crowdsentinel-mcp-server — Claude Code MCP server: threat hunting
Connects your agent to Elasticsearch and OpenSearch for natural-language threat hunting, incident response, endpoint and network forensics.
claude mcp add --env ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> --env ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> --env ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> --env ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> --env ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> --transport stdio crowdsentinel-mcp-server -- uvx crowdsentinel-mcp-serverWhat crowdsentinel-mcp-server does
The server exposes 139 tools and 9 resources with investigation playbooks to a connected agent. You query Elasticsearch in plain English, and indicators of compromise found by one tool show up in the others, along with a forensic timeline and cross-query correlation. Investigation state lives in 8GB of memory-backed storage and survives across sessions.
Detection content ships inside the package: 6,060 Lucene, EQL and ES|QL rules. A separate crowdsentinel setup run downloads the Chainsaw binary for EVTX analysis and 3,000+ Sigma rules; those land in ~/.crowdsentinel/ and stay put across package upgrades. PCAP analysis needs tshark installed on the system — without it, network traffic work and cross-tool IoC correlation do not run. Live endpoint forensics through Velociraptor comes as an optional extra.
The project is under active development and described as not production-ready, so tool interfaces and data formats can shift. Connecting it means giving the server Elasticsearch credentials — host, Cloud ID, API key or username and password — through environment variables.
What it helps with
- hunt for suspicious processes in Elasticsearch with plain text
- build an incident timeline from EVTX logs
- pull C2 addresses out of base64-encoded PowerShell commands
- correlate PCAP indicators with host events
- collect live artefacts from an endpoint via Velociraptor
Example prompts for the agent
- Find every
powershell.exelaunch with-EncodedCommandin the index over the last day - Parse
capture.pcapand match the IPs against Elasticsearch events - Build a timeline for host
WORKSTATION-14and show what happened before and after logon
How to install crowdsentinel-mcp-server
Platform CLI
claude mcp add --env ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> --env ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> --env ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> --env ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> --env ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> --transport stdio crowdsentinel-mcp-server -- uvx crowdsentinel-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server <command>
Platform CLI
codex mcp add crowdsentinel-mcp-server --env ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> --env ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> --env ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> --env ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> --env ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> -- uvx crowdsentinel-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server <command>
Config file
{
"mcpServers": {
"crowdsentinel-mcp-server": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_HOSTS": "<ELASTICSEARCH_HOSTS>",
"ELASTICSEARCH_CLOUD_ID": "<ELASTICSEARCH_CLOUD_ID>",
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_USERNAME": "<ELASTICSEARCH_USERNAME>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>"
}
}
}
}Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server <command>
Config file
{
"servers": {
"crowdsentinel-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_HOSTS": "<ELASTICSEARCH_HOSTS>",
"ELASTICSEARCH_CLOUD_ID": "<ELASTICSEARCH_CLOUD_ID>",
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_USERNAME": "<ELASTICSEARCH_USERNAME>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>"
}
}
}
}Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server <command>
Platform CLI
gemini mcp add -e ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> -e ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> -e ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> -e ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> -e ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> crowdsentinel-mcp-server uvx crowdsentinel-mcp-serverReplace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about crowdsentinel-mcp-server
How do I install crowdsentinel-mcp-server in Claude Code?
Add the server with `claude mcp add crowdsentinel-mcp-server -e ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> -e ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> -e ELASTICSEARCH_BEARER_TOKEN=<ELASTICSEARCH_BEARER_TOKEN> -- uvx crowdsentinel-mcp-server. The other form sets the host and transport explicitly: claude mcp add --env ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> --env ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> --env ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> --env ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> --env ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> --transport stdio crowdsentinel-mcp-server -- uvx crowdsentinel-mcp-server`.
What does crowdsentinel-mcp-server do?
It is an MCP server for threat hunting and incident response. It links a language model to Elasticsearch or OpenSearch and adds EVTX, PCAP, live endpoint and local host forensics.
What do I need before running it?
Elasticsearch or OpenSearch credentials passed as environment variables, plus tshark on the system for traffic analysis. Velociraptor live forensics installs through the extra pip install 'crowdsentinel-mcp-server[velociraptor]'.
