- Conduid
- Marketplace
- #detection-engineering
MCP servers tagged detection-engineering
27 live MCP servers tagged "detection-engineering", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with detection-engineering.
Security Detections MCP
MCP to help Defenders Detection Engineer Harder and Smarter
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Vigil
Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
Adk Runbooks
No description published.
AI Dfir Toolkit
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider t…
Sigil
Fleet AI Security Posture Management (AI-SPM): client agents on each developer machine score their AI coding agents' guard surfaces (Claude Code, Cursor, Codex, Gemini CLI — permi…
Fengarde
Open-source SIEM pipeline: raw security logs → OCSF → correlation rules → alerts. OT and IT in one pipeline. Local-first AI triage, 10-minute self-hosted quickstart.
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
Gsh Framework
Open-source hunt playbooks and a policy-driven Sentinel reference framework for detecting runaway AI agents, unauthorized tool calls, behavioral drift, DNS exfiltration, and poiso…
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Agentic Dart
Automate digital forensics and incident response tasks using an autonomous agent aligned with MITRE ATT&CK frameworks.
Argus Detection Evolution
ARGUS: Adversarial Detection Evolution Engine: Red AI attacks, Blue AI defends, on real Splunk data. Splunk Agentic Ops Hackathon 2026 (Security track).
WRG-11/wrg-sigma-rules
rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.
Living Off The Land Lolbins MCP Server
Living off the Land LOLBins MCP Server — 59 composite tools for LOL binary intelligence across 10 catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, LO…
Logsift
Detect brute-force, spray, and anomalous auth events in logs
Agentic Dfir
Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…
Detect
Open-source MCP abuse-detection lab with reproducible rules, corpora, and coverage limits
Detection Lab
Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).
Anvilogic
Anvilogic — independent third-party profile of a public API surface, by API Evangelist. Anvilogic is an Agentic SecOps platform founded in 2019 by former SOC practitioners. It run…
Runreveal
RunReveal — independent third-party profile of a public API surface, by API Evangelist. RunReveal is a unified security log management and detection platform that replaces traditi…
Investigation Reports
MCP security investigation and hunting reports — reference material for detecting and investigating agent tool activity.
Yara Detection Harness
Detection-as-code for generated text & code: hand-written YARA rules, a paired synthetic corpus, and a CI harness gating on recall + false-positive rate — plus a VirusTotal enrich…
Threat Dashboard
SOC desktop app in Zig + Vulkan: triage/hunt/detect/intel workspaces, YARA rules-as-code with CI quality gates, ATT&CK coverage mapping, dbt-style pipelines, and an embedded Claud…
Threat Detection Lab
Agent exposure review ("what changes if I add this tool to my agent?"), a deterministic detection-boundary harness, and a CTI pipeline. Public data only; every figure measured.
Elastic Genai Secops
Open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: SIEM, detection rules, alert correlation, PII masking, LLM triage with human review, and a read-only MCP ser…
Claude Code Cyber Defense Writeups
No description published.
Pranith Jain.github.io
No description published.