$ loading_
Query Blumira SIEM findings, evidence, and detection data for security investigations.
This tool appears to be a standard MCP integration for querying Blumira SIEM findings and evidence via the Blumira API, requiring a JWT credential and running as an MCP server. Given the official source, open-source availability, and recent maintenance, it trends toward low-to-moderate risk, with attention needed for credential handling, actual network destinations, and accessible data scope.
The materials show it requires BLUMIRA_JWT_TOKEN, which is a sensitive authentication credential; if exposed, it could be used to access findings, evidence, and detection data in Blumira. The other environment variables appear to be runtime configuration, but they should still not be exposed in logs or plaintext configs.
The description explicitly states it queries data via the Blumira API, so routine network egress to Blumira services is expected. No specific host is listed in the materials, and there is no clear red flag indicating exfiltration to unrelated or unknown third-party endpoints, but the actual API targets should be verified in source before deployment.
The system checks indicate it executes code / runs as an MCP server, which is a normal capability for this class of tool. The available materials do not show requests for unusual system privileges, unrelated high-risk operations, or covert command execution.
Per the description, it can access Blumira findings, evidence, and detection data, which are typically sensitive security operations data. The materials do not specify local file read/write scope, and no obvious overreach beyond the stated purpose is visible, but access should still be constrained under least-privilege principles.
The source is an official registry entry and an open-source repository is provided, with updates within the past year, giving it auditability and some maintenance signals; these are clear risk-reducing factors. Although the repository has low stars and the license is not stated, those points merit follow-up rather than a high-risk rating based on the current materials.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "Blumira" yet — see the docs or source repo.
Safely lets AI agents use threat analysis and security operations tools.
Investigate SIEM alerts, hunt threats, and tune rules using natural language.
Integrate multiple security tools for AI-assisted pentesting and vulnerability validation.
Query and automate 7,283+ security detection rules in one place.
Analyze PCAPs offline to extract streams, detect threats, and find leaked credentials.
Access Wazuh security alerts, vulnerabilities, and network docs using natural language.