Security Detections MCP is a server based on the Model Context Protocol that allows LLMs to query a unified security detection rule database covering Sigma, Splunk ESCU, Elastic, and KQL formats. The latest version 3.0 is upgraded to an autonomous detection engineering platform that can automatically extract TTPs from threat intelligence, analyze coverage gaps, generate SIEM-native format detection rules, run tests, and verify. The project includes over 71 tools, 11 pre-built workflow prompts, and a knowledge graph system, supporting multiple SIEM platforms.

This project designs and implements an architecture that connects the data space with generative AI. Through the Model Context Protocol (MCP) server as a secure middle layer, the language model can indirectly access the DuckDB database. It has the characteristics of modularity, extensibility, and log tracking, laying the foundation for future upgrades to the RAG architecture.