Crate rsigma_mcp 

rsigma-mcp

A Model Context Protocol server that exposes the rsigma Sigma toolchain (parser, linter, evaluator, converter, field extraction, pipeline resolution) as MCP tools and resources, so any MCP-aware agent can author, lint, fix, validate, evaluate, and convert Sigma detection rules with structured, machine-readable results.

The server is transport-agnostic; the RsigmaMcp handler is driven over stdio by rsigma mcp serve (and, behind a feature, Streamable HTTP). The handlers are thin synchronous wrappers over the underlying rsigma crates, which keeps stdout reserved for the transport (all diagnostics go to stderr).

Structs

RsigmaMcp

The rsigma MCP handler. Cloned per request by rmcp; the real state lives behind an Arc so cloning is cheap.

Functions

serve_stdio

Serve the MCP handler over stdio (stdin/stdout), blocking until the client disconnects. The caller owns the tokio runtime.