io.github.thomasxm/crowdsentinel-mcp-server

io.github.thomasxm/crowdsentinel-mcp-server

AI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "crowdsentinel-mcp-server": {
      "command": "uvx",
      "args": [
        "crowdsentinel-mcp-server"
      ],
      "env": {
        "ELASTICSEARCH_HOSTS": "https://localhost:9200",
        "ELASTICSEARCH_API_KEY": "<your ELASTICSEARCH_API_KEY>",
        "ELASTICSEARCH_PASSWORD": "<your ELASTICSEARCH_PASSWORD>",
        "ELASTICSEARCH_BEARER_TOKEN": "<your ELASTICSEARCH_BEARER_TOKEN>",
        "VERIFY_CERTS": "false"
      }
    }
  }
}
Environment variables
  • ELASTICSEARCH_HOSTSComma-separated Elasticsearch hosts. Supports HTTP/HTTPS, local/remote/cloud (e.g., http://localhost:9200, https://es.prod.example.com:9200)
  • ELASTICSEARCH_API_KEYsecretAPI key for authentication (recommended for production and Elastic Cloud)
  • ELASTICSEARCH_PASSWORDsecretPassword for basic authentication (used with ELASTICSEARCH_USERNAME)
  • ELASTICSEARCH_BEARER_TOKENsecretBearer/service token for authentication (alternative to API key)
  • VERIFY_CERTSTLS certificate verification: true (verify CA — production), false (skip — dev/test), or /path/to/ca.crt (custom CA)

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
0.6.0
Registry
active
Published
7/19/2026
Browse all Developer Tools →

Add the badge to your site

Show visitors that io.github.thomasxm/crowdsentinel-mcp-server is listed here — it’s also the link we check for a free listing.

io.github.thomasxm/crowdsentinel-mcp-server — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-thomasxm-crowdsentinel-mcp-server?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="io.github.thomasxm/crowdsentinel-mcp-server — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![io.github.thomasxm/crowdsentinel-mcp-server — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-thomasxm-crowdsentinel-mcp-server?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.