# Purple AI MCP Server

> Read-only MCP server for SentinelOne's Singularity Platform — query Purple AI, alerts, vulnerabilities, misconfigurations, and asset inventory via natural language or PowerQuery.

- Type: MCP server
- Author: Sentinel-One
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-30
- Source repository: https://github.com/Sentinel-One/purple-mcp
- Repo state: not archived
- Last push: 2026-10-28T14:20:38Z
- Stars: 102 (a popularity signal, not a safety signal)
- Forks: 35 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: SentinelOne
- Domains: security-operations, vulnerability-management
- Tags: sentinelone, purple-ai, alerts, vulnerability-management, asset-inventory, power-query, singularity-platform
- Date added: 2026-07-09
- Transport: both
- Runtime: python
- Auth method: none
- Compatible clients: Claude Desktop, Claude Code, Codex, Cursor
- Tools:
  - `purple_ai`: Ask security questions and investigate threats using SentinelOne's Purple AI
  - `powerquery`: Run PowerQuery analytics against events in your SentinelOne data lake
  - `get_alert`: Get details for a specific alert
  - `list_alerts`: List recent alerts
  - `search_alerts`: Search alerts with filters
  - `get_alert_notes`: Get comments/notes on an alert
  - `get_alert_history`: View an alert's timeline
  - `get_vulnerability`: Get details for a specific vulnerability
  - `list_vulnerabilities`: List recent vulnerabilities
  - `search_vulnerabilities`: Search CVEs and vulnerability findings with filters
  - `get_vulnerability_notes`: Get comments on a vulnerability
  - `get_vulnerability_history`: View a vulnerability's timeline
  - `get_misconfiguration`: Get details for a specific misconfiguration
  - `list_misconfigurations`: List recent misconfiguration issues
  - `search_misconfigurations`: Search misconfigurations by criteria
  - `get_misconfiguration_notes`: Get comments on a misconfiguration
  - `get_misconfiguration_history`: View a misconfiguration's timeline
  - `get_inventory_item`: Get details for a specific asset
  - `list_inventory_items`: List assets by surface type (endpoints, cloud resources, identities, network devices)
  - `search_inventory_items`: Search asset inventory with advanced filters
- Listing page: https://exchange.tenable.com/mcp-servers/sentinelone-purple-ai-mcp-server
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/sentinelone-purple-ai-mcp-server.md

Purple AI MCP Server gives any MCP-compatible client read-only access to SentinelOne's Singularity Platform: Purple AI natural-language security Q&A, PowerQuery analytics over the data lake, and structured access to alerts, vulnerabilities, misconfigurations, and asset inventory (endpoints, cloud resources, identities, network devices).

## What it does

- **Purple AI Q&A** — ask free-form security questions and investigate threats through SentinelOne's Purple AI.
- **PowerQuery access** — run PowerQuery analytics directly against events in your SentinelOne data lake.
- **Alerts, vulnerabilities, and misconfigurations** — get, list, search, and pull notes/history for each, so an assistant can triage and correlate without leaving the chat.
- **Asset inventory** — query endpoints, cloud resources, identities, and network devices by surface type or filter.
- **Read-only by design** — the server cannot make changes to the account or any objects in it; it is a query/investigation layer only.

## How it works

The server is a Python package (installable via `uv`/`uvx` or Docker) that authenticates to a SentinelOne console using an Account- or Site-scoped service user token (`PURPLEMCP_CONSOLE_TOKEN` + `PURPLEMCP_CONSOLE_BASE_URL`). It supports `stdio`, `sse`, and `streamable-http` transports, so it works with local clients (Claude Desktop, Claude Code, Cursor, Codex, Zed) as well as remote/serverless deployments (Docker, Amazon Bedrock AgentCore, Amazon ECS). The server itself enforces no authentication at the transport layer — for network-exposed deployments, SentinelOne's docs direct you to place it behind a reverse proxy or load balancer. It is maintained by SentinelOne in partnership with the open source community; it is not a formal SentinelOne product.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/sentinelone-purple-ai-mcp-server.json. The full index and how to read it: https://exchange.tenable.com/llms.txt