Back to Browse
Free
Server data from the Official MCP Registry
AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch
About
AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch
What You'll Need
Set these up before or after installing:
Comma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)
Environment variable: ELASTICSEARCH_HOSTS
Elastic Cloud deployment ID (alternative to ELASTICSEARCH_HOSTS for cloud deployments)
Environment variable: ELASTICSEARCH_CLOUD_ID
API key for authentication (recommended for production and Elastic Cloud)Required
Environment variable: ELASTICSEARCH_API_KEY
Username for basic authentication (alternative to API key)
Environment variable: ELASTICSEARCH_USERNAME
Password for basic authentication (used with ELASTICSEARCH_USERNAME)Required
Environment variable: ELASTICSEARCH_PASSWORD
Bearer/service token for authentication (alternative to API key)Required
Environment variable: ELASTICSEARCH_BEARER_TOKEN
TLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)
Environment variable: VERIFY_CERTS
Request timeout in seconds (e.g., 60 or 10.5)
Environment variable: REQUEST_TIMEOUT
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-thomasxm-crowdsentinel-mcp-server": {
"env": {
"VERIFY_CERTS": "your-verify-certs-here",
"REQUEST_TIMEOUT": "your-request-timeout-here",
"ELASTICSEARCH_HOSTS": "your-elasticsearch-hosts-here",
"ELASTICSEARCH_API_KEY": "your-elasticsearch-api-key-here",
"ELASTICSEARCH_CLOUD_ID": "your-elasticsearch-cloud-id-here",
"ELASTICSEARCH_PASSWORD": "your-elasticsearch-password-here",
"ELASTICSEARCH_USERNAME": "your-elasticsearch-username-here",
"ELASTICSEARCH_BEARER_TOKEN": "your-elasticsearch-bearer-token-here"
},
"args": [
"crowdsentinel-mcp-server"
],
"command": "uvx"
}
}
}Security Report
2.8
Use Caution2.8Critical RiskCrowdSentinel is a feature-rich security MCP server with extensive threat hunting capabilities but lacks authentication controls and has several security concerns. The server can execute arbitrary commands through subprocess calls, lacks authentication on sensitive operations, and includes hardcoded credentials in configuration examples. Supply chain analysis found 7 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.
Scanned 3 files · 14 findings
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
Reviews
No reviews yet
Be the first to review this server!