Skip to main content
Glama
Sign In
deenesjakoruzh
SigmaHQ

Sigma MCP Server

Official
by SigmaHQ
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Sigma MCP Server

An MCP server that exposes pySigma functionality to AI assistants and other MCP clients.

Features

Tools

Tool

Description

validate_rule

Validate a Sigma rule (YAML) against all configured validators; returns detailed issue reports with severity levels

configure_validators

Persist a custom validator allow-list / exclusion-list for the current MCP session

Resources

Resource

Description

sigma://validators

JSON dict mapping validator identifiers → human-readable descriptions

sigma://modifiers

JSON dict mapping modifier names (e.g. contains, re, base64) → descriptions

sigma://logsources

JSON array of valid Sigma log source combinations from the official specification

sigma://fields/{category}

JSON array of known field names for a Sigma log source category (e.g. process_creation)

sigma://tags

JSON dict mapping tag namespaces (e.g. attack, cve, detection) → descriptions

sigma://specification

Full Sigma Rules Specification document as Markdown

sigma://events/windows

JSON dict of documented Windows Security Auditing events grouped by log channel

sigma://events/windows/{channel}/{event_id}

Full Microsoft documentation for a specific Windows event as Markdown

Prompts

Prompt

Description

create_sigma_rule_from_description

Guide an LLM to create and validate a Sigma detection rule from a natural language description

create_sigma_rules_from_url

Guide an LLM to extract and validate Sigma rules from a blog post or threat report URL

Related MCP server: mcp-audit-server

Requirements

  • Python ≥ 3.10

  • Poetry (for development / installation)

Installation

git clone <repo-url>
cd sigma-mcp-server
poetry install

Usage

Running the server

poetry run sigma-mcp-server
# or, after installation:
sigma-mcp-server

The server listens on stdio by default (standard MCP transport).

Configuring in VS Code / Claude Desktop

Add the following entry to your MCP client configuration (e.g. ~/.config/claude/claude_desktop_config.json):

{
  "mcpServers": {
    "sigma": {
      "command": "sigma-mcp-server"
    }
  }
}

Adjust the command path to the installed binary if it is not on PATH.

Tool Reference

validate_rule

Validate a single Sigma rule.

Arguments

Name

Type

Description

rule_yaml

string

Complete Sigma rule in YAML format

Returns

A JSON array of validation issue objects. Each object contains:

Key

Type

Description

validator

string

Validator identifier that produced the issue

type

string

Issue class name (e.g. IdentifierExistenceIssue)

severity

string

low, medium, or high

description

string

Human-readable description of the issue class

rules

array[string]

Rule IDs / titles affected by the issue

Additional subclass-specific fields (e.g. identifier) may also be present.

An empty array means the rule passed all active validators.

configure_validators

Persist a custom validator configuration for the current MCP session. All subsequent validate_rule calls within the same session will use this configuration.

Arguments

Name

Type

Default

Description

validator_names

array[string] | null

null

Explicit allow-list of validator identifiers. null = use all.

exclusions

array[string] | null

null (= [])

Validator identifiers to exclude after the allow-list is applied.

Returns

On success: {"validator_names": ..., "exclusions": [...]} confirming the stored config.
On error: {"error": "<description>"} when an unknown identifier is supplied.

Example – exclude a single validator:

{"exclusions": ["identifier_existence"]}

Example – use only two validators:

{"validator_names": ["identifier_existence", "identifier_uniqueness"]}

Resource Reference

sigma://validators

Returns a JSON object mapping validator identifier strings to their human-readable descriptions. Validator identifiers are used with configure_validators.

Example response (truncated):

{
  "identifier_existence": "Checks if rule has identifier.",
  "identifier_uniqueness": "Check rule UUID uniqueness.",
  ...
}

sigma://modifiers

Returns a sorted JSON array of Sigma value modifier names that can be used in detection conditions (e.g. contains, startswith, re, base64).

Development

# Install dev dependencies
poetry install

# Run tests
poetry run pytest

# Run tests with coverage report
poetry run pytest --cov=sigma/mcp --cov-report=term-missing

# Type checking
poetry run mypy sigma/mcp/ tests/

# Code formatting
poetry run black sigma/ tests/ conftest.py

Test coverage must remain ≥ 95 %. All code must pass mypy --strict and be formatted with black in its default configuration.

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • mcp-audit-server

    joepangallo
    A
    license
    Not graded
    quality
    A
    maintenance
    This MCP server enables security auditing for MCP configurations and AI agents, including prompt injection testing, data flow tracing, and security policy generation.
    66 npm
    MIT

  • RSigma

    timescale
    A
    license
    A
    quality
    A
    maintenance
    RSigma is a Rust detection-engineering toolkit for the Sigma standard. Its MCP server (rsigma mcp serve) exposes the toolchain to AI agents over stdio or Streamable HTTP, with tools to author, lint, validate, and convert Sigma rules, evaluate and explain detections against log events, and inspect correlation state.
    15
    182
    MIT