example-mcp-app-security/manifest.json at main · elastic/example-mcp-app-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
{
  "manifest_version": "0.3",
  "name": "elastic-security-mcp-app",
  "display_name": "Elastic Security",
  "version": "1.0.8",
  "description": "Interactive blue-team security operations for Elastic Security — alert triage, attack discovery, case management, detection rules, threat hunting, and sample data generation.",
  "long_description": "An MCP App server that brings interactive blue-team security operations directly into Claude Desktop. Provides six rich React-based UIs that render inline in the conversation: alert triage with AI verdicts, AI-powered attack discovery with confidence scoring and MITRE mapping, case management with the Kibana Cases API, detection rule browsing and tuning, an ES|QL threat-hunting workbench with a D3 investigation graph, and an ECS sample-data generator for demos.",
  "author": {
    "name": "Elastic",
    "url": "https://www.elastic.co"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/elastic/example-mcp-app-security.git"
  },
  "homepage": "https://github.com/elastic/example-mcp-app-security",
  "support": "https://github.com/elastic/example-mcp-app-security/issues",
  "server": {
    "type": "node",
    "entry_point": "dist/main.bundle.mjs",
    "mcp_config": {
      "command": "node",
      "args": [
        "${__dirname}/dist/main.bundle.mjs",
        "--stdio"
      ],
      "env": {
        "CLUSTERS_JSON": "[{\"name\":\"primary\",\"elasticsearchUrl\":\"${user_config.elasticsearch_url}\",\"kibanaUrl\":\"${user_config.kibana_url}\",\"elasticsearchApiKey\":\"${user_config.elasticsearch_api_key}\",\"sslVerify\":${user_config.ssl_verification}}]"
      }
    }
  },
  "tools": [
    {
      "name": "triage-alerts",
      "description": "Fetch, filter, and triage security alerts with AI verdicts"
    },
    {
      "name": "triage-attack-discoveries",
      "description": "Review AI-correlated attack chain findings with confidence scoring"
    },
    {
      "name": "generate-attack-discovery",
      "description": "Trigger on-demand attack discovery analysis via any AI connector"
    },
    {
      "name": "manage-cases",
      "description": "Create, search, and manage SOC investigation cases"
    },
    {
      "name": "manage-rules",
      "description": "Browse, tune, and manage detection rules"
    },
    {
      "name": "threat-hunt",
      "description": "ES|QL query workbench with entity investigation graph"
    },
    {
      "name": "generate-sample-data",
      "description": "Generate ECS-compliant security events for demos"
    }
  ],
  "tools_generated": true,
  "user_config": {
    "elasticsearch_url": {
      "type": "string",
      "title": "Elasticsearch URL",
      "description": "Elasticsearch URL (e.g. https://your-cluster.es.cloud.example.com).",
      "required": true,
      "sensitive": false
    },
    "elasticsearch_api_key": {
      "type": "string",
      "title": "Elasticsearch API Key",
      "description": "API key for Elasticsearch authentication.",
      "required": true,
      "sensitive": true
    },
    "kibana_url": {
      "type": "string",
      "title": "Kibana URL",
      "description": "Kibana URL (e.g. https://your-cluster.kb.cloud.example.com).",
      "required": true,
      "sensitive": false
    },
    "ssl_verification": {
      "type": "boolean",
      "title": "Verify SSL/TLS Certificates",
      "description": "⚠ Uncheck ONLY for trusted self-signed dev clusters — disabling removes protection against man-in-the-middle attacks. When checked (default), the Elasticsearch / Kibana TLS certificate is verified against trusted CAs.",
      "default": true,
      "required": false,
      "sensitive": false
    }
  },
  "keywords": [
    "security",
    "elastic",
    "elasticsearch",
    "kibana",
    "siem",
    "soc",
    "alerts",
    "detection",
    "threat-hunting",
    "mcp-app"
  ],
  "license": "Elastic-2.0",
  "privacy_policies": [
    "https://www.elastic.co/legal/privacy-statement"
  ],
  "compatibility": {
    "platforms": [
      "darwin",
      "win32",
      "linux"
    ],
    "runtimes": {
      "node": ">=22.0.0"
    }
  }
}