Crowdsentinel Mcp Server

Name: Crowdsentinel Mcp Server
Author: thomasxm

by thomasxmcommunityv0.5.6

202

CrowdSentinel MCP Server is an open-source threat hunting orchestrator that connects large language models to enterprise security data via the Model Context Protocol (MCP). It enables natural language querying and AI-guided investigation workflows.

From the registry: AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch

GitHub Repository

Install & configure

Prerequisites

required
Elasticsearch access
Requires running Elasticsearch instance and API key or credentials.
optional
tshark (for PCAP analysis)
System dependency required for network traffic analysis tools.
optional
Run crowdsentinel setup
Downloads Chainsaw and Sigma rules (one-time).
```
$ crowdsentinel setup
```

Install in your client

Paste into the AI you're chatting with — it will figure out the rest

Please install the `crowdsentinel-mcp-server` MCP server into my current AI client (that's you).

Required prerequisites (do these first if not already done):
- **Elasticsearch access** — Requires running Elasticsearch instance and API key or credentials.

Optional prerequisites:
- tshark (for PCAP analysis) — System dependency required for network traffic analysis tools.
- Run crowdsentinel setup — Downloads Chainsaw and Sigma rules (one-time). Run: `crowdsentinel setup`

Canonical MCP server config (stdio transport):
- command: `uvx`
- args: ["crowdsentinel-mcp-server"]
- optional environment variables:
  - `ELASTICSEARCH_HOSTS`: Self-hosted Elasticsearch URL. (example: `https://localhost:9200`)
  - `ELASTICSEARCH_CLOUD_ID`: Elastic Cloud deployment ID. (example: `deployment:base64...`)
  - `ELASTICSEARCH_API_KEY`: Elasticsearch API key (recommended auth). (example: `<your-api-key>`)
  - `ELASTICSEARCH_BEARER_TOKEN`: Elasticsearch service/bearer token. (example: `<your-service-token>`)
  - `ELASTICSEARCH_USERNAME`: Basic auth username. (example: `elastic`)
  - `ELASTICSEARCH_PASSWORD`: Basic auth password. (example: `<your-password>`)
  - `VERIFY_CERTS`: Verify TLS certs. (example: `false`)
  - `VIRUSTOTAL_API_KEY`: VirusTotal API key for IoC enrichment. (example: `<your-vt-key>`)
  - `ABUSEIPDB_API_KEY`: AbuseIPDB API key for IP reputation lookups. (example: `<your-abuse-key>`)
  - `THREATFOX_API_KEY`: ThreatFox API key. (example: `<your-tf-key>`)

Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.