"Elastic Stack" matching MCP servers:

Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.

Trust, identity, and reputation infrastructure for AI agents. Register agents with W3C DID (Ed25519), check EigenTrust reputation scores, submit peer attestations, search agents by capability, and verify IPFS-anchored audit trails. 11 tools.

Provides tools for AI agents to audit websites, including stack detection, DNS snapshots, and security checks.

Model Context Protocol server for pyobfus — the Python obfuscator. Lets Claude Desktop, Claude Code, Cursor, Windsurf, and Zed call pyobfus tools (preflight risk check, zero-config init, reverse stack-trace mapping) directly from an agent conversation.

Gives AI assistants read-only access to a Kubernetes cluster's observability stack — Loki, Prometheus, Tempo, the Kubernetes API — plus AWS telemetry from CloudTrail, Config, ECR, and RDS. 23 tools for querying logs, metrics, traces, Kubernetes events, deployments, and audit history in plain language.

Enables MCP-capable agents to run a seven-tool proof loop: opening scoped sessions, authorizing bounded actions, recording typed evidence, checking claims, and closing sessions with a tamper-evident local ledger.

A local-first MCP control-and-proof plane for scoped continuity, action authorization, budget ceilings, evidence-bound claims, durable recovery, and Ed25519-signed traces.

Enterprise-grade Slack integration with compliance audit trails for AI agents. Every action is logged locally for governance, regulatory compliance, and security review.

23 pay-per-call web analysis APIs as MCP tools. Security audits, tech stack detection, email verification, SEO analysis, SSL checks, performance monitoring. Supports x402 and Stripe MPP payments.

MCP server for passive domain reconnaissance and attack surface monitoring. It scans subdomains, security headers, TLS certs, and tech stack, detects subdomain takeovers, and reports changes since the last scan.

Enables querying and analysis of a unified database of security detection rules across multiple formats, including Sigma, Splunk, Elastic, KQL, and CrowdStrike CQL.

Full-stack security for AI agents — static analysis + MCP runtime interception. 31 rules detect prompt injection, data exfiltration, backdoors, tool poisoning, and cross-file attack chains. Includes MCP proxy for real-time blocking, Python AST taint tracking, multi-language injection detection (8 languages), and AI-powered deep analysis. Free, offline, zero-config.

An MCP server that manages a TODO list with user authentication via Stytch, enabling AI agents to interact with a full-stack application.

A secure cloud MCP server for Antigravity AI that provides AI agents with full-stack developer and cybersecurity capabilities, using SSE transport and API key authentication.

An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.

Enables comprehensive management of Tailscale networks including device management, DNS configuration, file sharing via Taildrop, security monitoring, and network automation with built-in Grafana/Prometheus observability stack.

Brings interactive blue-team security operations into AI hosts, enabling alert triage, attack discovery, case management, detection rules, threat hunting, and sample data generation with rich inline UIs.

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.

An MCP-powered compliance copilot for SaaS stacks, enabling structured audit workflows including stack detection, module wiremapping, implementation directives, code verification, and security/infrastructure/legal readiness gates.

Human-in-the-loop approval gate for MCP agents, classifying tool calls by risk and requiring Slack-based human approval for medium/high risk actions.