Crowdsentinel MCP Server
crowdsentinel-mcp-server
PyPI
v0.6.0
Published by thomasxm — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
AI-powered threat hunting and incident response MCP server for Elasticsearch/OpenSearch with 139 tools, 6,060 detection rules, and baseline behaviour analysis
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 9
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: velociraptor_evidence_of_download → esql_query → export_to_misp. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow velociraptor_evidence_of_download → esql_query → export_to_misp
high Reads a sensitive credential path or dumps the environment (src/clients/common/cyber_kill_chain.py)MTC-SRC-006
In the server's implementation (`src/clients/common/cyber_kill_chain.py:633`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: " OR "/etc/sudoers" OR "id_rsa")', "archive_staging": "event.module:auditd AND process.name:(tar OR zip OR g
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/clients/common/cyber_kill_chain.py
high Shell/command execution in server code (src/agent/mcp_bridge.py)MTC-SRC-002
In the server's implementation (`src/agent/mcp_bridge.py:256`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.Popen( cmd, stdin=subprocess.PIPE, st
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agent/mcp_bridge.py
high Shell/command execution in server code (src/clients/common/chainsaw_client.py)MTC-SRC-002
In the server's implementation (`src/clients/common/chainsaw_client.py:289`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: y: result = subprocess.run( cmd, capture_output=True, text=T
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/clients/common/chainsaw_client.py
high Shell/command execution in server code (src/clients/common/osquery_client.py)MTC-SRC-002
In the server's implementation (`src/clients/common/osquery_client.py:162`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30, check=False) except (sub
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/clients/common/osquery_client.py
high Shell/command execution in server code (src/clients/common/schemas/query_builder.py)MTC-SRC-002
In the server's implementation (`src/clients/common/schemas/query_builder.py:131`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ) def build_child_processes_query( self, parent_process_name: str, host: str, start_time: str, end_t
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/clients/common/schemas/query_builder.py
high Shell/command execution in server code (src/tools/esql_hunting.py)MTC-SRC-002
In the server's implementation (`src/tools/esql_hunting.py:516`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ue, include_child_processes: bool = True, include_registry: bool = True, include_pro
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/tools/esql_hunting.py
high Shell/command execution in server code (src/wireshark/core/tshark_executor.py)MTC-SRC-002
In the server's implementation (`src/wireshark/core/tshark_executor.py:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: y: result = subprocess.run([self.tshark_path, "--version"], capture_output=True, text=True, timeout=10)
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/wireshark/core/tshark_executor.py
high Shell/command execution in server code (src/wireshark/extraction/object_extractor.py)MTC-SRC-002
In the server's implementation (`src/wireshark/extraction/object_extractor.py:72`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) # List extract
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/wireshark/extraction/object_extractor.py
Tools 139
Each tool and what it can reach — statically extracted from the published source.
esql_queryreads sensitive dataexport_to_mispnetwork egressosquery_queryreads sensitive datavelociraptor_evidence_of_downloadingests untrusted inputadd_iocs_to_investigationno sensitive capabilityanalyze_failed_loginsno sensitive capabilityanalyze_kill_chain_stageno sensitive capabilityanalyze_process_creationno sensitive capabilityanalyze_search_resultsno sensitive capabilitybuild_baselineno sensitive capability
Show 129 more tools ↓
build_unified_timelineno sensitive capabilitycheck_esql_supportno sensitive capabilitycleanup_storageno sensitive capabilityclose_investigationno sensitive capabilitycorrelate_by_timeno sensitive capabilitycorrelate_siem_with_endpointno sensitive capabilitycreate_data_streamno sensitive capabilitycreate_indexno sensitive capabilitycreate_investigationno sensitive capabilitydecode_commandno sensitive capabilitydecode_trafficno sensitive capabilitydelete_aliasno sensitive capabilitydelete_by_queryno sensitive capabilitydelete_data_streamno sensitive capabilitydelete_documentno sensitive capabilitydelete_indexno sensitive capabilitydetect_beaconingno sensitive capabilitydetect_lateral_movementno sensitive capabilitydetect_schema_for_indexno sensitive capabilitydiscover_all_assetsno sensitive capabilitydiscover_esql_indicesno sensitive capabilityendpoint_hunt_from_iocno sensitive capabilityendpoint_to_siem_pivotno sensitive capabilityenrich_iocsno sensitive capabilityeql_deleteno sensitive