Skip to main content
affpapa.org
RU EN
skill CX Codex

security-detections-mcp — Claude Code skill: setup and features

Connects your coding agent to an MCP server querying detection rules across Sigma, Splunk, and Elastic. Useful for spotting coverage gaps in MITRE ATT&CK.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill security-detections-mcp -a claude-code
Open on GitHub

What security-detections-mcp does

The skill connects your coding assistant to a collection of 8,200+ detection rules. It searches queries across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL syntax. The database incorporates MITRE ATT&CK threat intelligence. That includes 172 threat actors, 784 software entries, and 4,362 actor-technique relationships.

The system pinpoints detection gaps across tactics or individual adversaries. It generates exportable JSON layers for ATT&CK Navigator and drafts pull requests from incoming threat intelligence reports. Running it locally exposes 81 MCP tools alongside 11 expert prompts for ransomware assessments or purple team exercises. The hosted alternative provides around 25 tools.

Full local operation demands Node.js 18+ and cloned rule repositories on disk. Directories must exist locally. Without configured environment paths pointing to those files, the server will fail to load rules. The hosted cloud endpoint avoids local downloads, yet its free token caps usage at 200 daily calls under read-only access.

What it helps with

  • Search detection rules for a specific MITRE ATT&CK technique
  • Audit detection coverage gaps against ransomware tactics
  • Export custom JSON layers for ATT&CK Navigator
  • Retrieve Splunk or Sigma rules targeting credential dumping

Example prompts for the agent

  • Search for Sigma rules that detect process injection techniques
  • Analyze our MITRE ATT&CK coverage against ransomware threats
  • Show me Splunk rules designed for credential dumping

How to install security-detections-mcp

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill security-detections-mcp -a claude-code

2Manually: put the files in place

~/.claude/skills/security-detections-mcp/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-detections-mcp/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about security-detections-mcp

How to install security-detections-mcp in Claude Code?

Run npx skills add reason-machines/security-skills --skill security-detections-mcp -a claude-code in your terminal. This registers the skill file at ~/.claude/skills/security-detections-mcp/SKILL.md.

What does security-detections-mcp do?

It lets your assistant query detection rules across Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike CQL repositories. The skill maps these rules against MITRE ATT&CK techniques to highlight monitoring gaps.

What is the difference between local and hosted setups?

Running locally via npx -y security-detections-mcp gives you 81 MCP tools but requires Node.js 18+ and cloned rule repositories. The hosted option connects to https://detect.michaelhaag.org/api/mcp/mcp with an API token, offering around 25 read-only tools and a limit of 200 calls per day.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs dragonjar-android-pentesting-skill Performs static and dynamic Android APK security checks, bypasses client protections with Frida, and scores findings against MASVS. CX Codex +1 916installs malware-detection-security-awareness Helps AI agents spot malicious repositories disguised as cracked security software. Useful when verifying GitHub projects and avoiding malware delivery vectors. CX Codex +1 910installs malware-awareness-bitdefender-crack-fraud Detects fraudulent repositories that disguise info stealers and trojans as cracked Bitdefender utilities. It alerts developers before downloading untrusted binaries. CX Codex +1 872installs malware-detection-and-reporting This skill flags repositories that disguise malware as legitimate security software and helps assemble evidence for a report. CX Codex +1 851installs malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs kali-pentest-ai-agent This skill plans and runs phased penetration tests with Kali Linux tools. It fits authorized assessments where high-risk actions need human approval. CX Codex +1 837installs malware-analysis-warning This skill flags repositories that may distribute malware while posing as antivirus or other security software. CX Codex +1 833installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor