# crowdsentinel-mcp-server Connects your agent to Elasticsearch and OpenSearch for natural-language threat hunting, incident response, endpoint and network forensics. - MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 204 - Author: thomasxm - License: GPL-3.0 · policy=link-only · description only; the file stays with the author - Source: https://github.com/thomasxm/CrowdSentinels-AI-MCP - Updated: 2026-07-19 - HTML: https://affpapa.org/en/nevibecode/mcp/crowdsentinel-mcp-server ## What it does The server exposes 139 tools and 9 resources with investigation playbooks to a connected agent. You query Elasticsearch in plain English, and indicators of compromise found by one tool show up in the others, along with a forensic timeline and cross-query correlation. Investigation state lives in 8GB of memory-backed storage and survives across sessions. Detection content ships inside the package: 6,060 Lucene, EQL and ES|QL rules. A separate `crowdsentinel setup` run downloads the Chainsaw binary for EVTX analysis and 3,000+ Sigma rules; those land in `~/.crowdsentinel/` and stay put across package upgrades. PCAP analysis needs `tshark` installed on the system — without it, network traffic work and cross-tool IoC correlation do not run. Live endpoint forensics through Velociraptor comes as an optional extra. The project is under active development and described as not production-ready, so tool interfaces and data formats can shift. Connecting it means giving the server Elasticsearch credentials — host, Cloud ID, API key or username and password — through environment variables. ## Requirements - Needs: Python and uv (commands run via uvx) - Environment variables: `ELASTICSEARCH_HOSTS`, `ELASTICSEARCH_CLOUD_ID`, `ELASTICSEARCH_API_KEY`, `ELASTICSEARCH_USERNAME`, `ELASTICSEARCH_PASSWORD`, `ELASTICSEARCH_BEARER_TOKEN`, `VERIFY_CERTS`, `REQUEST_TIMEOUT` — keys and tokens: ask the human for the values, never commit them or put them in shared files. ## Install ### Claude Code (native platform) **Platform CLI** ```bash claude mcp add --env ELASTICSEARCH_HOSTS= --env ELASTICSEARCH_CLOUD_ID= --env ELASTICSEARCH_API_KEY= --env ELASTICSEARCH_USERNAME= --env ELASTICSEARCH_PASSWORD= --transport stdio crowdsentinel-mcp-server -- uvx crowdsentinel-mcp-server ``` Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server ### Codex **Platform CLI** ```bash codex mcp add crowdsentinel-mcp-server --env ELASTICSEARCH_HOSTS= --env ELASTICSEARCH_CLOUD_ID= --env ELASTICSEARCH_API_KEY= --env ELASTICSEARCH_USERNAME= --env ELASTICSEARCH_PASSWORD= -- uvx crowdsentinel-mcp-server ``` Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server ### Cursor **Config file** File `.cursor/mcp.json`: ```json { "mcpServers": { "crowdsentinel-mcp-server": { "command": "uvx", "args": [ "crowdsentinel-mcp-server" ], "env": { "ELASTICSEARCH_HOSTS": "", "ELASTICSEARCH_CLOUD_ID": "", "ELASTICSEARCH_API_KEY": "", "ELASTICSEARCH_USERNAME": "", "ELASTICSEARCH_PASSWORD": "" } } } } ``` Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server ### GitHub Copilot **Config file** File `.vscode/mcp.json`: ```json { "servers": { "crowdsentinel-mcp-server": { "type": "stdio", "command": "uvx", "args": [ "crowdsentinel-mcp-server" ], "env": { "ELASTICSEARCH_HOSTS": "", "ELASTICSEARCH_CLOUD_ID": "", "ELASTICSEARCH_API_KEY": "", "ELASTICSEARCH_USERNAME": "", "ELASTICSEARCH_PASSWORD": "" } } } } ``` Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server ### Gemini CLI **Platform CLI** ```bash gemini mcp add -e ELASTICSEARCH_HOSTS= -e ELASTICSEARCH_CLOUD_ID= -e ELASTICSEARCH_API_KEY= -e ELASTICSEARCH_USERNAME= -e ELASTICSEARCH_PASSWORD= crowdsentinel-mcp-server uvx crowdsentinel-mcp-server ``` Replace <…> with your own values. 3 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from crowdsentinel-mcp-server ## When to use it - hunt for suspicious processes in Elasticsearch with plain text - build an incident timeline from EVTX logs - pull C2 addresses out of base64-encoded PowerShell commands - correlate PCAP indicators with host events - collect live artefacts from an endpoint via Velociraptor ## Example prompts - Find every `powershell.exe` launch with `-EncodedCommand` in the index over the last day - Parse `capture.pcap` and match the IPs against Elasticsearch events - Build a timeline for host `WORKSTATION-14` and show what happened before and after logon ## Similar - [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989 - [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408 - [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109 - [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658 - [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061 - [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802 --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md