SuricataMCP
About
A server that allows MCP clients to use Suricata for network traffic analysis.
Details
- Author
- medinios
- Downloads
- 111
- Categories
- Other, Security, Infrastructure
Jump to
- Enables autonomous Suricata usage from MCP clients
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
SuricataMCPCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
3 Edit The Config Py File To Specify Your Suricata Installation Path
SURICATA_DIR = "/path/to/suricata" SURICATA_EXE_FILE = "suricata" # or "suricata.exe" on Windows
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"suricatamcp": {
"SuricataMcp": {
"command": "cmd",
"args": [
"/c",
"mcp",
"run",
"suricata-mcp.py"
]
}
}
}
}McpServers
{
"SuricataMcp": {
"command": "cmd",
"args": [
"/c",
"mcp",
"run",
"suricata-mcp.py"
]
}
}4. Add SuricataMCP to your AI platform with:
{ "mcpServers": { "SuricataMcp": { "command": "cmd", "args": ](https://smithery.ai/server/@Medinios/SuricataMCP)["/c", "mcp", "run", "[YourPath]\\SuricataMcp\\suricata-mcp.py"] } } }
Run the MCP server locally from your AI platform (like Cursor)
When running, the server exposes the following MCP tools:
- get_suricata_version(): Returns Suricata's version string.
- get_suricata_help(): Returns Suricata CLI help output.
- get_alerts_from_pcap_file(pcap_destination: str, destination_folder_results: str): Runs Suricata on the given .pcap file and returns the content of fast.log.
To extend Suricata with your own detection rules:
- Add your custom rule files (e.g., custom.rules) to the suricata/rules directory.
We are not affiliated with the official Suricata project or the OISF (Open Information Security Foundation). SuricataMCP is an independent integration built for personal use inside Cursor. Example pcap was taken fromPCAP-ATTACK
This project was built by two developers passionate about security, context-aware systems, and building useful tools for the community. Every line of code, every CLI command, and every integration was a product of focused collaboration and shared curiosity.
PRs and suggestions are welcome! Let's make SuricataMCP more accessible and programmable together.
MCP access to cluster-wide L4 and L7 network traffic, packets, APIs, and complete payloads.
Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment
A server for real-time network packet monitoring and security analysis.
Perform network scanning and security auditing using the NMAP utility.
Network diagnostics from 6 global regions — SSL, DNS, ping, whois, traceroute, port scan, latency. Works without an API key.
Integrate with Tailscale's CLI and API for automated network management and monitoring.
Empowers LLMs with real-time network traffic analysis using tshark. Requires Wireshark's tshark to be installed.
Model Context Protocol server for secure AsusWRT router administration via SSH. Provides 42+ read-only monitoring tools and guarded mutation tools for managing AsusWRT/Merlin routers.
A complete Model Context Protocol (MCP) server for Fortinet FortiOS 7.6.6
Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
