DETECTION ENGINEERING / Timescale
RSigma MCP
Exposes Sigma rule parsing, linting, evaluation and conversion, with separately enabled incident-triage and operational-write tools.
“MCP server”
01 / THE REASONING
Why this made the selection.
- Supports a concrete rule-authoring loop with structured parse, lint and evaluation results.
- Daemon read tools and operational writes require separate configuration, making their scope explicit.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md (installation, capability and permission sections)
- Cargo.toml
- crates/rsigma-mcp/Cargo.toml
- crates/rsigma-mcp/src/lib.rs
- crates/rsigma-mcp/src/tools.rs
- crates/rsigma-cli/src/commands/mcp.rs
- LICENSE
- Official MCP guide: feature/build, tool tiers, HTTP authentication and TLS sections
Our findings
- The guide identifies the opt-in mcp feature and states prebuilt binaries include it; the CLI defines stdio and optional Streamable HTTP.
- Daemon writes require --allow-operate-writes; HTTP bearer authentication and TLS are configured separately.
- Content failures may arrive as successful MCP responses containing ok:false, which a client must inspect.
- Published crate metadata confirms the mcp feature enables the MCP HTTP feature as well as the server dependency.
Not established by this review
- Server startup, authentication and tool execution were not tested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
cargo install --locked rsigma --features mcpCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Install a build with the MCP feature, or use a documented prebuilt release.
- Launch rsigma mcp serve with the intended rules directory; add daemon access and write flags only when required.
Before you start
- A Rust toolchain for the source-build command, or a documented prebuilt binary; Sigma rules/event samples.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Official documentation ↗Checked
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/README.md
Supports: summary, whySelected, bestFor, limitations, install, access, compatibility, transports
- Applicable source licence ↗Checked
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/LICENSE
Supports: license
- Implementation: Cargo.toml ↗Checked
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/Cargo.toml
Supports: language, review
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/Cargo.toml
Supports: language, review
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/src/lib.rs
Supports: language, review
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/src/tools.rs
Supports: language, review
https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-cli/src/commands/mcp.rs
Supports: language, review
- RSigma MCP guide ↗Checked
https://rsigma.io/guide/mcp-server/
Supports: install, review, limitations, access, transports
https://crates.io/api/v1/crates/rsigma
Supports: install, review, transports