Why this fit
Teams evaluating AI models, assistants and generative workflows, particularly search and retrieval, teams avoiding vendor lock-in β free to start, source available on GitHub.
AI / Catalogue record
Free
Catalogue record
github.com
mcp-server-malcolm
π π π πͺ π§ - The first MCP server for Malcolm, the open-source network traffic analysis suite (Zeek + Suricata + Arkime + OpenSearch + NetBox...
Checked Oct 27, 2026Evidence completeness: evidenceREADME refreshed Oct 16, 2026
Field notes
Useful context before you commit.
π π π πͺ π§ - The first MCP server for Malcolm, the open-source network traffic analysis suite (Zeek + Suricata + Arkime + OpenSearch + NetBox). Gives AI agents structured, threat-hunting access: search and aggregate traffic, discover fields, query Suricata alerts, browse Arkime sessions, and resolve NetBox assets. Read-only by default; opt-in, audited write classes for alerts, tagging, hunts, and PCAP upload. pip install mcp-server-malcolm
Best for
Teams evaluating AI models, assistants and generative workflows, particularly search and retrieval, teams avoiding vendor lock-in β free to start, source available on GitHub.
Known limitations
Teams that need a vendor SLA before adopting a free tool β check the project's support terms first.
Verify current plan terms with the provider.
Evidence summary
Known limitations
Teams that need a vendor SLA before adopting a free tool β check the project's support terms first.
Catalogue confidence
Catalogue data checked Oct 27, 2026.
GitHub-backed record with source-attributed context.
Repository context
mcp-server-malcolm
GitHub / nagameTW/mcp-server-malcolm
Learn how it works
A guided tour of this tool
A short, animated walkthrough of the architecture, features and full README.
Public record assistant
Ask about mcp-server-malcolm
Evidence-bound answers from this catalogue record. No workspace data is used.
Sign in to ask Oryxen AI about this record
The database-first brief above stays free for everyone.
Record provenance
What this record is based on.
Oryxen distinguishes catalogue metadata from repository context. These signals describe the directory record and its sources; they do not guarantee the current availability, security, or suitability of an external product.
- Listing status
- Listed in active catalogue
- Freshness
- Catalogue updated Oct 27, 2026
- Source
- GitHub-backed record
- Repository context
- Repository activity not yet retrieved
Key links
Keep researching this tool
Community signal
Practical notes from users.
Feedback is public only after moderation. It is distinct from README-derived project context.
Add your signal
Used this tool?
Sign in to submit feedback for moderation.
Don't miss β compare before you commit
Top 4 alternatives to mcp-server-malcolm you should see.
Same category Β· honest pricing & fit β click any card to compare.