hackerdogs/suricata-mcp repository overview

⁠

⁠Suricata MCP Server

MCP server wrapper for Suricata⁠ — network intrusion detection and prevention system (IDS/IPS).

⁠What is Suricata?

Suricata (suricata) is a security tool that provides: high-performance network intrusion detection (IDS), intrusion prevention (IPS), and network security monitoring. It inspects network traffic using rules and signatures to detect threats, malware, and policy violations.

See suricata.io⁠ and the OISF/suricata⁠ repository for full documentation.

No API keys required — Suricata runs locally inside the Docker container with default rules from Emerging Threats.

Summary. MCP server wrapper for Suricata⁠ — network intrusion detection and prevention system.

Tools:

• run_suricata — Run suricata with the given arguments. Returns command output.
• analyze_pcap — Analyze a PCAP file and return alerts and EVE JSON events.
• download_file — Download files/repos from URLs into the container for analysis.
• cleanup_downloads — Clean up downloaded files from the container workspace.

⁠Tools Reference

⁠run_suricata

Run suricata with the given arguments. Returns command output.

This is Suricata version 6.0.10 RELEASE

⁠analyze_pcap

Analyze a PCAP file with Suricata and return alerts from fast.log and EVE JSON events.

{
  "return_code": 0,
  "alerts": "03/15/2026-12:00:00.000000  [**] [1:2001219:20] ET SCAN ...",
  "eve_events_count": 42,
  "alert_events": [...]
}

⁠download_file

Download a file or repository from a URL into the container workspace.

⁠cleanup_downloads

Clean up downloaded files from the container workspace.

⁠Example Prompts

Here are example prompts you can use with Claude (or any MCP client) when this tool is connected:

• "Use Suricata to analyze this PCAP file and show me any detected threats."
• "Download this PCAP from the URL and run Suricata IDS analysis on it."
• "Show me the Suricata version and build info with -V and --build-info."
• "Run Suricata against the network capture and summarize the alerts."
• "List all Suricata rule categories currently loaded."
• "Analyze the traffic capture at this URL for any malware signatures."

⁠Deploy

⁠Docker Compose (recommended)

docker-compose up -d

⁠Docker Run (stdio mode)

docker run -i --rm hackerdogs/suricata-mcp:latest

⁠Docker Run (HTTP streamable mode)

docker run -d -p 8365:8365 \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_PORT=8365 \
  hackerdogs/suricata-mcp:latest

⁠MCP Client Configuration

⁠Stdio mode (default)

Add to your Claude Desktop or Cursor MCP config:

{
  "mcpServers": {
    "suricata-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT", "hackerdogs/suricata-mcp:latest"],
      "env": {
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

⁠HTTP mode (streamable-http)

First, start the server using Docker Compose or docker run with HTTP mode (see Deploy⁠ above), then point your MCP client at the running server:

{
  "mcpServers": {
    "suricata-mcp": {
      "url": "http://localhost:8365/mcp"
    }
  }
}

⁠Environment Variables

⁠Installing in Hackerdogs

The fastest way to get started is through Hackerdogs⁠:

1. Log in to your Hackerdogs account.
2. Go to the Tools Catalog.
3. Search for the tool by name (e.g. "nuclei", "naabu", "julius").
4. Expand the tool card and click Install — you're ready to go.

1. Vendor API key required? Add your key in the config environment variable field before clicking Install. Your key will be encrypted at rest.
2. Enable / Disable the tool anytime from the Enabled Tools page.
3. Need to update a key or parameter? Go to My Tools → toggle Show Decrypted Values → edit → Save.

⁠Build

docker build -t hackerdogs/suricata-mcp:latest .

⁠Testing

⁠Automated tests

./test.sh

⁠Test directly with Docker

1. Start the server in HTTP mode:

docker run -d --rm --name suricata-mcp-test -p 8365:8365 \
  -e MCP_TRANSPORT=streamable-http \
  hackerdogs/suricata-mcp:latest

2. Initialize the MCP session:

SESSION_ID=$(curl -s -D - -X POST http://localhost:8365/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"0.1"}}}' \
  2>&1 | grep -i mcp-session-id | awk '{print $2}' | tr -d '\r\n')

curl -s -X POST http://localhost:8365/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

3. Call a tool:

curl -s -X POST http://localhost:8365/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"run_suricata","arguments":{"arguments":"-V"}}}'

4. Clean up:

docker stop suricata-mcp-test

⁠Running the tool directly (bypassing MCP)

You can run Suricata directly in the same container by overriding the entrypoint to analyze traffic without starting the MCP server.

Show version:

docker run --rm --entrypoint suricata hackerdogs/suricata-mcp:latest -V

Show build info:

docker run --rm --entrypoint suricata hackerdogs/suricata-mcp:latest --build-info

Analyze a PCAP file:

docker run --rm -v /path/to/captures:/data --entrypoint suricata hackerdogs/suricata-mcp:latest -r /data/capture.pcap -l /data/output