MCP Server Malcolm
UnclaimedMCP server for Malcolm: full read surface plus opt-in, audited write tools
Install
mcp-server-malcolmSet up this server
More in Security
Browse the full directoryUnclaimed listing
Is this your MCP server?
This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.
Claim this serverSecurity profile
Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works
40 of 40 tools
Documented tools (40)
From project documentation. A server handshake does not verify each tool’s description or behavior.
arkime_build_query
Compile an Arkime expression into the OpenSearch DSL it becomes, without running it — hand the result to searchdsl for a clause Arkime's syntax can't express
arkime_connections
Source/destination connection graph (nodes and links)
arkime_crons
List Arkime's cron queries — saved expressions that re-run on a schedule and explain where an unrecognized session tag came from
arkime_field_search
Search the field names Arkime expressions accept (listed again under Arkime)
arkime_file_by_hash
Extract the transferred file whose md5/sha256 matches (metadata only, nothing written to disk)
arkime_hunt_status
List Arkime hunt jobs and their progress — queued, running or finished. Not gated by a write class: it only reads job status, so it stays available with every write class off (it is part of the arkime-inventory read group)
arkime_multiunique
Unique value combinations across several fields (e.g. src.ip + dst.port pairs)
arkime_node_stats
Capture-node health: dropped packets, disk, memory, queues — warns when a node is losing packets, since that turns a gap into what looks like an absence
arkime_pcap_files
List the PCAP files Arkime has indexed, with each file's size, packet/session counts and time span
arkime_reverse_dns
Reverse-resolve one IP to its PTR hostname
arkime_session_detail
Fetch all fields (full SPI document) for one session
arkime_session_file_by_hash
Fetch the file ONE named session carried, by md5/sha256 (metadata only, nothing written to disk) — pins the answer to that session, unlike arkimefilebyhash, which serves the most recent match across every session
arkime_session_payload
Read a session's decoded payload — the bytes that crossed the wire, not parsed fields (plain text, not JSON)
arkime_session_pcap
Fetch a session's PCAP and report its size and file-magic validity (metadata only, nothing written to disk)
arkime_sessions
Search Arkime sessions with Arkime expression syntax
arkime_sessions_csv
Export sessions as a compact CSV table — about half the tokens of the same rows as JSON
arkime_sessions_summary
Total sessions, bytes and packets for an expression, plus per-field breakdowns — size a match before something expensive (like a hunt) acts on it
arkime_shortcuts
List named value lists (IOC sets) and what each holds, plus the $name token to use in an expression
arkime_spigraph
Top values of one field with a time-series graph
arkime_spigraphhierarchy
Hierarchical top-N breakdown across fields (nested drill-down)
arkime_spiview
Value profile across several fields in one call
arkime_unique
List distinct values of one field, with optional counts
arkime_views
List the saved search views the team curated, with each one's expression
cluster_health
OpenSearch cluster health
count
Count documents matching a DSL query clause
index_mapping
Field mapping/schema for an index
list_indices
List indices (name/health/status/doc count)
malcolm_aggregate
Aggregate traffic by one or more fields (top-N with counts)
malcolm_alerts
Search Suricata alerts by signature, severity, IP
malcolm_data_coverage
Data freshness per sensor, doc counts per dataset, index info
malcolm_field_profile
Show which event.dataset types contain a field
malcolm_field_search
Search available field names by keyword, prefix, or type
malcolm_field_values
List distinct values for a field
malcolm_netbox_lookup
Look up an IP, device, or network prefix in NetBox
malcolm_netbox_query
Read any other NetBox endpoint (services, VLANs, interfaces, VMs, contacts)
malcolm_netbox_sites
List the NetBox site directory (id, name, metadata)
malcolm_ping
Quick liveness check of the Malcolm API
malcolm_search
Search network traffic with Malcolm filter syntax
malcolm_service_status
Readiness of all Malcolm services plus version info
search_dsl
Run a raw OpenSearch DSL query (hits + aggregations, no hidden time window)
Tool change history
FAQ
Questions about MCP Server Malcolm MCP Server
- How do I connect MCP Server Malcolm MCP Server to Claude?
- The listing records `mcp-server-malcolm` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Desktop, Claude Code, Cursor as compatible clients.
- Is MCP Server Malcolm MCP Server free?
- The listed licence is MIT. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
- What can MCP Server Malcolm MCP Server do?
- MCP Server Malcolm MCP Server documents 40 tools to the agent, including arkime_build_query, arkime_connections, arkime_crons. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.