LocalFree

Malcolm MCP server

nagameTW/mcp-server-malcolm

Malcolm threat hunting: search and aggregate network traffic, query Suricata alerts, browse Arkime sessions and resolve NetBox assets. Read-only by default.

2 GitHub stars
Source code

Install Malcolm in Claude Code

Claude Code
claude mcp add malcolm -- uvx mcp-server-malcolm
mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)
{
  "mcpServers": {
    "malcolm": {
      "command": "uvx",
      "args": [
        "mcp-server-malcolm"
      ]
    }
  }
}

Frequently asked questions

What does the Malcolm MCP server do?

Malcolm threat hunting: search and aggregate network traffic, query Suricata alerts, browse Arkime sessions and resolve NetBox assets. Read-only by default.

Is the Malcolm MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does Malcolm run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Malcolm to Claude Code?

Run: claude mcp add malcolm -- uvx mcp-server-malcolm

More security & identity MCP servers

View all

PrivacyFence

2

privacyfence/privacyfence

Privacy and approval gateway between AI assistants and Gmail, Drive, Slack, Salesforce, Jira and more: human approval for sensitive reads and writes, local PII detection and an audit log.

LocalFreePython

M2M Sentinel

2

M2M-Sentinel/m2m-sentinel-sdk

EVM bytecode capability analysis, EIP-1967 proxy resolution, gas recommendations and preflight safety checks for agents on Base.

Local + RemoteAccount neededTypeScript

SpendShield

2

felixpg13-glitch/spendshield

Payment guardrails for AI agents: spend caps, budget and approval gates, prompt-injection defense, an encrypted secret vault and an audit trail.

LocalFreePython

Lucairn Sdks

2

Declade/lucairn-sdks

Privacy gateway that sanitizes German and English PII before prompts reach an LLM and issues a signed, timestamped certificate for each call.

LocalAccount neededTypeScript

Taskbounty Check

2161

eliottreich/taskbounty-check

Local, read-only scanner for GitHub Actions and CI maintenance issues in AI-built apps, with finding explanations and fix plans.

LocalFreeTypeScript

gatehouse

2

nickgeorgeseo/mcp-gatehouse

Permission tiers, approval gates and secret-redacting audit logging enforced inside MCP servers at the tool boundary, with a demo order-desk server.

LocalFreePython