suricata-mcp
ActiveChasing one Suricata alert means pivoting by hand across eve.json, flow records, DNS/HTTP/TLS transactions, and the Zeek logs next to them, slow and easy to get wrong under pressure. suricata-mcp hands the whole NSM stack to your agent: alerts, flows, protocols, Zeek metadata, and C2/DGA/exfil analytics, answered in plain language over stdio.
See it work
one question, the tools it calls, the answer
Representative session. Illustrative values, RFC 5737 addresses. Your logs never leave the box.
What it does
Point any MCP client at suricata-mcp and your Suricata IDS/IPS and Zeek NSM logs become tools the agent can call: query alerts, flows, and protocol records; investigate a host or a single alert; and cross-correlate Suricata alerts against Zeek conn/dns/http/ssl by IP pair and time window. Why: a SOC analyst working a single alert normally greps EVE JSON and stitches together flow and protocol context by hand, which does not scale under pressure. How it differs: instead of a dashboard or a one-shot log shipper, it reads your own log files locally and layers detection analytics on top, C2 beaconing, DGA via Shannon entropy, data exfiltration, and lateral movement, so the model does the pivoting. It is read-only by default and speaks stdio, so there is no new network surface, and it drops into Claude Desktop, Claude Code, Codex CLI, OpenClaw, or Hermes.
Capabilities
41 tools across Suricata and Zeek
Set it up
Point SURICATA_EVE_LOG at your EVE JSON log; set ZEEK_LOGS_DIR, PCAP_DIR, and MISP/TheHive vars to light up the optional tool groups.
MCP client config
{ "mcpServers": { "suricata": { "command": "npx", "args": ["-y", "suricata-mcp"], "env": { "SURICATA_EVE_LOG": "/var/log/suricata/eve.json", "ZEEK_LOGS_DIR": "/opt/zeek/logs" } } } }Read-only by default: every analysis and query tool works out of the box, while the tools that change a live IDS or shell out stay disabled. Mutating tools (rule writes, ruleset reload, PCAP replay) require both SURICATA_ALLOW_MUTATION=1 in the environment and confirm: true on the call. suricata_create_rule enforces a local SID range and rejects collisions; PCAP filenames are basename-sanitized against option injection. MISP and TheHive calls use manual redirect handling, so a 3xx from a compromised endpoint is refused rather than followed with the API key attached.