MCP servers tagged sigma

4 live MCP servers tagged "sigma", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sigma.

live servers

avg trust

Rsigma

A complete Sigma detection toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:

Agentic Dart

Agentic-DART — autonomous detection & response agent. Architecture-first, not prompt-first. Starts as agentic DFIR; designed to expand toward agentic SOC and beyond.

Agentic Dfir

Agentic-DFIR — autonomous digital forensics & incident response agent. Architecture-first, not prompt-first: typed read-only MCP tool surface, SHA-256 audit chain, senior-analyst…

Detection Lab

Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).