{
  "type": "mcp-server",
  "slug": "sentinelone-s1-secops-mcp",
  "name": "SentinelOne MCP Server (s1-secops-mcp)",
  "author": "Sentinel-One",
  "description": "Zero-dependency Node.js MCP server orchestrating the SentinelOne Management Console, Singularity Data Lake, UAM Alert Interface, and Hyperautomation APIs — 26 tools over stdio or Streamable HTTP.",
  "github_url": "https://github.com/Sentinel-One/ai-siem/tree/main/mcp/s1-secops-mcp",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "sentinelone",
    "powerquery",
    "singularity-data-lake",
    "soc",
    "hyperautomation",
    "uam",
    "mcp"
  ],
  "integrations": [
    "SentinelOne"
  ],
  "domains": [
    "security-operations"
  ],
  "date_added": "2026-07-09",
  "last_reviewed": "2026-07-30",
  "transport": "both",
  "runtime": "node",
  "auth_method": "token",
  "compatible_clients": [
    "Claude Desktop",
    "Claude Code"
  ],
  "tools_exposed": [
    {
      "name": "powerquery_enumerate_sources",
      "description": "Enumerate live dataSource.name values available in the Singularity Data Lake"
    },
    {
      "name": "powerquery_run",
      "description": "Run a PowerQuery against the Singularity Data Lake and return results"
    },
    {
      "name": "powerquery_schema_discover",
      "description": "Discover the field schema for a data source before writing a query"
    },
    {
      "name": "purple_ai_alert_summary",
      "description": "Get a Purple AI-generated summary for an alert"
    },
    {
      "name": "s1_api_get",
      "description": "Generic GET against the SentinelOne Management Console REST API"
    },
    {
      "name": "s1_api_post",
      "description": "Generic POST against the SentinelOne Management Console REST API"
    },
    {
      "name": "s1_api_put",
      "description": "Generic PUT against the SentinelOne Management Console REST API"
    },
    {
      "name": "s1_api_patch",
      "description": "Generic PATCH against the SentinelOne Management Console REST API"
    },
    {
      "name": "s1_api_delete",
      "description": "Generic DELETE against the SentinelOne Management Console REST API"
    },
    {
      "name": "uam_add_note",
      "description": "Add an analyst note to a UAM alert"
    },
    {
      "name": "uam_get_alert",
      "description": "Get full details for a UAM alert"
    },
    {
      "name": "uam_list_alerts",
      "description": "List UAM alerts with filtering"
    },
    {
      "name": "uam_set_status",
      "description": "Set the status of a UAM alert"
    },
    {
      "name": "sdl_get_file",
      "description": "Get a Singularity Data Lake configuration file (parser, dashboard, or lookup)"
    },
    {
      "name": "sdl_list_files",
      "description": "List Singularity Data Lake configuration files"
    },
    {
      "name": "sdl_put_file",
      "description": "Create or update a Singularity Data Lake configuration file"
    },
    {
      "name": "sdl_delete_file",
      "description": "Delete a Singularity Data Lake configuration file"
    },
    {
      "name": "hec_ingest",
      "description": "Ingest events into the Singularity Data Lake via HEC"
    },
    {
      "name": "ha_list_workflows",
      "description": "List Hyperautomation workflows"
    },
    {
      "name": "ha_get_workflow",
      "description": "Get a Hyperautomation workflow's definition"
    },
    {
      "name": "ha_import_workflow",
      "description": "Import and deploy a Hyperautomation workflow from JSON"
    },
    {
      "name": "ha_export_workflow",
      "description": "Export a Hyperautomation workflow as JSON"
    },
    {
      "name": "ha_delete_workflow",
      "description": "Delete a Hyperautomation workflow"
    },
    {
      "name": "uam_ingest_alert",
      "description": "Ingest a UAM alert via the HEC alert interface"
    },
    {
      "name": "uam_post_alert",
      "description": "Post a UAM alert directly to the Alert Interface"
    },
    {
      "name": "uam_post_indicators",
      "description": "Post IOC indicators to a UAM alert"
    }
  ],
  "resources_exposed": [
    {
      "name": "sentinelone://soc-context",
      "description": "Serves CLAUDE.md, the Principal SOC Analyst operating instructions"
    },
    {
      "name": "sentinelone://credentials-status",
      "description": "Reports which credentials are configured and which API surfaces are available"
    }
  ],
  "prompts_exposed": [
    {
      "name": "soc_analyst",
      "description": "Embeds CLAUDE.md as a system prompt; call at session start"
    },
    {
      "name": "session_init",
      "description": "Structured session init: enumerate data sources and triage open alerts in parallel"
    }
  ],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-11-05T11:01:40Z",
    "stars": 95,
    "forks": 39,
    "open_issues": 5,
    "owner_type": "organization",
    "language": "Lua",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/mcp-servers/sentinelone-s1-secops-mcp",
  "json_url": "https://exchange.tenable.com/api/mcp-servers/sentinelone-s1-secops-mcp.json",
  "markdown_url": "https://exchange.tenable.com/mcp-servers/sentinelone-s1-secops-mcp.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/sentinelone-s1-secops-mcp.md"
}