SigmaLineage MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SIGMALINEAGE_PROJECT_ROOT | Yes | Absolute path to the sigmalineage_mcp project root directory |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| run_sigmaC | Run Chainsaw Sigma hunt and return hunt.json summary. |
| run_sigma_lineageC | Run Sigma hunt + process lineage tracing and return process_lineage paths/summary. |
| rare_events_baselineC | Return rare tuple events with baseline frequencies from parsed CSV data. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
Each tool has a distinct purpose: one focuses on rare event baselines, another on Sigma hunts, and the third on Sigma hunts with lineage tracing. There is no overlap or ambiguity.
The first tool uses a noun phrase pattern (rare_events_baseline), while the other two use a verb-noun pattern (run_sigma, run_sigma_lineage). This inconsistency in naming style may cause confusion for an agent.
With 3 tools, the set is slightly small but well-scoped for the domain. Each tool serves a clear function without unnecessary bloat, fitting within the typical 3-15 range.
The tools cover the core workflows: baseline analysis, sigma hunts, and lineage tracing. There are minor gaps (e.g., no tool for managing rules or results), but the surface is complete for intended use.