Crowdsentinel Mcp Server

io.github.thomasxm/crowdsentinel-mcp-server · v0.6.0

AI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics

Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add crowdsentinel-mcp-server -e ELASTICSEARCH_HOSTS=<ELASTICSEARCH_HOSTS> -e ELASTICSEARCH_CLOUD_ID=<ELASTICSEARCH_CLOUD_ID> -e ELASTICSEARCH_API_KEY=<ELASTICSEARCH_API_KEY> -e ELASTICSEARCH_USERNAME=<ELASTICSEARCH_USERNAME> -e ELASTICSEARCH_PASSWORD=<ELASTICSEARCH_PASSWORD> -e ELASTICSEARCH_BEARER_TOKEN=<ELASTICSEARCH_BEARER_TOKEN> -e VERIFY_CERTS=<VERIFY_CERTS> -e REQUEST_TIMEOUT=<REQUEST_TIMEOUT> -- uvx crowdsentinel-mcp-server==0.6.0

claude_desktop_config.json

{
  "mcpServers": {
    "crowdsentinel-mcp-server": {
      "command": "uvx",
      "args": [
        "crowdsentinel-mcp-server==0.6.0"
      ],
      "env": {
        "ELASTICSEARCH_HOSTS": "<ELASTICSEARCH_HOSTS>",
        "ELASTICSEARCH_CLOUD_ID": "<ELASTICSEARCH_CLOUD_ID>",
        "ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
        "ELASTICSEARCH_USERNAME": "<ELASTICSEARCH_USERNAME>",
        "ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
        "ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>",
        "VERIFY_CERTS": "<VERIFY_CERTS>",
        "REQUEST_TIMEOUT": "<REQUEST_TIMEOUT>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "crowdsentinel-mcp-server": {
      "command": "uvx",
      "args": [
        "crowdsentinel-mcp-server==0.6.0"
      ],
      "env": {
        "ELASTICSEARCH_HOSTS": "<ELASTICSEARCH_HOSTS>",
        "ELASTICSEARCH_CLOUD_ID": "<ELASTICSEARCH_CLOUD_ID>",
        "ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
        "ELASTICSEARCH_USERNAME": "<ELASTICSEARCH_USERNAME>",
        "ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
        "ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>",
        "VERIFY_CERTS": "<VERIFY_CERTS>",
        "REQUEST_TIMEOUT": "<REQUEST_TIMEOUT>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "crowdsentinel-mcp-server": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "crowdsentinel-mcp-server==0.6.0"
      ],
      "env": {
        "ELASTICSEARCH_HOSTS": "<ELASTICSEARCH_HOSTS>",
        "ELASTICSEARCH_CLOUD_ID": "<ELASTICSEARCH_CLOUD_ID>",
        "ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
        "ELASTICSEARCH_USERNAME": "<ELASTICSEARCH_USERNAME>",
        "ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
        "ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>",
        "VERIFY_CERTS": "<VERIFY_CERTS>",
        "REQUEST_TIMEOUT": "<REQUEST_TIMEOUT>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`ELASTICSEARCH_HOSTS` Optional	Comma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)
`ELASTICSEARCH_CLOUD_ID` Optional	Elastic Cloud deployment ID (alternative to ELASTICSEARCH_HOSTS for cloud deployments)
`ELASTICSEARCH_API_KEY` Optional, secret	API key for authentication (recommended for production and Elastic Cloud)
`ELASTICSEARCH_USERNAME` Optional	Username for basic authentication (alternative to API key)
`ELASTICSEARCH_PASSWORD` Optional, secret	Password for basic authentication (used with ELASTICSEARCH_USERNAME)
`ELASTICSEARCH_BEARER_TOKEN` Optional, secret	Bearer/service token for authentication (alternative to API key)
`VERIFY_CERTS` Optional	TLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)
`REQUEST_TIMEOUT` Optional	Request timeout in seconds (e.g., 60 or 10.5)

Details

Package	`[email protected]` (PYPI, stdio)
First published	19 Jul 2026
Last updated	19 Jul 2026
Registry name	`io.github.thomasxm/crowdsentinel-mcp-server`

More databases servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use Crowdsentinel Mcp Server often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-thomasxm-crowdsentinel-mcp-server/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-thomasxm-crowdsentinel-mcp-server)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.