Back to MCP Trust Indexm8ven
69
/ 100
1 month ago
glama

CrowdSentinel MCP Server

Enables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.

→ thomasxm/CrowdSentinels-AI-MCP· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 12 credentials: ELASTICSEARCH_PASSWORD, ELASTICSEARCH_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, THREATFOX_API_KEY, ELASTICSEARCH_CLIENT_KEY, CLIENT_KEY, ELASTICSEARCH_BEARER_TOKEN, BEARER_TOKEN, MISP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configELASTICSEARCH_HOSTS— export ="https://localhost:9200"
configELASTICSEARCH_USERNAME— export ="elastic"
🔐 secretELASTICSEARCH_PASSWORD— export ="your_password"
configVERIFY_CERTS— export ="false"
🔐 secretELASTICSEARCH_API_KEY— export ="your_api_key"
🔐 secretANTHROPIC_API_KEY— export ="sk-ant-..." # or OPENAI_API_KEY
🔐 secretOPENAI_API_KEY— export ANTHROPIC_API_KEY="sk-ant-..." # or
configCROWDSENTINEL_MODEL_URL
configCROWDSENTINEL_MODEL
configCROWDSENTINEL_DATA_DIR
configCHAINSAW_PATH
configCHAINSAW_SIGMA_PATH
🔐 secretVIRUSTOTAL_API_KEY— "your_vt_key" # Free: 500 lookups/day
🔐 secretABUSEIPDB_API_KEY— "your_abuse_key" # Free: 1,000 lookups/day
🔐 secretTHREATFOX_API_KEY— "your_tf_key" # Free: unlimited
configMISP_URL— "https://misp.example.org" # MISP instance URL
configELASTICSEARCH_CLOUD_ID— "deployment:base64..." # Elastic Cloud
configCLOUD_ID
configREQUEST_TIMEOUT— "30" # Request timeout in seconds
configELASTICSEARCH_CA_CERT— ="/path/to/ca.crt" # Explicit CA certificate path
configCA_CERT
configELASTICSEARCH_CLIENT_CERT— ="/path/to/client.crt" # Client certificate (mTLS)
configCLIENT_CERT
🔐 secretELASTICSEARCH_CLIENT_KEY— ="/path/to/client.key" # Client private key (mTLS)
🔐 secretCLIENT_KEY
🔐 secretELASTICSEARCH_BEARER_TOKEN— "service_token_here" # Service/bearer token
🔐 secretBEARER_TOKEN
configCHAINSAW_EVTX_SAMPLES_PATH
🔐 secretMISP_API_KEY— "your_misp_key" # MISP API key (40-char hex)
configMISP_SSL_VERIFY— ="true" # Set "false" for self-signed (dev only)
configMISP_CA_BUNDLE
configDISABLE_HIGH_RISK_OPERATIONS— "true" # Block all write operations
configDISABLE_OPERATIONS
configVELOCIRAPTOR_API_CONFIG— export ="/path/to/api_client.yaml"
configCROWDSENTINEL_STORAGE_PATH
configCROWDSENTINEL_MAX_STORAGE_GB
configCROWDSENTINEL_COMPACT_AFTER_DAYS
configCROWDSENTINEL_MAX_IOCS
configCROWDSENTINEL_PROGRESSIVE_DISCLOSURE
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/thomasxm-crowdsentinels-ai-mcp-1tkchp)](https://m8ven.ai/mcp/thomasxm-crowdsentinels-ai-mcp-1tkchp)
commit: fe4008fadd6794103216ed548c4b0575a504cc92
code hash: b864cda57d0b1851af851b6ed3c01f976a6fd1c74c82716f3bc8b84175ad099a
verified: 6/22/2026, 12:46:19 PM
view raw JSON →