An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL security detection rules.
Security Detections is an MCP project maintained in the mhaggis/security-detections-mcp repository. The maintainer describes its purpose as “An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL security detection…”. Read the project documentation for the complete scope.
The documented npm package is security-detections-mcp. The configuration below comes from the maintainer’s example; adapt its paths and account values to your environment.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
{
"mcpServers": {
"security-detections": {
"command": "npx",
"args": [
"-y",
"security-detections-mcp"
]
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
Inspect PostgreSQL schemas and run read-only queries with the archived MCP reference server. Review its maintenance status before choosing it.
Connect the Notion MCP server to search workspace content and work with pages and databases through Notion’s hosted OAuth service.
Use the Supabase MCP server to inspect database schemas, query project data and retrieve docs through a project-scoped connection.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.