Listen to this Post
Introduction:
Detection engineering is undergoing a paradigm shift as the Security Detections MCP (Model Context Protocol) project evolves from a local server into a hosted detection intelligence platform. Version 3.2.2 now enables security teams to query over 8,200 detections across six platforms, assess coverage against 172 MITRE ATT&CK threat actors, and integrate AI directly—without complex local setup.
Learning Objectives:
- Understand the dual-mode architecture (local full power vs. hosted zero-setup) of Security Detections MCP.
- Query real-time detection coverage for ransomware and other threats using AI or a web interface.
- Deploy both local and hosted MCP instances to streamline detection engineering workflows.
You Should Know
- What Is Security Detections MCP and Why It Matters
MCP (Model Context Protocol) provides a standardized way for AI assistants and security tools to retrieve and analyze detection logic. Previously, running an MCP server required cloning repos, managing dependencies, and maintaining local detection pipelines. With v3.2.2, the project introduces a hosted tier: a website, token-based API, and an always‑up‑to‑date backend. This shift means you can now ask natural language questions like “What’s our ransomware coverage?” and receive a data‑driven answer across your entire detection ecosystem.
Step‑by‑step to access hosted detections:
- Open the website → `https://lnkd.in/gn-6iyrr` (resolve to actual endpoint; project name: Pulse MCP).
- Sign up for a token (free for FOSS users).
- Use the search bar to query by ATT&CK technique (e.g., `T1486` for ransomware) or threat actor (e.g.,
Lazarus). - Review the returned coverage matrix: which platforms (Windows, Linux, macOS, cloud) have detections, and which are missing.
2. Local vs. Hosted Modes: A Technical Comparison
The project remains fully open source. Local mode gives you 81 tools and the full detection pipeline, allowing you to ingest your own detection repos. Hosted mode requires no installation and is ideal for rapid assessments or integration with AI assistants.
| Feature | Local Mode | Hosted Mode |
|||–|
| Setup | `npm install` + config | Token‑based, zero install |
| Tools included | 81 (e.g., Atomic Red Team, Sigma, LOLDrivers) | Pre‑computed analytics |
| Detection repos | Your own or community | Pre‑ingested (8,200+ detections) |
| Update frequency | Manual `git pull` | Continuous |
Install local mode on Linux/macOS:
git clone https://github.com/mcp-project/security-detections-mcp.git cd security-detections-mcp npm install npm run build Configure your detection paths in config/local.yaml npm start
Windows (PowerShell as Admin):
git clone https://github.com/mcp-project/security-detections-mcp.git cd security-detections-mcp npm install --global windows-build-tools npm install npm run build $env:MCP_MODE="local" npm start
3. Querying Detections with AI Integration (Hosted MCP)
The hosted MCP exposes a REST API that any AI tool (LangChain, AutoGPT, custom scripts) can call. You get real‑time answers without hosting a server.
Example: Ask “What detections cover T1566 (Phishing)?” using `curl` (Linux/macOS or WSL):
curl -X POST "https://api.pulsemcp.com/v1/query" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"query": "T1566", "platforms": ["windows","linux"]}'
Expected response snippet:
{
"technique": "T1566 - Phishing",
"total_detections": 142,
"coverage_by_platform": {"windows": 98, "linux": 32, "macos": 12},
"threat_actors": ["APT28", "FIN7", "TA505"]
}
To integrate with a local AI (e.g., Ollama + Continue), set the MCP endpoint in your AI client’s configuration as `https://api.pulsemcp.com/v1/mcp` and provide the token.
4. Leveraging MITRE ATT&CK for Threat Actor Coverage
The platform indexes detection coverage against 172 ATT&CK threat actors. You can answer questions like “Which techniques used by APT29 are we missing detections for?”
Step‑by‑step using the web interface:
1. Navigate to “Coverage” → “Threat Actors”.
2. Select an actor (e.g., “APT29”).
- View a heatmap of techniques: green = detection exists, red = no coverage.
- Export the missing techniques as a CSV to build a detection backlog.
