Security Infrastructure MCP Servers
About
Integrate with security platforms like Splunk SIEM, CrowdStrike EDR, and Microsoft MISP.
Details
- Author
- jmstar85
- Downloads
- 312
- Categories
- Cloud Service, Infrastructure, Developer Tools
Jump to
- Native MCP Protocol integration for security platforms
- Multi-platform support for Splunk, CrowdStrike, and MISP
- Asynchronous operations for non-blocking API calls
- Flexible query languages: SPL, FQL, and MISP REST
- OAuth 2.0 and token-based authentication
- Docker support and structured JSON output
Clone the repository, install Python dependencies with pip install -r project-requirements.txt, copy .env.example to .env and fill in credentials, then add the server configuration to an MCP client such as Claude Desktop. Alternatively, run individual servers via python src/splunk_server.py (port 8080), python src/crowdstrike_server.py (port 8081), or python src/misp_server.py (port 8082), or deploy all with docker-compose up -d.
Integrate with security platforms like Splunk SIEM, CrowdStrike EDR, and Microsoft MISP.
A comprehensive collection ofsecureMCP (Model Context Protocol) server implementations for security platform integrations with enterprise-grade security hardening.
This project has undergone comprehensive security hardening to address critical vulnerabilities and implement security best practices:
- 🔴 HIGH Severity Fixes:
- SPL injection prevention with query sanitization and dangerous command blocking
- Secure XML parsing using defusedxml to prevent XXE attacks
- Complete removal of hardcoded credentials from all configuration files
- Enforced TLS 1.2+ with strong cipher suites for all API communications
- Comprehensive input validation and sanitization across all servers
- Prevention of command execution risks and injection attacks
- Error message sanitization to prevent information disclosure
- FQL/SPL injection attack prevention with pattern matching
- SSL certificate validation enforcement
- Data sanitization for API responses
- Secure configuration templates with safe placeholders
- Comprehensive .gitignore to prevent credential exposure
- Secure SPL Query Execution: Execute Search Processing Language queries with injection prevention
- Event Search: Search security events across all indexes with sanitized filtering
- Time-based Analysis: Validated time ranges and custom time windows
- Asynchronous Job Management: Create and monitor search jobs with secure result retrieval
- JSON Result Format: Structured output with sensitive data filtering
- Secure Detection Search: Query detections using validated FQL (Falcon Query Language)
- Detection Details: Retrieve sanitized detection summaries and metadata
- OAuth 2.0 Authentication: Secure API access with proper token management
- Input Validation: Comprehensive parameter validation and whitelisting
- Real-time Threat Data: Access to latest endpoint detection data with security filtering
- Event Search: Query MISP events with input sanitization and validation
- IOC Attribute Search: Search indicators with XSS and injection prevention
- Multi-format Support: Handle various IOC types with content validation
- SSL Security: Enforced certificate verification with security warnings
- RESTful API Integration: Secure MISP REST API support with error sanitization
# 1. Clone the repository git clone https://github.com/jmstar85/SecurityInfrastructure.git cd SecurityInfrastructure # 2. Install secure dependencies pip install -r requirements.txt # 3. Configure credentials securely cp .env.example .env # Edit .env with your platform credentials (see security guidelines) # 4. Add to Claude Desktop configuration # Copy config-example.json content to your Claude Desktop config # Location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) # Update paths and environment variables with your secure values
# Verify configuration security python -c " import json with open('.env', 'r') as f: content = f.read() if 'REPLACE_WITH_YOUR' in content: print('⚠️ Please update placeholder credentials in .env') else: print('✅ Configuration appears to be customized') " # Test server security python src/splunk_server.py # Runs on localhost:8080 python src/crowdstrike_server.py # Runs on localhost:8081 python src/misp_server.py # Runs on localhost:8082
- search-events: Execute sanitized SPL queries with injection prevention
# Example: Secure search for failed login attempts query = "index=security sourcetype=auth action=failure" # Automatically sanitized earliest_time = "-24h" # Validated time format
CrowdStrike EDR Tools (Security Hardened)
- search-detections: Query detections with FQL validation and whitelisting
# Example: Secure search for high severity detections filter_query = "max_severity:'high'" # Validated against injection patterns sort = "created_timestamp.desc" # Whitelisted sort options only
- search-events: Query threat intelligence with input sanitization
- search-attributes: Search IOCs with XSS and injection prevention
# Example: Secure search for IP-based IOCs type = "ip-dst" # Input sanitized and validated category = "Network activity" # Content filtered for safety
SecurityInfrastructure/ ├── src/ # Secure MCP server implementations │ ├── splunk_server.py # Splunk SIEM integration (hardened) │ ├── crowdstrike_server.py # CrowdStrike EDR integration (hardened) │ └── misp_server.py # Microsoft MISP integration (hardened) ├── config/ # Secure configuration templates │ ├── mcp-settings.json # MCP client configuration (sanitized) │ └── splunk.yaml # Splunk configuration template ├── tests/ # Security validation tests ├── SECURITY.md # Security guidelines and best practices ├── config-example.json # Safe configuration template ├── .env.example # Environment variables template (secure) ├── .gitignore # Comprehensive credential protection ├── requirements.txt # Minimal secure dependencies ├── INSTALLATION.md # Detailed setup guide ├── setup-guide.md # Quick setup templates └── docker-compose.yml # Container configuration
Note:Frontend components, unnecessary Node.js files, and development artifacts have been removed to minimize attack surface and optimize security posture.
