Back to Home
timesketch icon

timesketch-mcp-server

Verified Safe

by timesketch

Overview

Provides an API server with a set of tools for programmatic interaction and analysis of data within a Timesketch digital forensics platform.

Installation

Run Command
docker compose up -d

Environment Variables

  • TIMESKETCH_HOST
  • TIMESKETCH_PORT
  • TIMESKETCH_USER
  • TIMESKETCH_PASSWORD

Security Notes

The server uses environment variables for Timesketch credentials, which is good practice. Input sanitization for `search_timesketch_events_substrings` handles Lucene reserved characters for non-regex searches. However, tools like `search_timesketch_events_advanced` allow direct Lucene/OpenSearch query strings, meaning the security against query injection or resource exhaustion largely depends on the robustness of the underlying `timesketch-api-client` and the Timesketch backend itself. The server binds to `0.0.0.0` by default when run via `uv`, making it accessible externally, requiring proper network isolation in production.

Similar Servers

Stats

Interest Score0
Security Score7
Cost ClassMedium
Avg Tokens750
Stars0
Forks2
Last Update2026-01-12

Tags

TimesketchDigital ForensicsData AnalysisAPISecurity Operations