Mitre Mcp
MCP server for the MITRE ATT&CK knowledge base: map alerts to techniques, profile threat groups, analyze detection coverage, and enrich SOC workflows from an AI client.
Soc Stack
One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.
Proxmox Mcp
MCP server for Proxmox VE: inventory and operate VMs, LXC containers, and nodes from an AI client, with a gated write-safety model.
Cortex Mcp
MCP server for Cortex (StrangeBee/TheHive): run analyzers and responders, enrich observables, and triage threats with AI.
Adguardctrl
One bad call can take down your DNS filtering. adguardctrl gates every AdGuard Home write behind confirm and destructive flags. CLI plus MCP adapter, no daemon.
Wazuh Mcp
MCP server for Wazuh SIEM/XDR: query alerts, agents, vulnerabilities, and rules from Claude or any AI client. Read-only.
Librenmsctrl
A hallucinated call can mute a real alert. librenmsctrl gives shells, cron, and agents one stdio control surface for LibreNMS devices, ports, and alerts, writes gated.
Immich Mcp
MCP server for Immich: search, curate, and dedupe your self-hosted photo library from an AI client. 74 typed tools.
Suricata Mcp
MCP server for Suricata IDS/IPS and Zeek NSM: analyze EVE JSON alerts, hunt threats, and manage rules from an AI client
Maltego Mcp
Maltego MCP server: an LLM authors .mtgx OSINT graphs and runs whois/DNS/ASN/crt.sh lookups for threat intel