I Built 7 MCP Servers for Security Tools. The Protocol Was the Easy Part.

The author built seven open-source MCP servers to connect AI agents directly to security tools including Wazuh, Suricata, Zeek, TheHive, Cortex, MISP, and MITRE ATT&CK. While the protocol implementation took only a weekend, designing proper context engineering for security telemetry took weeks. Each server was tested against live infrastructure, with the core challenge being not just successful tool calls but ensuring the model receives data it can meaningfully reason about during investigations.