25 tools · all MIT, all local-first Watch your whole stack
Watch your whole stack
from one agent.
MCP servers and CLIs for the SOC, the network, and the homelab. Wazuh, MISP, TheHive, LibreNMS, and Proxmox, read like a console by your AI client.
$npx -y wazuh-mcp
lidless.dev the eye does not close
Tools
Each one wires a real system into your AI client. Writes are gated.
Security / SOC9 tools · SIEM, IDS, incident response
wazuh-mcp Read your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. v1.1.4 misp-mcp Turn MISP threat intel into answers: events, correlations, and IOC exports on demand. v1.3.6 suricata-mcp Hunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. v2.1.2 thehive-mcp Drive TheHive incident response from your agent: cases, alerts, tasks, observables. v1.2.3 cortex-mcp Detonate an indicator and get one verdict: Cortex analyzers, confirm-gated. v1.3.3 mitre-mcp Map alerts to ATT&CK and profile threat groups without leaving your agent. v2.0.4 zeek-mcp Query and correlate Zeek and Suricata NSM logs from your agent. v3.1.2 hotwash Build IR playbooks as flowcharts and run them step by step, agent-drivable. soc-stack One command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.
Threat Intelligence & OSINT4 tools · intel and OSINT
maltego-mcp Let your agent author Maltego .mtgx graphs and run whois, DNS, ASN, and crt.sh lookups. v0.4.3 cyberbrief AI threat-intel briefings: BLUF reports, ATT&CK mapping, and IOC extraction. intel-workbench Browser-native ACH workbench: ATT&CK tagging, ICD 203 confidence, local-only. vervet Threat hunting for Zeek and Suricata logs: explainable per-host risk with ATT&CK evidence chains.
Network6 tools · NMS, automation, mesh
librenmsctrl Pipe LibreNMS devices, ports, and alerts to shells, cron, and agents. Writes gated. n8nctrl Drive n8n workflows from shells, cron, and agents: inspect, validate, run, audit. watchtower NOC dashboard: device status, topology, and VM metrics via LibreNMS and Proxmox. eero-cli Drive the eero mesh API from the shell: SMS auth, device filtering, bulk block. cutsheet Network change intelligence: self-hosted config diff and risk analysis for switches, firewalls, and NetOps. portgrid High-density port visualizer for LibreNMS, a modern replacement for the legacy SwitchMap.
Homelab6 tools · hypervisor and self-hosted apps
proxmox-mcp Operate Proxmox VMs, containers, and nodes from your agent, every write gated. adguardctrl Run AdGuard Home DNS filtering from shells and agents, destructive writes gated. proxguard Audit Proxmox against CIS benchmarks: config parsers and remediation scripts. jellyctrl Drive Jellyfin libraries, sessions, and users from a CLI or MCP, writes gated. immichctrl One typed control surface for Immich: search, albums, and duplicate audits. samba-ad-migration Automated migration of a Windows AD file share to Samba on Proxmox, with Winbind domain join and permission-preserving data copy.
No tools match.
01 / read-first
Read-only by default
Anything that changes state needs an explicit confirm. Your agent looks before it touches.
02 / local
Runs on your machine
The servers run beside your client over stdio. Credentials stay in your environment.
03 / one shape
Learn it once
Every tool is configured and gated the same way. The docs cover all of it.