io.github.nagameTW/mcp-server-malcolm
mcp-server-malcolm
Is the io.github.nagameTW/mcp-server-malcolm MCP server down? No. It answered initialize and tools/list in the probe of 2026-10-30.
MCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch): threat-hunting access for AI agents
alive probed 2026-11-14 · unchanged since 2026-10-30
- Run it
- uvx mcp-server-malcolm@1.2.1 (stdio, probed in a container with the network off)
- Host
- pypi.org
- Reports itself as
- mcp-server-malcolm 1.2.1
- Capabilities
- prompts, resources, tools
- Instructions
- 3 753 characters
- Of a 1M window
- 3.7 % of a 1M context window
- Count
- 37k tokens in Claude Opus 5.5, exact, measured 2026-10-16. With the Claude Code prefix mcp__…__ on each tool name: 38k. The o200k_base estimate is 23k. Counted again when the tool definitions change. Method.
- Repository
- https://github.com/nagameTW/mcp-server-malcolm
- Registry
- active, updated 2026-10-13 · registry entry
Most expensive tools
The Claude column scales the o200k estimate of each tool by this server's ratio of exact to estimate, 1.64×.
| Tool | ≈ Claude tokens | o200k estimate | Share of this server |
|---|---|---|---|
| malcolm_alerts | 1 468 | 897 | 4 % |
| malcolm_file_scans | 1 412 | 863 | 4 % |
| arkime_spigraph | 1 190 | 727 | 3 % |
| arkime_session_payload | 1 144 | 699 | 3 % |
| arkime_connections | 1 118 | 683 | 3 % |
Compare this server with others.
More servers
Other registry entries on pypi.org, the ones next to this name; all of them.
- io.github.n24q02m/mnemo · not probed
- Telegram MCP io.github.n24q02m/telegram · needs env
- io.github.n24q02m/wet · crashed on start
- MCP Zero-Trust Gateway io.github.nabrahma/mcp-ztgateway · needs network
- AWS IoT Core io.github.nagarjunr/aws-iot-core · needs network
- Azure IoT Hub io.github.nagarjunr/azure-iot-hub · install failed
- Eclipse Ditto io.github.nagarjunr/eclipse-ditto · alive
- MQTT io.github.nagarjunr/mqtt · needs env
Servers that mention opensearch or suricata.
- io.github.infoinlet-marketplace/mcp-elasticsearch · alive
- io.github.mrfentmen/opensearch-mcp · alive
- io.github.thomasxm/crowdsentinel-mcp-server · crashed on start
- Netmon com.netmon/netmon · needs env
Badge for the README
The result of the latest probe, the tool count and the token cost. The feed has an entry for every probe that changed them.
A mail when this server changes
Stops answering, comes back, tool set or cost changes. One confirmation mail first, a stop link in every mail.
For the publisher
- This server is in the heaviest 10 % of the registry. Shorter descriptions, fewer optional parameters and fewer tools cut the cost. The command npx mcpcost --url <endpoint> --tools 50 lists every tool with its cost.