Skip to main content
Glama
andrewbrooks

Detection Workbench

by andrewbrooks
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to Detection Workbench

No user-submitted related servers found.

    Related Servers

    • retriage

      vidhiparekh11
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables MCP clients to run hardened, read-only radare2-based static binary triage tools, including disassembly, cross-reference following, string decoding, function renaming, and evidence-checked report generation without executing the sample.
      MIT

    • flameox

      morluto
      A
      license
      C
      quality
      A
      maintenance
      Enables coding agents to query, compare, and audit local profiler traces, benchmarks, memory captures, and execution evidence without uploading code or data, using CLI and MCP interfaces.
      111
      247 PyPI
      210
      MIT

    • Wireshark MCP — Packet

      tejaswipandey3931l-coder
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI assistants and security analysts to inspect PCAP/PCAPNG captures through MCP tools or REST endpoints, reassembling TCP/UDP streams, extracting payload artifacts, detecting CTF flags, credential leaks and network anomalies, and generating formal PDF or Markdown forensic reports. Every finding is bound to exact frame numbers, timestamps and endpoints with SHA-256 deduplicated evidence provenance.
      MIT

    • kali-mcps

      freitas51
      F
      license
      Not graded
      quality
      A
      maintenance
      Enables users to run security-focused operations such as network scanning, binary and symbol analysis, string extraction, live/pcap traffic inspection, and sandboxed command execution through an MCP client.
      -

    • kali-mcps

      aRay84844
      F
      license
      Not graded
      quality
      A
      maintenance
      Enables users to run Kali-based security tools for network scanning, binary and symbol analysis, string extraction, and live or captured traffic analysis through an MCP client. It also supports isolated Docker sandbox command execution with resource limits and file transfer.
      -
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.5/5.0

    Scored across 21 tools

    Disambiguation4/5

    Each tool targets a distinct resource+action (case CRUD, evidence registration, findings/notes, pcap analysis, tuning tests). A few tools operate on the same run object (get_alerts, explain_alert, suggest_tuning_targets, diff_runs) but their descriptions clearly separate enumeration, single-alert forensics, ranking, and comparison. Case tools like get_case/open_case/update_case are close but distinguishable by their descriptions.

    Naming Consistency4/5

    Names use snake_case throughout and are mostly verb_noun (create_case, add_finding, run_pcap, test_tuning). Minor deviations exist, notably the noun-first 'pcap_summary' and the verb-less 'diff_runs', but these remain readable and predictable.

    Tool Count4/5

    21 tools across case management, evidence, rule validation/execution, alert analysis, and tuning is on the heavier side but each earns a distinct role. The surface feels comprehensive rather than padded for a detection-engineering workflow.

    Completeness4/5

    Covers the full case lifecycle (create/open/list/get/update/export), evidence registration, findings, notes, pcap analysis, rule validation, running, alert inspection, profiling, tuning tests, run diffing, and rule writing. Minor gaps: no standalone run listing/summary or evidence listing/removal, so discoverability of past runs relies on get_case.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources