SentinelOne MCP Server (s1-secops-mcp)
ContributedZero-dependency Node.js MCP server orchestrating the SentinelOne Management Console, Singularity Data Lake, UAM Alert Interface, and Hyperautomation APIs — 26 tools over stdio or Streamable HTTP.
Tools (26)
- powerquery_enumerate_sources
Enumerate live dataSource.name values available in the Singularity Data Lake
- powerquery_run
Run a PowerQuery against the Singularity Data Lake and return results
- powerquery_schema_discover
Discover the field schema for a data source before writing a query
- purple_ai_alert_summary
Get a Purple AI-generated summary for an alert
- s1_api_get
Generic GET against the SentinelOne Management Console REST API
- s1_api_post
Generic POST against the SentinelOne Management Console REST API
- s1_api_put
Generic PUT against the SentinelOne Management Console REST API
- s1_api_patch
Generic PATCH against the SentinelOne Management Console REST API
- s1_api_delete
Generic DELETE against the SentinelOne Management Console REST API
- uam_add_note
Add an analyst note to a UAM alert
- uam_get_alert
Get full details for a UAM alert
- uam_list_alerts
List UAM alerts with filtering
- uam_set_status
Set the status of a UAM alert
- sdl_get_file
Get a Singularity Data Lake configuration file (parser, dashboard, or lookup)
- sdl_list_files
List Singularity Data Lake configuration files
- sdl_put_file
Create or update a Singularity Data Lake configuration file
- sdl_delete_file
Delete a Singularity Data Lake configuration file
- hec_ingest
Ingest events into the Singularity Data Lake via HEC
- ha_list_workflows
List Hyperautomation workflows
- ha_get_workflow
Get a Hyperautomation workflow's definition
- ha_import_workflow
Import and deploy a Hyperautomation workflow from JSON
- ha_export_workflow
Export a Hyperautomation workflow as JSON
- ha_delete_workflow
Delete a Hyperautomation workflow
- uam_ingest_alert
Ingest a UAM alert via the HEC alert interface
- uam_post_alert
Post a UAM alert directly to the Alert Interface
- uam_post_indicators
Post IOC indicators to a UAM alert
Resources (2)
- sentinelone://soc-context
Serves CLAUDE.md, the Principal SOC Analyst operating instructions
- sentinelone://credentials-status
Reports which credentials are configured and which API surfaces are available
Prompts (2)
- soc_analyst
Embeds CLAUDE.md as a system prompt; call at session start
- session_init
Structured session init: enumerate data sources and triage open alerts in parallel
SentinelOne MCP Server (s1-secops-mcp) is a pure Node.js 18+, zero-external-dependency MCP server that orchestrates the SentinelOne Management Console REST API, Singularity Data Lake (SDL), UAM Alert Interface, and Hyperautomation APIs behind a single MCP surface. It’s the primary API-access layer for the broader “SentinelOne AI Analyst” skills bundle in this repository, but it also works standalone with any MCP client.
What it does
- PowerQuery access — enumerate data sources, run PowerQuery analytics, and discover field schemas against the Singularity Data Lake.
- Management Console REST — generic GET/POST/PUT/PATCH/DELETE verbs against the S1 Mgmt Console API, plus Purple AI alert summaries.
- UAM alert management — list, get, note, and set status on UAM alerts; ingest alerts and IOC indicators via HEC.
- SDL configuration management — list, get, create/update, and delete SDL config files (parsers, dashboards, lookups).
- Hyperautomation — list, get, import/deploy, export, and delete Hyperautomation workflows.
- Two resources and two prompts for session bootstrapping: a
soc_analystsystem prompt that loadsCLAUDE.md, and asession_initprompt that enumerates data sources and triages open alerts in parallel.
How it works
The server supports both stdio (for Claude Desktop, Claude Code, and Claude Cowork, launched via npx) and Streamable HTTP transports (for shared team deployments on a VM, with per-user bearer tokens, SIGHUP-reloadable token rotation, and structured audit logging). It authenticates to the SentinelOne Management Console via an API token (S1_CONSOLE_API_TOKEN) and, for SDL and HEC operations, additional SDL-scoped keys (SDL_LOG_READ_KEY, SDL_CONFIG_READ_KEY, SDL_CONFIG_WRITE_KEY, S1_HEC_INGEST_URL). Credentials resolve from environment variables, an explicit credentials file, or several Cowork/CLI-friendly fallback paths, in a documented priority order. In HTTP mode, per-user bearer tokens are optional but strongly recommended outside 127.0.0.1; the server logs a warning if it starts without one.