v0.1.0

The first release of mcp-server-malcolm, an MCP server for Malcolm, the open-source network traffic analysis platform (Zeek, Suricata, Arkime, OpenSearch, and NetBox).

It lets any MCP-compatible AI agent work with Malcolm through structured tools instead of raw queries, so the agent stops guessing at field names and filter syntax.

Read tools (always available)

• OpenSearch DSL core: search_dsl, count, list_indices, index_mapping, cluster_health
• Malcolm query and field discovery: malcolm_search, malcolm_aggregate, malcolm_alerts, malcolm_field_search, malcolm_field_values, malcolm_field_profile
• Health and coverage: malcolm_service_status, malcolm_data_coverage, malcolm_ping
• NetBox assets: malcolm_netbox_lookup, malcolm_netbox_sites
• Arkime: arkime_sessions, arkime_session_detail, arkime_session_pcap, arkime_unique, arkime_spigraph, arkime_spiview, arkime_connections
• Correlation and export: malcolm_related_sessions, malcolm_dashboard_export

Write tools (opt-in, off by default)

Write access is split into four classes, each behind its own environment flag and each disabled unless you turn it on. A disabled class is never registered, so its tools cannot be called. Every write attempt emits one audit line.

• alerting: malcolm_create_alert
• arkime-tag: arkime_add_tags
• hunt-job: arkime_create_hunt, arkime_hunt_status
• pcap-upload: malcolm_upload_pcap

Every write is additive. This version has no tool that deletes data, removes a tag, or touches user accounts.

Install

pip install mcp-server-malcolm

Requires Python 3.11 or newer and a Malcolm instance with API access. See the README for configuration and usage.