nagameTW/mcp-server-malcolm

Overview

An MCP server that exposes Malcolm's full read surface to AI tools and assistants. It includes opt-in write tools that are audited, meaning write operations are disabled unless explicitly enabled and logged.

Best for

Best for
Developers prototyping MCP-based assistants that need read and audited write access to Malcolm.

Use cases

• Connect an AI assistant to query Malcolm data through MCP
• Enable audited write operations for controlled automation
• Build custom tooling that reads Malcolm's full data surface

How to use

Install

uvx --from /path/to/mcp-server-malcolm mcp-server-malcolm

Tools exposed

• MALCOLM_URL
• MALCOLM_USERNAME
• MALCOLM_PASSWORD
• MALCOLM_SSL_VERIFY
• MALCOLM_TIMEOUT
• MALCOLM_MAX_CONCURRENCY
• MALCOLM_MAX_REQUESTS_PER_MINUTE
• search_dsl
• list_indices
• index_mapping
• cluster_health
• malcolm_search
• malcolm_aggregate
• malcolm_alerts
• malcolm_field_search
• malcolm_field_values
• malcolm_field_profile
• arkime_field_search
• malcolm_service_status
• malcolm_data_coverage

Tested with

Claude Desktop, Claude Code, Cursor

Notes

An MCP server that exposes Malcolm’s full read surface to AI tools and assistants. It includes opt-in write tools that are audited, meaning write operations are disabled unless explicitly enabled and logged.

3 stars on GitHub. Last updated 2026-09-01. Licensed MIT.

Use cases

• Connect an AI assistant to query Malcolm data through MCP
• Enable audited write operations for controlled automation
• Build custom tooling that reads Malcolm’s full data surface

Pros

• Full read coverage of Malcolm’s data
• Write tools are opt-in and audited for safer automation
• Simple Python implementation fits standard MCP workflows

Cons

• Very early stage with only 3 GitHub stars
• Writes require explicit opt-in configuration
• Limited community adoption and proven production use

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.