Zeek
Zeek-MCP provides a bridge between AI assistants and the Zeek network security monitor through the Model Context Protocol. It offers tools for executing Zeek analysis on PCAP files and parsing the resulting log files into structured data formats. The implementation handles the complete workflow from running Zeek commands to cleaning up previous log files and converting the tabular output into pandas DataFrames for easier analysis. Built with Python and FastMCP, it supports both stdio and Server-Sent Events (SSE) transport methods, making it particularly valuable for network security analysis, traffic monitoring, and intrusion detection tasks without requiring users to interact directly with Zeek's command-line interface.
Composite of vulnerability cleanliness, spec conformance, provenance, stability, and usage signals — scanned and weighted by Cognium. Human and agent signals are tracked separately. Last scanned 2026-09-28.
Scan details: Circle-IR · 2026-09-28 · Appeal
View full trust & usage report →Metadata
- Version
- 1.0.0
- Skill type
- atomic
- Execution layer
- mcp-remote
- Category
- monitoring
- Source
- PulseMCP
- Repository
- github.com/gabbo01/zeek-mcp
- Author type
- human
- Last scanned
- 2026-09-28
- Updated
- 2026-09-28
Use via MCP
Resolve Zeek from your agent
Streamable HTTP transport at https://api.skillsregistry.net/mcp. No auth for read tools. Discovery: .well-known/mcp.json.
One command in your shell — Claude Code wires it up and verifies the connection. Run /mcp in any session to confirm.
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp--scope user for --scope project to commit it to .mcp.json.