AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add crowdsentinel --env ELASTICSEARCH_API_KEY='<ELASTICSEARCH_API_KEY>' --env ELASTICSEARCH_PASSWORD='<ELASTICSEARCH_PASSWORD>' --env ELASTICSEARCH_BEARER_TOKEN='<ELASTICSEARCH_BEARER_TOKEN>' -- uvx crowdsentinel-mcp-server~/.codex/config.toml
[mcp_servers.crowdsentinel]
command = "uvx"
args = ["crowdsentinel-mcp-server"]
env = { ELASTICSEARCH_API_KEY = "<ELASTICSEARCH_API_KEY>", ELASTICSEARCH_PASSWORD = "<ELASTICSEARCH_PASSWORD>", ELASTICSEARCH_BEARER_TOKEN = "<ELASTICSEARCH_BEARER_TOKEN>" }
# codex mcp add crowdsentinel --env ELASTICSEARCH_API_KEY='<ELASTICSEARCH_API_KEY>' --env ELASTICSEARCH_PASSWORD='<ELASTICSEARCH_PASSWORD>' --env ELASTICSEARCH_BEARER_TOKEN='<ELASTICSEARCH_BEARER_TOKEN>' -- uvx crowdsentinel-mcp-server~/.cursor/mcp.json
{
"mcpServers": {
"crowdsentinel": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
"ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"crowdsentinel": {
"type": "stdio",
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
"ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"crowdsentinel": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
"ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"crowdsentinel": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
"ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"crowdsentinel": {
"command": "uvx",
"args": [
"crowdsentinel-mcp-server"
],
"env": {
"ELASTICSEARCH_API_KEY": "<ELASTICSEARCH_API_KEY>",
"ELASTICSEARCH_PASSWORD": "<ELASTICSEARCH_PASSWORD>",
"ELASTICSEARCH_BEARER_TOKEN": "<ELASTICSEARCH_BEARER_TOKEN>"
}
}
}
}Environment variables
ELASTICSEARCH_API_KEYELASTICSEARCH_PASSWORDELASTICSEARCH_BEARER_TOKEN
Replace the placeholders with your own credentials and keep them out of version control.