# Nagametw Server Malcolm MCP server

Source: https://glimind.com/server/mcp-registry%2Fio.github.nagametw%2Fmcp-server-malcolm
Registry id: `mcp-registry/io.github.nagametw/mcp-server-malcolm`
Status: unknown

## Install

```json
{
  "mcpServers": {
    "nagametw-server-malcolm-mcp-server": {
      "command": "uvx",
      "args": [
        "mcp-server-malcolm"
      ]
    }
  }
}
```

Claude Code:

```sh
claude mcp add nagametw-server-malcolm-mcp-server -- uvx mcp-server-malcolm
```

## Tools (58)

- `arkime_add_tags`: Add tags to sessions
- `arkime_build_query`: Compile Arkime expression into OpenSearch DSL
- `arkime_cancel_hunt`: Stop a queued or running hunt
- `arkime_connections`: Source/destination connection graph
- `arkime_create_hunt`: Launch a cross-PCAP packet search
- `arkime_create_shortcut`: Save a named value list
- `arkime_create_view`: Save a named search expression
- `arkime_crons`: List Arkime cron queries
- `arkime_field_search`: Search field names Arkime expressions accept
- `arkime_file_by_hash`: Extract transferred file by md5/sha256
- `arkime_hunt_status`: List Arkime hunt jobs and their progress
- `arkime_multiunique`: Unique value combinations across several fields
- `arkime_node_stats`: Capture-node health: dropped packets, disk, memory
- `arkime_pcap_files`: List PCAP files Arkime has indexed
- `arkime_reverse_dns`: Reverse-resolve one IP to its PTR hostname
- `arkime_session_detail`: Fetch all fields for one session
- `arkime_session_file_by_hash`: Fetch file one named session carried by hash
- `arkime_session_payload`: Read a session's decoded payload
- `arkime_session_pcap`: Fetch a session's PCAP and report its size
- `arkime_sessions`: Search Arkime sessions with Arkime expression syntax
- `arkime_sessions_csv`: Export sessions as a compact CSV table
- `arkime_sessions_summary`: Total sessions, bytes and packets for an expression
- `arkime_shortcuts`: List named value lists and $name tokens
- `arkime_spigraph`: Top values of one field with a time-series graph
- `arkime_spigraphhierarchy`: Hierarchical top-N breakdown across fields
- `arkime_spiview`: Value profile across several fields in one call
- `arkime_unique`: List distinct values of one field with optional counts
- `arkime_views`: List saved search views with each expression
- `cluster_health`: OpenSearch cluster health
- `count`: Count documents matching a DSL query clause
- `index_mapping`: Field mapping/schema for an index
- `list_indices`: List indices with name/health/status/doc count
- `malcolm_aggregate`: Aggregate traffic by one or more fields
- `malcolm_alerting_alerts`: List fired OpenSearch alerting alerts
- `malcolm_alerting_monitor_detail`: Read one alerting monitor's full query
- `malcolm_alerting_monitors`: List OpenSearch alerting monitors
- `malcolm_alerts`: Search Suricata alerts by signature, severity, IP
- `malcolm_anomaly_detectors`: List anomaly detectors and anomalies
- `malcolm_anomaly_results`: Read anomalous entities from an anomaly detector
- `malcolm_create_alert`: Index an analyst-generated finding as an alert
- `malcolm_dashboard_export`: Export an OpenSearch Dashboards saved object as JSON
- `malcolm_data_coverage`: Data freshness per sensor, doc counts per dataset
- `malcolm_extract_file`: Fetch one carved file from Malcolm
- `malcolm_field_profile`: Show which event.dataset types contain a field
- `malcolm_field_search`: Search available field names by keyword, prefix, or type
- `malcolm_field_values`: List distinct values for a field
- `malcolm_file_scans`: List files Zeek carved out of traffic
- `malcolm_netbox_lookup`: Look up an IP, device, or network prefix in NetBox
- `malcolm_netbox_query`: Read any other NetBox endpoint
- `malcolm_netbox_sites`: List the NetBox site directory
- `malcolm_ping`: Quick liveness check of the Malcolm API
- `malcolm_related_sessions`: Find all sessions related to a Zeek UID
- `malcolm_saved_object_detail`: Read one saved object's query and filters
- `malcolm_saved_objects`: Find dashboards, visualizations and saved searches
- `malcolm_search`: Search network traffic with Malcolm filter syntax
- `malcolm_service_status`: Readiness of all Malcolm services plus version info
- `malcolm_upload_pcap`: Send a local capture file to Malcolm for ingestion
- `search_dsl`: Run a raw OpenSearch DSL query

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.