Content
# Summit Talk: Build Custom MCP Servers to Arm Your Threat Hunting Agents
> **Event Date & Time:** August 14 @ 3:30 pm – 3:55 pm ET
> **Speaker:** Matt Franz (AI Security Lead, Bespin Global)
> **Source Page:** [Antisyphon Event Page](https://www.antisyphontraining.com/event/summit-talk-build-custom-mcp-servers-to-arm-your-threat-hunting-agents/)
> **Registration:** [Zoom Event Registration](https://events.zoom.us/ev/AhXLnCl5y-AOiCkhPyanD8pLrOEtNtLDkGMVPTXYeSfXaUELLAfv~AmK8TKAbqy70ccKK0Q8r9zY_tSsEYRaYfhARYdtS9XU0d2cXPefne5FvNA) | [Infosec: Age of AI Summit](https://www.antisyphontraining.com/event/ai-summit/)
> **Community:** [Antisyphon Discord](https://discord.gg/antisyphon)
---
## Overview
Can your SIEM find the needle in the haystack — or does it need a smarter partner?
Join Matt Franz, AI Security Lead at Bespin Global, as he shows you how to vibe-code a custom MCP (Model Context Protocol) Server for your SIEM in Go, whether or not your vendor already ships one.
In 25 minutes, you’ll benefit from Matt’s experience building tools for SentinelOne, Osquery, Coralogix, and Elastic and learn:
* **Client Library Reuse:** A method for building and reusing client libraries even when your vendor offers no SDK or API spec.
* **Agent Integration:** Hands-on techniques for wiring your MCP Server into coding agents and agent frameworks.
* **Performance Tuning:** Practical approaches to tuning tool calling, prompting, and query guardrails to cut latency.
* **Data Optimization:** Testing, observability, and caching strategies to optimize queries for your datasets.
* **Threat Hunting Workflow:** A git/markdown threat-hunting workflow you can operationalize into a persistent knowledge base.
> MCP security concerns are real, but local MCP servers can be built and run safely, with significant payoff for your team (human and agentic alike). You might even save a token or two!
---
## About the Event
This talk is part of [Antisyphon Training's Infosec: Age of AI Summit](https://www.antisyphontraining.com/event/ai-summit/), a free, six-hour, live virtual event designed to give a practical, real-world look at how cyber experts are using AI and what security professionals need to know as adoption grows.
For those who want to go further, high-quality, affordable hands-on workshops are available Aug. 17-18 to help you learn AI security concepts, techniques, and tactics. Check out the entire [Antisyphon Training Course Catalog](https://www.antisyphontraining.com/course-catalog/) for affordable cybersecurity training!
---
## About the Speaker
### Matt Franz
*AI Security Lead at Bespin Global*
Matt Franz is the AI Security Lead at Bespin Global, where he builds products at the intersection of Cloud, SecOps, and AI. With over 25 years of experience in early-stage startups and mature enterprises, Matt blends the strategic perspective of an executive with the hands-on expertise of a builder. His background includes founding the Helix Cloud Operations team at Mandiant/FireEye, serving as VP of Production Engineering at Cofense, and directing global security operations at Ping Identity.
A former U.S. Army Intelligence Analyst, Matt currently focuses on large-scale data platforms, security analytics, infrastructure automation, and applying generative AI to offensive and defensive use cases. He builds daily in Python and Golang, with a focus on agentic blue team capabilities.
---
## Links & Resources
### Event
* [Antisyphon Talk Page](https://www.antisyphontraining.com/event/summit-talk-build-custom-mcp-servers-to-arm-your-threat-hunting-agents/) ([Zoom Registration](https://events.zoom.us/ev/AhXLnCl5y-AOiCkhPyanD8pLrOEtNtLDkGMVPTXYeSfXaUELLAfv~AmK8TKAbqy70ccKK0Q8r9zY_tSsEYRaYfhARYdtS9XU0d2cXPefne5FvNA)) — Infosec: Age of AI Summit
* [Antisyphon Discord](https://discord.gg/antisyphon) | [Course Catalog](https://www.antisyphontraining.com/course-catalog/)
* [Slides (PDF)](dist/slides-simple.pdf)
### My MCP Servers
* [steampipe-mcp-golang](https://github.com/mdfranz/steampipe-mcp-golang) — MCP server for Steampipe
* [go-velociraptor-mcp](https://github.com/mdfranz/go-velociraptor-mcp) — MCP server for Velociraptor
* [osqueryi-mcp](https://github.com/mdfranz/osqueryi-mcp) — MCP server for osqueryi
* [elastic-security-mcp](https://github.com/mdfranz/elastic-security-mcp) — MCP server for Elastic Security
MCP Store