Enables querying and analysis of a unified database of security detection rules across multiple formats, including Sigma, Splunk, Elastic, KQL, and CrowdStrike CQL.
Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.
RSigma is a Rust detection-engineering toolkit for the Sigma standard. Its MCP server (rsigma mcp serve) exposes the toolchain to AI agents over stdio or Streamable HTTP, with tools to author, lint, validate, and convert Sigma rules, evaluate and explain detections against log events, and inspect correlation state.
Unifies 21 supply chain security data sources into a single MCP server, enabling AI agents to perform comprehensive package audits, vulnerability checks, provenance verification, and risk assessment across multiple ecosystems.
An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.