--- title: "RSigma MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/rsigma/ description: "Exposes Sigma rule parsing, linting, evaluation and conversion, with separately enabled incident-triage and operational-write tools." --- # RSigma MCP: review, setup & limitations · Undominated.ai > Exposes Sigma rule parsing, linting, evaluation and conversion, with separately enabled incident-triage and operational-write tools. [← Explore all mcp servers](/mcp-servers/) DETECTION ENGINEERING / Timescale # RSigma MCP Exposes Sigma rule parsing, linting, evaluation and conversion, with separately enabled incident-triage and operational-write tools. See setup guidance ↓Original source ↗ SOURCE REVIEW Reviewed 2026-09-21 Evidence 9 linked sources Publisher Timescale Licence MIT ↗ Revision 7cadc4aa617a Read what was—and wasn’t—checked ↓ “MCP server” Timescale · upstream description ↗ Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Supports a concrete rule-authoring loop with structured parse, lint and evaluation results. - Daemon read tools and operational writes require separate configuration, making their scope explicit. ### A good fit for - Checking Sigma rules against supplied event examples before converting them for a target backend. ### Weigh up before choosing - The MCP feature must be included in source builds; a generic CLI installation may omit it. - Rule-fixing tools can modify files, and optional sigma-cli delegation launches another program. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - README.md (installation, capability and permission sections) - Cargo.toml - crates/rsigma-mcp/Cargo.toml - crates/rsigma-mcp/src/lib.rs - crates/rsigma-mcp/src/tools.rs - crates/rsigma-cli/src/commands/mcp.rs - LICENSE - Official MCP guide: feature/build, tool tiers, HTTP authentication and TLS sections ### Our findings - The guide identifies the opt-in mcp feature and states prebuilt binaries include it; the CLI defines stdio and optional Streamable HTTP. - Daemon writes require --allow-operate-writes; HTTP bearer authentication and TLS are configured separately. - Content failures may arrive as successful MCP responses containing ok:false, which a client must inspect. - Published crate metadata confirms the mcp feature enables the MCP HTTP feature as well as the server dependency. ### Not established by this review - Server startup, authentication and tool execution were not tested. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. Upstream setup instructions ↗ DOCUMENTED COMMAND cargo install --locked rsigma --features mcp Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Install a build with the MCP feature, or use a documented prebuilt release. - Launch rsigma mcp serve with the intended rules directory; add daemon access and write flags only when required. ### Before you start - A Rust toolchain for the source-build command, or a documented prebuilt binary; Sigma rules/event samples. ### Compatibility An MCP client supporting stdio, Streamable HTTP. · A Rust toolchain for the source-build command, or a documented prebuilt binary; Sigma rules/event samples. ### Implementation Rust ### Transports stdio · Streamable HTTP ### Detection engineering / Configured credentials or local access - Reads rule files and event samples; rule fixes can write files. - Optional daemon integration reads incidents and can create silences or post dispositions when explicitly enabled. ### Cost model Local compute and any separately deployed daemon/backend infrastructure determine cost. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - Official documentation ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/README.md Supports: summary, whySelected, bestFor, limitations, install, access, compatibility, transports - Applicable source licence ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/LICENSE Supports: license - Implementation: Cargo.toml ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/Cargo.toml Supports: language, review - Implementation: crates/rsigma-mcp/Cargo.toml ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/Cargo.toml Supports: language, review - Implementation: crates/rsigma-mcp/src/lib.rs ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/src/lib.rs Supports: language, review - Implementation: crates/rsigma-mcp/src/tools.rs ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-mcp/src/tools.rs Supports: language, review - Implementation: crates/rsigma-cli/src/commands/mcp.rs ↗ Checked 2026-09-21 https://github.com/timescale/rsigma/blob/7cadc4aa617a938d0664a0a3f02121b295cd52c6/crates/rsigma-cli/src/commands/mcp.rs Supports: language, review - RSigma MCP guide ↗ Checked 2026-09-21 https://rsigma.io/guide/mcp-server/ Supports: install, review, limitations, access, transports - Published RSigma crate feature metadata ↗ Checked 2026-09-21 https://crates.io/api/v1/crates/rsigma Supports: install, review, transports KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Agent Spreadsheet MCP ↗ Provides workbook inspection and structured edit/recalculation workflows through a Rust MCP server with a configured workspace root.](/mcp-servers/agent-spreadsheet-mcp/)[### Perfetto MCP ↗ Lets an assistant load local Perfetto traces and investigate them with dedicated trace tools or custom PerfettoSQL.](/mcp-servers/perfetto/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)