threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Last Updated: 2026-02-02 Source: Lotus Blossom Chrysalis Backdoor detection engineering workflow.
1 5mo ago A 0 tokens
1Stars on the repository
22Mods indexed here, across every type
5mo agoLast push, which is what freshness is scored on
noneNo LICENSE: all rights reserved, so bodies are not copied
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Atomic Red Team testing specialist. Use when finding or executing atomic tests for detection validation.
1 5mo ago A 21 tokens
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Attack Range configuration and build specialist. Use to build custom ranges for specific detection testing scenarios.
1 5mo ago A 22 tokens
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Gap analysis specialist. Use to identify detection coverage gaps for threats, actors, or techniques.
1 5mo ago A 22 tokens
cti-analyst
05threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Threat intelligence specialist. Use when parsing threat reports, CISA alerts, or extracting TTPs from intelligence sources.
1 5mo ago A 29 tokens
data-dumper
06threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Attack data export specialist. Use after successful validation to dump attack data for the attackdata repo.
1 5mo ago A 23 tokens
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Detection writing specialist. Use when creating detection rules from techniques or threat analysis. Supports SPL, KQL, Sigma, and Elastic formats.
1 5mo ago A 32 tokens
fp-analyst
08threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
False positive analyst. Use to assess FP risk before staging detections.
1 5mo ago A 19 tokens
orchestrator
09threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Main workflow coordinator for the threat-to-detection pipeline.
1 5mo ago A 15 tokens
pr-reviewer
10threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Reviews open PRs, validates content quality, identifies gaps, and adds improvements. Use to enhance existing PRs before merge.
1 5mo ago A 29 tokens
pr-stager
11threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
GitHub PR specialist. Use to stage DRAFT PRs to detection and attackdata repos. NEVER auto-merge.
1 5mo ago A 28 tokens
qa-reviewer
12threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Quality assurance specialist. Use to review detection quality before PR staging.
1 5mo ago A 17 tokens
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Detection validation specialist. Use after atomic execution to verify detections fire correctly in any SIEM.
1 5mo ago A 23 tokens
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Splunk-specific detection validator. Use after atomic execution to verify SPL detections fire correctly in Splunk. For other SIEMs, use /siem-validator instead.
1 5mo ago A 38 tokens
verifier
15threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Agent Cursor
Skeptical validator. Use after detection workflow claims completion to verify work actually done.
1 5mo ago A 21 tokens