- macOS:~/Library/Application Support/Claude/claude_desktop_config.json
- Windows:%APPDATA%\Claude\claude_desktop_config.json
{ "mcpServers": { "security-infrastructure-splunk": { "command": "python", "args": ["/FULL/PATH/TO/SecurityInfrastructure/src/splunk_server.py"], "env": { "SPLUNK_HOST": "REPLACE_WITH_YOUR_SPLUNK_HOST", "SPLUNK_TOKEN": "REPLACE_WITH_YOUR_API_TOKEN", "SPLUNK_VERIFY_SSL": "true" } } } }
⚠️ Security Note:Never commit real credentials to version control. Use the provided templates and replace placeholders with actual values.
Once securely configured with Claude Desktop, you can use natural language to interact with your security platforms:
"Search for failed SSH login attempts in the last 6 hours" "Find all authentication events from IP 192.168.1.100" "Show me high priority security alerts from yesterday" "Search for events in the security index containing 'malware'"
"Show me all high severity detections from today" "Find endpoint detections with behavior patterns" "List recent detections sorted by creation time" "Search for detections on specific hostnames"
"Search for events related to specific threat actors" "Find all IP address indicators of compromise" "Look up domain indicators from the last week" "Search for published threat intelligence events about phishing"
- Input Validation: Comprehensive sanitization and validation of all user inputs
- Injection Prevention: Protection against SPL, FQL, SQL, and XSS injection attacks
- Secure Communications: Enforced HTTPS/TLS 1.2+ with strong cipher suites
- Error Sanitization: Generic error messages to prevent information disclosure
- Authentication Security: Secure token/credential handling with proper validation
- Multiple Auth Methods: Session-based, token-based, and OAuth 2.0 with secure defaults
- SSL/TLS Enforcement: Mandatory certificate verification for all connections
- API Security: Rate limiting, timeout enforcement, and connection pooling limits
- Configuration Security: Safe templates, credential masking, and .gitignore protection
- Output Sanitization: Removal of sensitive fields from API responses
- Credential Management: No hardcoded secrets, environment variable protection
- Logging Security: Sensitive data filtering in logs and audit trails
- Session Management: Proper token expiration and secure storage
- Python 3.11+
- Secure access credentials for security platforms (properly configured)
- MCP-compatible client (Claude Desktop recommended)
- SSL/TLS certificates for production deployments
- API Token(strongly recommended) with minimal required permissions
- HTTPS endpointverification required
- Search permissionslimited to necessary indexes only
- Client IDandClient Secretwith principle of least privilege
- API permissions: Detections (READ), limited scope
- Base URLvalidation and HTTPS enforcement
- API Keywith read-only permissions when possible
- MISP instance URLwith SSL certificate validation
- Timeout settingsconfigured for security
This project includes comprehensive security validation:
# Run security validation tests python -m pytest tests/ -v # Validate configuration security python -c " import os config_files = ['.env', 'config/mcp-settings.json'] for f in config_files: if os.path.exists(f): with open(f) as file: content = file.read() if 'REPLACE_WITH_YOUR' in content: print(f'⚠️ {f} contains placeholder credentials') else: print(f'✅ {f} appears configured') "
- Vulnerability Status: All HIGH and MEDIUM severity issues resolved
- Security Coverage: 83% of security validation tests passed
- Code Quality: Comprehensive input validation and error handling
- Attack Surface: Minimized through component removal and optimization
- Fork the repository
- Create a feature branch (git checkout -b feature/security-enhancement)
- Follow security guidelines inSECURITY.md
- Add security tests for new features
- Commit with security validation (git commit -am 'Add secure feature')
- Push to the branch (git push origin feature/security-enhancement)
- Create a Pull Request with security review checklist
This project is provided for security research and educational purposes with a focus on secure implementation practices.
- SECURITY.md- Security guidelines and best practices
- MCP Protocol Documentation
- OWASP Security Guidelines
- Platform API Security Documentation
If you discover a security vulnerability, please:
- Do notcreate a public issue
- Email security details to the maintainer
- Allow reasonable time for fixes before disclosure
- Follow responsible disclosure practices
⭐If you find this secure implementation useful, please give it a star!
Latest Security Update:December 2024 - Comprehensive security hardening with vulnerability remediation and optimization.
Navigate your Aiven projects and interact with the PostgreSQL®, Apache Kafka®, ClickHouse® and OpenSearch® services
Yunxiao MCP Server provides AI assistants with the ability to interact with the Yunxiao platform.
Get prescriptive CDK advice, explain CDK Nag rules, check suppressions, generate Bedrock Agent schemas, and discover AWS Solutions Constructs patterns.
This AWS Labs Model Context Protocol (MCP) server for CloudTrail enables your AI agents to query AWS account activity for security investigations, compliance auditing, and operational troubleshooting.
Core AWS MCP server providing prompt understanding and server management capabilities.
Analyze CDK projects to identify AWS services used and get pricing information from AWS pricing webpages and API.
Query and analyze your Axiom logs, traces, and all other event data in natural language
Manage and interact with Microsoft Azure services.
Bastion: External Attack Surface Monitoring
Ask your AI assistant about your attack surface: run scans, catch expiring certificates and domains, triage findings, and generate reports.
Agent-ready global image CDN that AI agents can install and operate through MCP.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
