Discover the toolingbehind modern intelligence
The operating system for AI infrastructure discovery. Search a live map of MCP servers, AI agents, LLM tools, automation systems, and developer infrastructure.
Security-Detections-MCP
MCP to help Defenders Detection Engineer Harder and Smarter
443stars
66forks
TypeScript
detection-engineeringmcp
Quality signals
StaleNo testsNo CIThin docsNo licensePopular
AI summary
Auto-generated overview of what this skill does and when to reach for it.
MCP server that lets LLMs query unified security detection rules across Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike CQL formats.
Use this when
- Debugging a suspicious process name across multiple SIEM formats
- Checking if a new MITRE technique has existing detections
- Building a detection gap analysis for a threat actor
- Converting detection rules between Splunk, Sigma, and Elastic
- Reviewing detection coverage for a specific ATT&CK tactic
Don't use when
- Need real-time live log querying (this is rule search only)
- Looking for non-security detection content
Capabilities
- Search 8,200+ detections across 6 rule formats
- Map detections to MITRE ATT&CK techniques and tactics
- Generate coverage gap analysis between rules and threats
- Convert between Sigma, Splunk ESCU, Elastic, KQL, Sublime, CQL
- Export ATT&CK Navigator layers for visualization
- Query MITRE threat actors, software, and relationships
InstallMCP + SKILLInstall as a Claude Code skill
Universal installANY TOOL
$ npx skillcity@latest MHaggis/Security-Detections-MCPAuto-detects the skill or MCP server in this repo and installs it for Claude Code, Codex, Cursor, Cline, OpenCode, Gemini CLI, Anti-Gravity, OpenClaw and Hermes.
Requires Node.js 18+ (ships with npx).
Or install manually
# Install into ~/.claude/skills/ mkdir -p ~/.claude/skills/security-detections-mcp curl -fsSL https://raw.githubusercontent.com/MHaggis/Security-Detections-MCP/main/SKILL.md -o ~/.claude/skills/security-detections-mcp/SKILL.md
Loading README…
Ask a simulated agent to run this skill. It loads the real SKILL.md and reasons over your task with NVIDIA.
security-detections-mcp — sandboxAI sandbox
Pick a quick prompt below or type your own — watch the agent execute this skill step by step.
guest@skillcity:~$Try a prompt