# SentinelOne MCP Server (s1-secops-mcp)

> Zero-dependency Node.js MCP server orchestrating the SentinelOne Management Console, Singularity Data Lake, UAM Alert Interface, and Hyperautomation APIs — 26 tools over stdio or Streamable HTTP.

- Type: MCP server
- Author: Sentinel-One
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-30
- Source repository: https://github.com/Sentinel-One/ai-siem/tree/main/mcp/s1-secops-mcp
- Repo state: not archived
- Last push: 2026-11-05T11:01:40Z
- Stars: 95 (a popularity signal, not a safety signal)
- Forks: 39 (a popularity signal, not a safety signal)
- Open issues: 5
- Language: Lua
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: SentinelOne
- Domains: security-operations
- Tags: sentinelone, powerquery, singularity-data-lake, soc, hyperautomation, uam, mcp
- Date added: 2026-07-09
- Transport: both
- Runtime: node
- Auth method: token
- Compatible clients: Claude Desktop, Claude Code
- Tools:
  - `powerquery_enumerate_sources`: Enumerate live dataSource.name values available in the Singularity Data Lake
  - `powerquery_run`: Run a PowerQuery against the Singularity Data Lake and return results
  - `powerquery_schema_discover`: Discover the field schema for a data source before writing a query
  - `purple_ai_alert_summary`: Get a Purple AI-generated summary for an alert
  - `s1_api_get`: Generic GET against the SentinelOne Management Console REST API
  - `s1_api_post`: Generic POST against the SentinelOne Management Console REST API
  - `s1_api_put`: Generic PUT against the SentinelOne Management Console REST API
  - `s1_api_patch`: Generic PATCH against the SentinelOne Management Console REST API
  - `s1_api_delete`: Generic DELETE against the SentinelOne Management Console REST API
  - `uam_add_note`: Add an analyst note to a UAM alert
  - `uam_get_alert`: Get full details for a UAM alert
  - `uam_list_alerts`: List UAM alerts with filtering
  - `uam_set_status`: Set the status of a UAM alert
  - `sdl_get_file`: Get a Singularity Data Lake configuration file (parser, dashboard, or lookup)
  - `sdl_list_files`: List Singularity Data Lake configuration files
  - `sdl_put_file`: Create or update a Singularity Data Lake configuration file
  - `sdl_delete_file`: Delete a Singularity Data Lake configuration file
  - `hec_ingest`: Ingest events into the Singularity Data Lake via HEC
  - `ha_list_workflows`: List Hyperautomation workflows
  - `ha_get_workflow`: Get a Hyperautomation workflow's definition
  - `ha_import_workflow`: Import and deploy a Hyperautomation workflow from JSON
  - `ha_export_workflow`: Export a Hyperautomation workflow as JSON
  - `ha_delete_workflow`: Delete a Hyperautomation workflow
  - `uam_ingest_alert`: Ingest a UAM alert via the HEC alert interface
  - `uam_post_alert`: Post a UAM alert directly to the Alert Interface
  - `uam_post_indicators`: Post IOC indicators to a UAM alert
- Resources:
  - `sentinelone://soc-context`: Serves CLAUDE.md, the Principal SOC Analyst operating instructions
  - `sentinelone://credentials-status`: Reports which credentials are configured and which API surfaces are available
- Prompts:
  - `soc_analyst`: Embeds CLAUDE.md as a system prompt; call at session start
  - `session_init`: Structured session init: enumerate data sources and triage open alerts in parallel
- Listing page: https://exchange.tenable.com/mcp-servers/sentinelone-s1-secops-mcp
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/sentinelone-s1-secops-mcp.md

SentinelOne MCP Server (`s1-secops-mcp`) is a pure Node.js 18+, zero-external-dependency MCP server that orchestrates the SentinelOne Management Console REST API, Singularity Data Lake (SDL), UAM Alert Interface, and Hyperautomation APIs behind a single MCP surface. It's the primary API-access layer for the broader "SentinelOne AI Analyst" skills bundle in this repository, but it also works standalone with any MCP client.

## What it does

- **PowerQuery access** — enumerate data sources, run PowerQuery analytics, and discover field schemas against the Singularity Data Lake.
- **Management Console REST** — generic GET/POST/PUT/PATCH/DELETE verbs against the S1 Mgmt Console API, plus Purple AI alert summaries.
- **UAM alert management** — list, get, note, and set status on UAM alerts; ingest alerts and IOC indicators via HEC.
- **SDL configuration management** — list, get, create/update, and delete SDL config files (parsers, dashboards, lookups).
- **Hyperautomation** — list, get, import/deploy, export, and delete Hyperautomation workflows.
- **Two resources and two prompts** for session bootstrapping: a `soc_analyst` system prompt that loads `CLAUDE.md`, and a `session_init` prompt that enumerates data sources and triages open alerts in parallel.

## How it works

The server supports both `stdio` (for Claude Desktop, Claude Code, and Claude Cowork, launched via `npx`) and Streamable HTTP transports (for shared team deployments on a VM, with per-user bearer tokens, SIGHUP-reloadable token rotation, and structured audit logging). It authenticates to the SentinelOne Management Console via an API token (`S1_CONSOLE_API_TOKEN`) and, for SDL and HEC operations, additional SDL-scoped keys (`SDL_LOG_READ_KEY`, `SDL_CONFIG_READ_KEY`, `SDL_CONFIG_WRITE_KEY`, `S1_HEC_INGEST_URL`). Credentials resolve from environment variables, an explicit credentials file, or several Cowork/CLI-friendly fallback paths, in a documented priority order. In HTTP mode, per-user bearer tokens are optional but strongly recommended outside `127.0.0.1`; the server logs a warning if it starts without one.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/mcp-servers/sentinelone-s1-secops-mcp.json. The full index and how to read it: https://exchange.tenable.com/llms.txt