{"server":{"$schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","name":"io.github.MHaggis/security-detections-mcp","description":"Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK.","title":"Security Detections","repository":{"url":"https://github.com/MHaggis/Security-Detections-MCP","source":"github"},"version":"3.3.4","packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"security-detections-mcp","version":"3.3.4","runtimeHint":"npx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)","name":"SIGMA_PATHS"},{"description":"Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)","name":"SPLUNK_PATHS"},{"description":"Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)","name":"ELASTIC_PATHS"},{"description":"Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)","name":"KQL_PATHS"},{"description":"Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)","name":"SUBLIME_PATHS"},{"description":"Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)","name":"CQL_HUB_PATHS"},{"description":"Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)","name":"JAMF_PROTECT_PATHS"},{"description":"Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)","name":"STORY_PATHS"}]}]},"_meta":{"io.modelcontextprotocol.registry/official":{"status":"active","statusChangedAt":"2026-11-04T19:19:18.78265Z","publishedAt":"2026-11-04T19:19:18.78265Z","updatedAt":"2026-11-04T19:19:18.78265Z","isLatest":true}}}