capabilityeql_get_statusno sensitive capabilityeql_searchno sensitive capabilityexecute_detection_ruleno sensitive capabilityexecute_esql_huntno sensitive capabilityexecute_multiple_rulesno sensitive capabilityexport_iocsno sensitive capabilityextract_objectsno sensitive capabilitygeneral_api_requestno sensitive capabilitygenerate_investigation_reportno sensitive capabilitygenerate_iocsno sensitive capabilitygenerate_reportno sensitive capabilityget_aliasno sensitive capabilityget_cluster_healthno sensitive capabilityget_cluster_statsno sensitive capabilityget_data_streamno sensitive capabilityget_diamond_model_guideno sensitive capabilityget_documentno sensitive capabilityget_enrichment_statusno sensitive capabilityget_esql_execution_historyno sensitive capabilityget_esql_hunt_detailsno sensitive capabilityget_event_type_fieldsno sensitive capabilityget_field_mappingno sensitive capabilityget_host_activity_timelineno sensitive capabilityget_indexno sensitive capabilityget_index_metadatano sensitive capabilityget_indices_by_typeno sensitive capabilityget_investigation_queryno sensitive capabilityget_investigation_summaryno sensitive capabilityget_investigation_workflowno sensitive capabilityget_kill_chain_overviewno sensitive capabilityget_next_stepno sensitive capabilityget_progressive_disclosureno sensitive capabilityget_pyramid_of_pain_guideno sensitive capabilityget_rule_detailsno sensitive capabilityget_rule_statisticsno sensitive capabilityget_saved_assetsno sensitive capabilityget_schema_detailsno sensitive capabilityget_shared_iocsno sensitive capabilityget_system_statusno sensitive capabilityhunt_adjacent_stagesno sensitive capabilityhunt_anomaliesno sensitive capabilityhunt_by_kill_chain_stageno sensitive capabilityhunt_by_timeframeno sensitive capabilityhunt_for_iocno sensitive capabilityhunt_iocsno sensitive capabilityhunt_suspicious_process_activityno sensitive capabilityhunt_with_rule_categoryno sensitive capabilityhunt_with_sigma_rulesno sensitive capabilityindex_documentno sensitive capabilityinvestigate_with_promptno sensitive capabilityiterative_huntno sensitive capabilitylist_aliasesno sensitive capabilitylist_available_capabilitiesno sensitive capabilitylist_available_schemasno sensitive capabilitylist_detection_rulesno sensitive capabilitylist_esql_huntsno sensitive capabilitylist_indicesno sensitive capabilitylist_investigationsno sensitive capabilitylookup_iocno sensitive capabilitymap_events_to_kill_chainno sensitive capabilityosquery_processesno sensitive capabilityosquery_socketsno sensitive capabilityosquery_usersno sensitive capabilitypcap_overviewno sensitive capabilityput_aliasno sensitive capabilityquick_countno sensitive capabilityquick_triageno sensitive capabilityresume_investigationno sensitive capabilitysearch_documentsno sensitive capabilitysearch_ioc_in_evtxno sensitive capabilitysearch_mispno sensitive capabilitysearch_rules_by_mitre_attackno sensitive capabilitysearch_with_luceneno sensitive capabilityshow_investigation_promptsno sensitive capabilitysmart_searchno sensitive capabilitystart_guided_investigationno sensitive capabilitysuggest_rules_for_datano sensitive capabilitythreat_hunt_searchno sensitive capabilitytrack_sessionsno sensitive capabilityvalidate_rule_for_datano sensitive capabilityvelociraptor_amcacheno sensitive capabilityvelociraptor_autorunsno sensitive capabilityvelociraptor_bamno sensitive capabilityvelociraptor_client_infono sensitive capabilityvelociraptor_collect_artifactno sensitive capabilityvelociraptor_evtxno sensitive capabilityvelociraptor_get_collection_resultsno sensitive capabilityvelociraptor_groupsno sensitive capabilityvelociraptor_list_artifactsno sensitive capabilityvelociraptor_list_clientsno sensitive capabilityvelociraptor_lnkno sensitive capabilityvelociraptor_mountsno sensitive capabilityvelociraptor_netstatno sensitive capabilityvelociraptor_ntfs_mftno sensitive capabilityvelociraptor_prefetchno sensitive capabilityvelociraptor_pslistno sensitive capabilityvelociraptor_recentdocsno sensitive capabilityvelociraptor_scheduled_tasksno sensitive capabilityvelociraptor_servicesno sensitive capabilityvelociraptor_shellbagsno sensitive capabilityvelociraptor_shimcacheno sensitive capabilityvelociraptor_srumno sensitive capabilityvelociraptor_userassistno sensitive capabilityvelociraptor_usersno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (139 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.6.0 latest |
B 89/100 | 9 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan crowdsentinel-mcp-server --online --registry pypiMore in Security & Testing
The Stripe Agent Toolkit enables popular agent frameworks including LangChain and Vercel's AI SDK to integrate with Stripe APIs through function calling.
MCP (Model Context Protocol) server for AgentGate. Enables Claude and other MCP-compatible AI assistants to request approvals.
Scan any website for AI agent readiness, payment protocols, and discovery endpoints
MCP server for aigently security guardrails — reads static catalog-data JSON, zero API dependency
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.