zeek-mcp
ActiveA real investigation means grepping conn, then dns, then http, then ssl by hand, pivoting on a UID you keep pasting between awk one-liners. zeek-mcp hands the whole sensor to your agent: Zeek and Suricata logs queried, correlated, and hunted over stdio, so it follows the pivot for you.
See it work
one question, the tools it calls, the answer
Representative session. Illustrative values, RFC 5737 addresses. Read-only, and your logs never leave the box.
What it does
Point any MCP client at zeek-mcp and your Zeek and Suricata sensor becomes tools the agent can call: search connection, DNS, HTTP, SSL, files, notice, and SSH logs, follow a connection UID across every log type, and cross-reference Suricata alerts back to the Zeek context that explains them. It exists because network telemetry lives in dense per-protocol log files that are tedious to grep under pressure, and an LLM is good at pivoting across them once you give it structured access. It differs from a generic log-reader MCP by speaking Zeek and Suricata natively: it parses both TSV and JSON, matches CIDR and wildcards with IPv6 support, walks gzipped and date-rotated archives, and ships purpose-built detections (beaconing by interval regularity, DNS tunneling by entropy, JA3 hunting, anomaly and baseline analysis) instead of handing the model raw text. It is read-only against your telemetry and speaks stdio, so there is no new network surface; the only writes are the optional TheHive and MISP tools, and only when you supply credentials.
Capabilities
39 tools across the sensor
Set it up
Set ZEEK_LOG_DIR, ZEEK_LOG_FORMAT (json or tsv), and SURICATA_EVE_LOG to your sensor paths. Optional MISP_* / THEHIVE_* / PCAP_DIR vars enable IR and replay.
MCP client config
{ "mcpServers": { "zeek": { "command": "npx", "args": ["-y", "zeek-mcp"], "env": { "ZEEK_LOG_DIR": "/opt/zeek/logs/current", "ZEEK_LOG_FORMAT": "tsv", "SURICATA_EVE_LOG": "/opt/suricata/logs/eve.json" } } } }Read-only against Zeek and Suricata telemetry: it queries logs, never runs the sensor, mutates capture, or writes to your data. It retains nothing between calls and opens no network listeners. The only writes are the optional TheHive and MISP tools, which create alerts, cases, and events only when you supply credentials. PCAP replay confines every filename to PCAP_DIR and rejects anything resolving outside it.