWNoYWVsaGFhZy5vcmcvYXBpL21jcC9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIgc2RtY3BfWU9VUl9UT0tFTl9IRVJFIn19';

  db.exec(`INSERT INTO detections_identity_new(rowid, ${info.map(c => '"' + c.name.replaceAll('"', '""') + '"').join(', ')}) SELECT rowid, * FROM detections`);

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add security-detections-mcp -- npx -y security-detections-mcp

{
  "mcpServers": {
    "security-detections-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "security-detections-mcp"
      ]
    }
  }
}

[mcp_servers.security-detections-mcp]
command = "npx"
args = ["-y", "security-detections-mcp"]

{
  "mcpServers": {
    "security-detections-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "security-detections-mcp"
      ]
    }
  }
}

{
  "servers": {
    "security-detections-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "security-detections-mcp"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: SIGMA_PATHS (Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)), SPLUNK_PATHS (Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)), ELASTIC_PATHS (Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)), KQL_PATHS (Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)), SUBLIME_PATHS (Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)), CQL_HUB_PATHS (Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)), JAMF_PROTECT_PATHS (Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)), STORY_PATHS (Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)).