zeek-mcp

An MCP server for Zeek and Suricata, providing intelligent log parsing, querying, and analysis over network security monitoring data.

→ solomonneas/zeek-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: MISP_API_KEY, THEHIVE_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretMISP_API_KEY— (none) MISP API key. Required for MISP tools.

configMISP_URL

configMISP_VERIFY_SSL

configPCAP_DIR— /opt/nids/pcaps Directory of PCAP files. pcap_analyze confines all filenames (relative and absolute) to this directory; anything resolving outside it is rejected.

configPCAP_OUTPUT_DIR— /tmp/zeek-pcap-analysis Working directory for generated logs.

configSURICATA_EVE_LOG— /opt/nids/suricata/logs/eve.json Path to Suricata eve.json

configSURICATA_FAST_LOG— /opt/nids/suricata/logs/fast.log Path to Suricata fast.log

configSURICATA_RULES_DIR— /opt/nids/suricata/rules Path to Suricata rules directory

🔐 secretTHEHIVE_API_KEY— (none) TheHive API key. Required for TheHive tools.

configTHEHIVE_URL

configTHEHIVE_VERIFY_SSL

configZEEK_BINARY— /usr/local/zeek/bin/zeek Path to the Zeek binary.

configZEEK_CONTAINER— zeek Docker container to run Zeek in. Set to empty to run Zeek directly on the host.

configZEEK_LOG_ARCHIVE— /opt/zeek/logs Path to archived/rotated logs

configZEEK_LOG_DIR— /opt/zeek/logs/current Path to current Zeek logs

configZEEK_LOG_FORMAT— json Log format: json or tsv

configZEEK_MAX_RESULTS— 1000 Maximum results per query

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/solomonneas-zeek-mcp-44u1p4)](https://m8ven.ai/mcp/solomonneas-zeek-mcp-44u1p4)

commit: b14c6480b3a62b7fd89c7daf55eb15f7a83aeca2

code hash: 0f9636240d93067b1e7662d88bae72180e024668f04d82f91b13bfcf2814badf

verified: 6/11/2026, 11:42:04 AM

view raw JSON →