← Index

io.github.thomasxm/crowdsentinel-mcp-server

io.github.thomasxm/crowdsentinel-mcp-server·v0.5.6·Search
Quality Score
79
/100

AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch

§01  Install
Claude Desktop (uvx)
{
  "mcpServers": {
    "crowdsentinel-mcp-server": {
      "command": "uvx",
      "args": [
        "crowdsentinel-mcp-server"
      ],
      "env": {
        "ELASTICSEARCH_HOSTS": "https://localhost:9200",
        "ELASTICSEARCH_CLOUD_ID": "<elasticsearch_cloud_id>",
        "ELASTICSEARCH_API_KEY": "<your-elasticsearch_api_key>",
        "ELASTICSEARCH_USERNAME": "<elasticsearch_username>",
        "ELASTICSEARCH_PASSWORD": "<your-elasticsearch_password>",
        "ELASTICSEARCH_BEARER_TOKEN": "<your-elasticsearch_bearer_token>",
        "VERIFY_CERTS": "false",
        "REQUEST_TIMEOUT": "<request_timeout>"
      }
    }
  }
}
§02  Environment variables
ELASTICSEARCH_HOSTS

Comma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)

ELASTICSEARCH_CLOUD_ID

Elastic Cloud deployment ID (alternative to ELASTICSEARCH_HOSTS for cloud deployments)

ELASTICSEARCH_API_KEY
secret

API key for authentication (recommended for production and Elastic Cloud)

ELASTICSEARCH_USERNAME

Username for basic authentication (alternative to API key)

ELASTICSEARCH_PASSWORD
secret

Password for basic authentication (used with ELASTICSEARCH_USERNAME)

ELASTICSEARCH_BEARER_TOKEN
secret

Bearer/service token for authentication (alternative to API key)

VERIFY_CERTS

TLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)

REQUEST_TIMEOUT

Request timeout in seconds (e.g., 60 or 10.5)

§03  MCP Quality Score  ·  methodology
freshness
24
completeness
10
installability
25
documentation
15
stability
5
§04  Alternatives in Search