Tenzir

Tenzir MCP server

python

8

GitHub Stars

python

Language

6 months ago

First Indexed

2 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "tenzir-mcp": {
      "command": "uvx",
      "args": [
        "tenzir-mcp"
      ]
    }
  }
}

You can use the MCP server to let AI assistants interact with the Tenzir data pipeline, execute TQL pipelines and tests, access embedded documentation, work with OCSF definitions, manage packages, and auto-generate parsers. This server provides practical tools to run pipelines, explore documentation, and connect with security data workflows.

How to use

You connect to the MCP server with your preferred client and use its features to run pipelines, search documentation, query OCSF data, manage packages, and generate parsers. You can execute pipelines written in TQL, browse cross-referenced docs, explore event classes and profiles, and create or modify packages that contain operators, pipelines, enrichment contexts, and tests. Use the client to initiate a pipeline run, view results, and verify tests to ensure your security workflows behave as expected.

How to install

Prerequisites: you should have Docker installed or have a local MCP runtime available via uvx.

# Docker quick start
docker run -i tenzir/mcp

# Local runtime via uvx (requires a local Tenzir installation)
uvx tenzir-mcp

Additional notes and setup

Install and run options are provided to help you start quickly. If you prefer containers, use Docker to pull and run the MCP server. If you already have a local Tenzir setup, you can start the MCP server with uvx using the bundled runtime.

Available tools

pipeline_run

Executes TQL pipelines and runs tests within the MCP server, returning results and status.

doc_browse

Searches and browses embedded Tenzir documentation with cross-reference support.

ocsf_query

Queries OCSF event classes, objects, and profiles to integrate with security workflows.

package_manage

Creates and manages Tenzir packages including operators, pipelines, enrichment contexts, and tests.

parser_codegen

Auto-generates TQL parsers and OCSF mapping packages to streamline integration.