{"id":49005572,"url":"https://github.com/elastic/example-mcp-app-security","last_synced_at":"2026-04-24T01:01:09.714Z","repository":{"id":352128268,"uuid":"1213850825","full_name":"elastic/example-mcp-app-security","owner":"elastic","description":"Reference MCP App for Elastic Security — interactive SOC dashboards inside Claude, Cursor, and other MCP hosts.","archived":false,"fork":false,"pushed_at":"2026-04-21T16:46:39.000Z","size":2218,"stargazers_count":1,"open_issues_count":2,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-21T23:04:23.964Z","etag":null,"topics":["ai","claude","cursor","elastic","mcp","model-context-protocol","security","soc"],"latest_commit_sha":null,"homepage":"https://modelcontextprotocol.io/extensions/apps/overview","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/elastic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE.txt","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-17T20:38:51.000Z","updated_at":"2026-04-21T16:46:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"e9732edf-1969-4319-bccc-01901603fbb6","html_url":"https://github.com/elastic/example-mcp-app-security","commit_stats":null,"previous_names":["elastic/example-mcp-app-security"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/elastic/example-mcp-app-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fexample-mcp-app-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fexample-mcp-app-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fexample-mcp-app-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fexample-mcp-app-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elastic","download_url":"https://codeload.github.com/elastic/example-mcp-app-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Fexample-mcp-app-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32159962,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-22T17:06:48.269Z","status":"ssl_error","status_checked_at":"2026-04-22T17:06:19.037Z","response_time":58,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","claude","cursor","elastic","mcp","model-context-protocol","security","soc"],"created_at":"2026-04-18T20:00:59.959Z","updated_at":"2026-04-23T00:01:01.515Z","avatar_url":"https://github.com/elastic.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Elastic Security MCP App\n\n[![Latest Release](https://img.shields.io/github/v/release/elastic/example-mcp-app-security?label=Download%20.mcpb\u0026color=00bfb3)](https://github.com/elastic/example-mcp-app-security/releases/latest)\n\nAn [MCP App](https://modelcontextprotocol.io/extensions/apps/overview) that brings interactive blue-team security operations directly into Claude, VS Code, and other MCP-compatible AI hosts. Built on the [Model Context Protocol](https://modelcontextprotocol.io/) with interactive UI extensions that render inline in the conversation.\n\n\u003e **What are MCP Apps?** MCP Apps extend the Model Context Protocol to let tool servers return interactive HTML interfaces — dashboards, forms, visualizations — that render inside the AI conversation. The LLM calls a tool, and instead of just returning text, an interactive UI appears alongside the response.\n\n![Alert Triage Dashboard](docs/screenshots/alert-triage.png)\n\n## What This Does\n\nThis project provides six interactive security operations tools, each with a rich React-based UI that renders inline when Claude (or another MCP host) calls the tool:\n\n| Tool | What It Does |\n|------|-------------|\n| **Alert Triage** | Fetch, filter, and triage security alerts with AI verdict cards, process tree, and network investigation |\n| **Attack Discovery** | AI-powered correlated attack chain analysis with confidence scoring, entity risk, and MITRE mapping |\n| **Case Management** | Create, search, and manage SOC investigation cases with AI-assisted actions |\n| **Detection Rules** | Browse, tune, and manage detection rules with KQL search and noisy rules analysis |\n| **Threat Hunt** | ES\\|QL workbench with clickable entities and a D3 investigation graph |\n| **Sample Data** | Generate ECS security events for demos across 4 attack chain scenarios |\n\nSee [docs/features.md](docs/features.md) for a full breakdown of each tool's capabilities.\n\n## Quick Start\n\n\u003e [!TIP]\n\u003e **Just want to try it?** Download [`elastic-security-mcp-app.mcpb`](https://github.com/elastic/example-mcp-app-security/releases/latest) and double-click it. No Node.js, no cloning, no config files.\n\u003e\n\u003e Claude Desktop handles the rest — you'll be prompted for your Elasticsearch URL and API key during install. That's it.\n\nFor other hosts (Cursor, VS Code, Claude Code) or building from source, see [Installation](#installation) below.\n\n## How It Works\n\n![Interaction Flow](docs/screenshots/interaction-flow.png)\n\nWhen a user asks Claude to triage alerts or run a threat hunt, Claude calls a model-facing tool on this server. The tool returns a compact text summary to Claude **and** an interactive React UI that renders inline in the conversation. The UI then calls app-only tools directly for all subsequent interactions — keeping the LLM context small while the UI has full data access.\n\nSee [docs/architecture.md](docs/architecture.md) for details on how views are built, how the UI communicates with the server, and key design decisions.\n\n### Skills\n\nThe `skills/` directory contains [Claude Skills](https://claude.com/docs/skills/overview) — `SKILL.md` files that teach Claude *when* and *how* to use the tools. See [docs/setup-skills.md](docs/setup-skills.md) for installation instructions.\n\n## Installation\n\n| Guide | Description |\n|-------|-------------|\n| [Add to Claude Desktop](docs/setup-claude-desktop.md) | Install the MCP app via one-click `.mcpb` or manual config |\n| [Add to Cursor](docs/setup-cursor.md) | Connect the MCP app via npx or a locally running server |\n| [Add to VS Code](docs/setup-vscode.md) | Connect the MCP app via npx or a locally running server |\n| [Add to Claude Code](docs/setup-claude-code.md) | Register the MCP app via the `claude mcp add` CLI |\n| [Add to Claude.ai](docs/setup-claude-ai.md) | Expose the MCP app via a cloudflared tunnel |\n| [Build and run locally](docs/setup-local.md) | Build the MCP server from source and run it on your machine |\n| [Install skills](docs/setup-skills.md) | Install skills via npx, local clone, or zip upload |\n\n## Development\n\n```bash\nnpm run dev          # Watch mode\nnpm run typecheck    # Type-check only\nnpm run build:views  # Build views only\nnpm run build:server # Build server only\n```\n\n## Inspired By\n\n- [Elastic Agent Skills](https://github.com/elastic/agent-skills/tree/main/skills/security) — SOC triage methodology and tool patterns\n- [MCP Apps Specification](https://modelcontextprotocol.io/extensions/apps/overview) — Interactive UI extensions for MCP\n\n## License\n\nElastic-2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Fexample-mcp-app-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felastic%2Fexample-mcp-app-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Fexample-mcp-app-security/lists"}