Loading
Security Detections
io.github.MHaggisClaim this server
Power your agent
Add this server
The publisher's own command. Not a PlugMCP endpoint.
Host a copy with our keys and logs.
Local command
npx -y [email protected]Credentials from the publisher
- SIGMA_PATHS — Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)
- SPLUNK_PATHS — Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)
- ELASTIC_PATHS — Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)
- KQL_PATHS — Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)
- SUBLIME_PATHS — Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)
- CQL_HUB_PATHS — Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)
- JAMF_PROTECT_PATHS — Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)
- STORY_PATHS — Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)
Claude Code has no install link for a local command. Copy the command below and run it in a terminal.
shClaude Code
SIGMA_PATHS=<value> SPLUNK_PATHS=<value> ELASTIC_PATHS=<value> KQL_PATHS=<value> SUBLIME_PATHS=<value> CQL_HUB_PATHS=<value> JAMF_PROTECT_PATHS=<value> STORY_PATHS=<value> claude mcp add io.github.mhaggis-security-detections-mcp -- npx -y security-detections-mcp@3.3.4Run in a terminal.
jsonClaude Desktop
{ "mcpServers": { "io.github.mhaggis-security-detections-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ], "env": { "SIGMA_PATHS": "<value>", "SPLUNK_PATHS": "<value>", "ELASTIC_PATHS": "<value>", "KQL_PATHS": "<value>", "SUBLIME_PATHS": "<value>", "CQL_HUB_PATHS": "<value>", "JAMF_PROTECT_PATHS": "<value>", "STORY_PATHS": "<value>" } } }}claude_desktop_config.json
Local · npmPublisher installStep-by-step: add this in Claude
Remote URL or a command on your machine? How the two installs differ
Run on PlugMCP
Host a copy with our keys and logs.
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
LaunchServer facts
Local- Transport
Tools
Tools
No tool list yet. Remote servers get one after the first health check.
FAQ