MCP在SecOps自动化中使用的场景，包括Splunk、CrowdStrike EDR、MISP
概览
一个全面的MCP（模型上下文协议）服务器实现合集，用于企业级安全强化的安全平台集成。 该项目已经过全面的安全强化，以解决关键漏洞并实施安全最佳实践： - - SPL注入预防，包括查询净化和危险的命令阻断 - 使用DefusedXML的安全解析以防止XXE攻击 - 完全移除所有配置文件中的硬编码凭证 - - 强制TLS 1.2+，强密码套件支持所有API通信 - 在所有服务器上进行全面的输入验证和净化 - 防止命令执行风险和注入攻击 - 错误消息净化以防止信息泄露 - - FQL/SPL注入攻击防范及模式匹配 - SSL证书验证强制执行 - API响应的数据净化 - 安全配置模板及安全占位符 - 全面。
概述（AI 翻译）
一个全面的安全MCP（模型上下文协议）服务器实现合集，用于与企业级安全强化的安全平台集成。
🛡️ 安全优先设计
该项目已经过全面的安全强化，以解决关键漏洞并实施安全最佳实践：
✅ 安全改进（最新更新）
- ** 🔴 高严重度修复：**
- 带有查询净化和危险命令阻断的SPL注入预防
- 利用 defusedXML 进行安全解析，以防止 XXE 攻击
- 从所有配置文件中完全移除硬编码凭据
- ** 🟡 中等严重度修正：**
- 强制TLS 1.2+，支持所有API通信的强密码套件
- 在所有服务器上进行全面的输入验证和净化
- 防止命令执行风险和注入攻击
- 错误消息清理以防止信息泄露
- ** 🔵 额外安全功能：
- FQL/SPL注入攻击防范，支持模式匹配
- SSL证书验证强制执行
- API 响应的数据净化
- 带有安全占位符的安全配置模板
- 综合性。
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
Security Infrastructure MCP Servers
A comprehensive collection of secure MCP (Model Context Protocol) server implementations for security platform integrations with enterprise-grade security hardening.
🛡️ Security-First Design
This project has undergone comprehensive security hardening to address critical vulnerabilities and implement security best practices:
✅ Security Improvements (Latest Update)
- 🔴 HIGH Severity Fixes:
- SPL injection prevention with query sanitization and dangerous command blocking
- Secure XML parsing using defusedxml to prevent XXE attacks
- Complete removal of hardcoded credentials from all configuration files
- 🟡 MEDIUM Severity Fixes:
- Enforced TLS 1.2+ with strong cipher suites for all API communications
- Comprehensive input validation and sanitization across all servers
- Prevention of command execution risks and injection attacks
- Error message sanitization to prevent information disclosure
- 🔵 Additional Security Features:
- FQL/SPL injection attack prevention with pattern matching
- SSL certificate validation enforcement
- Data sanitization for API responses
- Secure configuration templates with safe placeholders
- Comprehensive .gitignore to prevent credential exposure
🔒 Security Documentation
See SECURITY.md for comprehensive security guidelines, configuration best practices, and vulnerability reporting procedures.
🔐 Supported Platforms
Splunk SIEM
- Secure SPL Query Execution: Execute Search Processing Language queries with injection prevention
- Event Search: Search security events across all indexes with sanitized filtering
- Time-based Analysis: Validated time ranges and custom time windows
- Asynchronous Job Management: Create and monitor search jobs with secure result retrieval
- JSON Result Format: Structured output with sensitive data filtering
CrowdStrike EDR
- Secure Detection Search: Query detections using validated FQL (Falcon Query Language)
- Detection Details: Retrieve sanitized detection summaries and metadata
- OAuth 2.0 Authentication: Secure API access with proper token management
- Input Validation: Comprehensive parameter validation and whitelisting
- Real-time Threat Data: Access to latest endpoint detection data with security filtering
Microsoft MISP
- Event Search: Query MISP events with input sanitization and validation
- IOC Attribute Search: Search indicators with XSS and injection prevention
- Multi-format Support: Handle various IOC types with content validation
- SSL Security: Enforced certificate verification with security warnings
- RESTful API Integration: Secure MISP REST API support with error sanitization
🚀 Quick Start
Installation
# 1. Clone the repository
git clone https://github.com/jmstar85/SecurityInfrastructure.git
cd SecurityInfrastructure
# 2. Install secure dependencies安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"security-infrastructure-splunk": {
"command": "python",
"args": ["/FULL/PATH/TO/SecurityInfrastructure/src/splunk_server.py"],
"env": {
"SPLUNK_HOST": "REPLACE_WITH_YOUR_SPLUNK_HOST",
"SPLUNK_TOKEN": "REPLACE_WITH_YOUR_API_TOKEN",
"SPLUNK_VERIFY_SSL": "true"
}
}
}
}