Sigma MCP Server

An MCP server that exposes pySigma functionality to AI assistants and other MCP clients.

Features

| Capability | Details | |---|---| | Tool validate_rule | Validate a Sigma rule (YAML) against all configured validators | | Tool configure_validators | Persist a custom validator allow-list / exclusion-list for the current MCP session | | Resource sigma://validators | JSON dict of available validator identifiers → descriptions | | Resource sigma://modifiers | JSON list of available Sigma value modifier names |

Requirements

• Python ≥ 3.10
• Poetry (for development / installation)

Installation

git clone <repo-url>
cd sigma-mcp-server
poetry install

Usage

Running the server

poetry run sigma-mcp-server
# or, after installation:
sigma-mcp-server

The server listens on stdio by default (standard MCP transport).

Configuring in VS Code / Claude Desktop

Add the following entry to your MCP client configuration (e.g. ~/.config/claude/claude_desktop_config.json):

{
  "mcpServers": {
    "sigma": {
      "command": "sigma-mcp-server"
    }
  }
}

Adjust the command path to the installed binary if it is not on PATH.

Tool Reference

validate_rule

Validate a single Sigma rule.

Arguments

| Name | Type | Description | |---|---|---| | rule_yaml | string | Complete Sigma rule in YAML format |

Returns

A JSON array of validation issue objects. Each object contains:

| Key | Type | Description | |---|---|---| | validator | string | Validator identifier that produced the issue | | type | string | Issue class name (e.g. IdentifierExistenceIssue) | | severity | string | low, medium, or high | | description | string | Human-readable description of the issue class | | rules | array[string] | Rule IDs / titles affected by the issue |

Additional subclass-specific fields (e.g. identifier) may also be present.

An empty array means the rule passed all active validators.

configure_validators

Persist a custom validator configuration for the current MCP session. All subsequent validate_rule calls within the same session will use this configuration.

Arguments

| Name | Type | Default | Description | |---|---|---|---| | validator_names | array[string] \| null | null | Explicit allow-list of validator identifiers. null = use all. | | exclusions | array[string] \| null | null (= []) | Validator identifiers to exclude after the allow-list is applied. |

Returns

On success: {"validator_names": ..., "exclusions": [...]} confirming the stored config.
On error: {"error": "<description>"} when an unknown identifier is supplied.

Example – exclude a single validator:

{"exclusions": ["identifier_existence"]}

Example – use only two validators:

{"validator_names": ["identifier_existence", "identifier_uniqueness"]}

Resource Reference

sigma://validators

Returns a JSON object mapping validator identifier strings to their human-readable descriptions. Validator identifiers are used with configure_validators.

Example response (truncated):

{
  "identifier_existence": "Checks if rule has identifier.",
  "identifier_uniqueness": "Check rule UUID uniqueness.",
  ...
}

sigma://modifiers

Returns a sorted JSON array of Sigma value modifier names that can be used in detection conditions (e.g. contains, startswith, re, base64).

Development

# Install dev dependencies
poetry install

# Run tests
poetry run pytest

# Run tests with coverage report
poetry run pytest --cov=sigma/mcp --cov-report=term-missing

# Type checking
poetry run mypy sigma/mcp/ tests/

# Code formatting
poetry run black sigma/ tests/ conftest.py

Test coverage must remain ≥ 95 %. All code must pass mypy --strict and be formatted with black in its default configuration.

License

MIT