Programmatic query with Python:
import requests
token = "YOUR_TOKEN"
actor = "APT29"
resp = requests.get(f"https://api.pulsemcp.com/v1/coverage/actor/{actor}",
headers={"Authorization": f"Bearer {token}"})
data = resp.json()
missing = [t for t in data["techniques"] if t["coverage"] == 0]
print(f"Missing {len(missing)} techniques for {actor}")
- Hands‑On: Using Atomic Red Team and LOLDrivers with MCP
Atomic Red Team (ART) and LOLDrivers are core components of the local mode. You can test your detection pipeline by invoking atomic tests and then querying the MCP to see if those tests were logged.
On Windows (PowerShell as Admin):
Install Atomic Red Team Install-Module -Name AtomicRedTeam -Force Import-Module AtomicRedTeam Run a test for T1059 (Command and Scripting Interpreter) Invoke-AtomicTest T1059 -TestNumbers 1
On Linux (using ART):
git clone https://github.com/redcanaryco/atomic-red-team.git cd atomic-red-team/atomics/T1059 bash T1059.yaml execute test (requires atomic CLI)
After running tests, query the local MCP:
curl http://localhost:8080/detections?technique=T1059
If detections are missing, use the MCP’s “suggest_sigma” tool to generate Sigma rules based on the atomic test’s commands.
- Building a Full Detection Engineering Workflow (Local Mode)
The local pipeline includes 81 tools such as Sigma CLI, Elk stack, and custom parsers. Follow this workflow to ingest your own detection repos (e.g., Sigma rules, Splunk ES savedsearches).
Step‑by‑step:
1. Clone your detection repos into `./custom_detections/`.
- Run the ingestion script: `npm run ingest — –source custom_detections/`
3. Validate syntax: `npm run validate — –format sigma`
4. Start the MCP server with your repos: `npm run serve — –mode local –repos custom_detections/`
5. Query coverage for a specific technique: `npm run query — –technique T1047`Automate with a cron job (Linux) or Task Scheduler (Windows):
Linux crontab - every 6 hours 0 /6 cd /opt/mcp && git pull && npm run ingest
Windows scheduled task (XML example) schtasks /create /tn "MCP_Ingest" /tr "powershell -File C:\mcp\ingest.ps1" /sc hourly
-
Cloud Hardening and API Security for MCP Deployments
If you expose the hosted MCP internally or via a gateway, secure it properly. The default token authentication is a good start, but add rate limiting and IP whitelisting for production.
NGINX configuration snippet (rate limiting):
limit_req_zone $binary_remote_addr zone=mcp:10m rate=10r/m;
server {
location /api/ {
limit_req zone=mcp burst=5;
proxy_pass http://localhost:8080;
proxy_set_header Authorization $http_authorization;
}
}
Azure WAF or AWS WAF rule – block requests without a valid token prefix. For self‑hosted local mode, always run the MCP server behind a reverse proxy with TLS (Let’s Encrypt) and disable directory listing.
What Undercode Say
- Key Takeaway 1: Security Detections MCP v3.2.2 democratizes detection intelligence by offering a hosted, AI‑ready platform while keeping the full power local mode open source.
- Key Takeaway 2: The ability to query coverage against 172 ATT&CK threat actors transforms reactive detection into proactive gap analysis, enabling teams to prioritize based on real adversaries.
Analysis: This release signals a maturation of detection engineering tooling. For years, teams struggled to aggregate detections from disparate sources (Sigma, YARA, custom rules) and map them to ATT&CK. The MCP project solves that by providing a unified query layer. The hosted option lowers the barrier for small teams and AI integrations, but local mode remains critical for air‑gapped environments or when using proprietary detection logic. Expect competitors to follow with similar MCP‑based platforms. The biggest risk is over‑reliance on a single hosted API – always keep a local backup of your detection repos.
Prediction
Within 18 months, AI‑powered SOC assistants will routinely use MCP‑like protocols to autonomously query detection coverage, suggest rule improvements, and even generate new Sigma rules from threat intelligence feeds. Detection engineering will shift from manual rule writing to “coverage as code,” where the primary skill is interpreting MCP query results and tuning false positives. However, the hosted model may create vendor lock‑in unless the open source community maintains a fully self‑hostable alternative. The end of traditional detections? Not quite – but the role of the detection engineer will become more analytical and less about hunting through SIEM dashboards.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Michaelahaag Is – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
