MCP server for Zeek network security analysis
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"iflow-mcp-gabbo01-zeek-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
[](https://www.apache.org/licenses/LICENSE-2.0) [](https://github.com/Gabbo01/Zeek-MCP/releases) [](https://www.linkedin.com/in/gabriele-bencivenga-93797b147/)  # Zeek-MCP This repository provides a set of utilities to build an MCP server (Model Context Protocol) that you can integrate with your conversational AI client. --- ## Table of Contents * [Prerequisites](#prerequisites) * [Installation](#installation) * [Usage](#usage) * [1. Clone the repository](#1-clone-the-repository) * [2. Install dependencies](#2-install-dependencies) * [3. Run the MCP server](#3-run-the-mcp-server) * [4. Use the MCP tools](#4-use-the-mcp-tools) * [Examples](#examples) * [License](#license) --- ## Prerequisites * **Python 3.7+** * **Zeek** installed and available in your `PATH` (for the `execzeek` tool) * **pip** (for installing Python dependencies) --- ## Installation ### 1. Clone the repository ```bash git clone https://github.com/Gabbo01/Zeek-MCP cd Zeek-MCP ``` ### 2. Install dependencies It's recommended to use a virtual environment: ```bash python -m venv venv source venv/bin/activate # Linux/macOS venv\Scripts\activate # Windows pip install -r requirements.txt ``` > **Note:** If you don’t have a `requirements.txt`, install directly: > > ```bash > pip install pandas mcp > ``` --- ## Usage The repository exposes two main MCP tools and a command-line entry point: ### 3. Run the MCP server ```bash python Bridge_Zeek_MCP.py --mcp-host 127.0.0.1 --mcp-port 8081 --transport sse ``` * `--mcp-host`: Host for the MCP server (default: `127.0.0.1`). * `--mcp-port`: Port for the MCP server (default: `8081`). * `--transport`: Transport protocol, either `sse` (Server-Sent Events) or `stdio`.  ### 4.…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.