MCP Server Malcolm
未认领MCP server for Malcolm: full read surface plus opt-in, audited write tools
安装
mcp-server-malcolm更多Security服务器
浏览完整目录安全概况
已认领和已认证的服务器每周接受一次静态扫描，显示代码能触及的范围（外部服务、环境变量、shell 命令、代理配置目录）以及带有已知公告的依赖。认领此列表即可获得。 安全概况的工作原理
40 个工具中显示 40 个
文档中列出的工具 (40)
内容来自项目文档。服务器握手不会验证每个工具的说明或行为。
arkime_build_query
Compile an Arkime expression into the OpenSearch DSL it becomes, without running it — hand the result to searchdsl for a clause Arkime's syntax can't express
arkime_connections
Source/destination connection graph (nodes and links)
arkime_crons
List Arkime's cron queries — saved expressions that re-run on a schedule and explain where an unrecognized session tag came from
arkime_field_search
Search the field names Arkime expressions accept (listed again under Arkime)
arkime_file_by_hash
Extract the transferred file whose md5/sha256 matches (metadata only, nothing written to disk)
arkime_hunt_status
List Arkime hunt jobs and their progress — queued, running or finished. Not gated by a write class: it only reads job status, so it stays available with every write class off (it is part of the arkime-inventory read group)
arkime_multiunique
Unique value combinations across several fields (e.g. src.ip + dst.port pairs)
arkime_node_stats
Capture-node health: dropped packets, disk, memory, queues — warns when a node is losing packets, since that turns a gap into what looks like an absence
arkime_pcap_files
List the PCAP files Arkime has indexed, with each file's size, packet/session counts and time span
arkime_reverse_dns
Reverse-resolve one IP to its PTR hostname
arkime_session_detail
Fetch all fields (full SPI document) for one session
arkime_session_file_by_hash
Fetch the file ONE named session carried, by md5/sha256 (metadata only, nothing written to disk) — pins the answer to that session, unlike arkimefilebyhash, which serves the most recent match across every session
arkime_session_payload
Read a session's decoded payload — the bytes that crossed the wire, not parsed fields (plain text, not JSON)
arkime_session_pcap
Fetch a session's PCAP and report its size and file-magic validity (metadata only, nothing written to disk)
arkime_sessions
Search Arkime sessions with Arkime expression syntax
arkime_sessions_csv
Export sessions as a compact CSV table — about half the tokens of the same rows as JSON
arkime_sessions_summary
Total sessions, bytes and packets for an expression, plus per-field breakdowns — size a match before something expensive (like a hunt) acts on it
arkime_shortcuts
List named value lists (IOC sets) and what each holds, plus the $name token to use in an expression
arkime_spigraph
Top values of one field with a time-series graph
arkime_spigraphhierarchy
Hierarchical top-N breakdown across fields (nested drill-down)
arkime_spiview
Value profile across several fields in one call
arkime_unique
List distinct values of one field, with optional counts
arkime_views
List the saved search views the team curated, with each one's expression
cluster_health
OpenSearch cluster health
count
Count documents matching a DSL query clause
index_mapping
Field mapping/schema for an index
list_indices
List indices (name/health/status/doc count)
malcolm_aggregate
Aggregate traffic by one or more fields (top-N with counts)
malcolm_alerts
Search Suricata alerts by signature, severity, IP
malcolm_data_coverage
Data freshness per sensor, doc counts per dataset, index info
malcolm_field_profile
Show which event.dataset types contain a field
malcolm_field_search
Search available field names by keyword, prefix, or type
malcolm_field_values
List distinct values for a field
malcolm_netbox_lookup
Look up an IP, device, or network prefix in NetBox
malcolm_netbox_query
Read any other NetBox endpoint (services, VLANs, interfaces, VMs, contacts)
malcolm_netbox_sites
List the NetBox site directory (id, name, metadata)
malcolm_ping
Quick liveness check of the Malcolm API
malcolm_search
Search network traffic with Malcolm filter syntax
malcolm_service_status
Readiness of all Malcolm services plus version info
search_dsl
Run a raw OpenSearch DSL query (hits + aggregations, no hidden time window)