nagameTW

MCP Server Malcolm — Data skill for Claude Code

Data community

Ask an AI agent about your Malcolm network traffic.

How to install MCP Server Malcolm

This entry records only its repository, not the path inside it, so there is no exact command to give. Open nagameTW/mcp-server-malcolm and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Server Malcolm does

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

Alternatives in Data

Private GPT — Complete API layer for private AI applications on local models: RAG, skills, tools, MCP, text-to-sql, and more 57.5k ★
MCP Server Chart — 🤖 A visualization mcp & skills contains 25+ visual charts using @antvis 4k ★
MCP Server Supabase — Supabase database and auth integration 2.6k ★

README

mcp-server-malcolm

[![CI](https://github.com/nagameTW/mcp-server-malcolm/actions/workflows/ci.yml/badge.svg)](https://github.com/nagameTW/mcp-server-malcolm/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/mcp-server-malcolm)](https://pypi.org/project/mcp-server-malcolm/) [![Python](https://img.shields.io/badge/python-3.11%2B-blue)](https://pypi.org/project/mcp-server-malcolm/) [![License](https://img.shields.io/github/license/nagameTW/mcp-server-malcolm?style=flat-square&logo=opensourceinitiative&logoColor=white&color=3DA639)](./LICENSE) [![Glama score](https://glama.ai/mcp/servers/nagameTW/mcp-server-malcolm/badges/score.svg)](https://glama.ai/mcp/servers/nagameTW/mcp-server-malcolm)

**English** | [繁體中文](README.zh-TW.md)

[![mcp-server-malcolm MCP server](https://glama.ai/mcp/servers/nagameTW/mcp-server-malcolm/badges/card.svg)](https://glama.ai/mcp/servers/nagameTW/mcp-server-malcolm)

Ask an AI agent about the traffic in your [Malcolm](https://malcolm.fyi) instance, and it queries Malcolm with the field names and filter syntax Malcolm actually uses instead of guessing them. For example:

"Show every Suricata alert involving 192.0.2.15 in the last 24 hours, and which NetBox device owns that IP." → malcolm_alerts, malcolm_netbox_lookup
"Who were the top talkers by protocol over the last hour?" → malcolm_aggregate
"List the executables Zeek carved out of yesterday's traffic, with their hashes." → malcolm_file_scans
"Upload this PCAP, then hunt the stored packets for this string." → malcolm_upload_pcap, arkime_create_hunt (write tools, off by default)

**Read-only by default.** The write tools that create alerts, tag sessions, launch hunts or upload PCAP are not registered until you turn on their write class. See [Read-only until you opt in](#read-only-until-you-opt-in).

![Claude Code answering a question about Modbus alerts through mcp-server-malcolm](https://raw.gith