ms-sentinel-mcp-server

Instructions

Implementation Reference

• tools/workspace_tools.py:244-308 (handler)

  The SentinelMetadataListTool class defines the tool with name 'sentinel_metadata_list' and implements the handler logic in the async run() method, which retrieves and lists Sentinel metadata from the workspace using the Azure Security Insights client's metadata.list() API.
  class SentinelMetadataListTool(MCPToolBase): """ Tool for listing all Sentinel metadata in the current workspace. """ name = "sentinel_metadata_list" description = "List all Sentinel metadata in the current workspace." async def run(self, ctx: Context, **kwargs): """ List all metadata in the current Sentinel workspace. Parameters: None required. (Context is extracted from MCP or environment.) Returns: dict: { 'metadata': list[dict], 'valid': bool, 'errors': list[str], 'error': str (optional, present only if an error occurs) } Output Fields: - metadata: List of metadata objects (id, name, kind, etc.) - valid: True if successful, False otherwise - errors: List of error messages (empty if none) - error: Error message if an error occurs (optional) Error cases will always include an 'error' key for testability. """ logger = self.logger workspace_name, resource_group, subscription_id = self.get_azure_context(ctx) result = { "metadata": [], "valid": False, "errors": [], } try: client = self.get_securityinsight_client(subscription_id) metadata_objs = client.metadata.list(resource_group, workspace_name) metadata_list = [] for meta in metadata_objs: metadata_list.append( { "id": getattr(meta, "id", None), "name": getattr(meta, "name", None), "kind": getattr(meta, "kind", None), "content_id": getattr(meta, "content_id", None), "version": getattr(meta, "version", None), "parent_id": getattr(meta, "parent_id", None), "author": getattr(meta, "author", None), "source": getattr(meta, "source", None), "support": getattr(meta, "support", None), "categories": getattr(meta, "categories", None), "dependencies": getattr(meta, "dependencies", None), "created": str(getattr(meta, "created", "")), "last_modified": str(getattr(meta, "last_modified", "")), } ) result["metadata"] = metadata_list result["valid"] = True except Exception as ex: error_msg = "Error listing metadata: %s" % ex logger.exception("%s", error_msg) result["error"] = error_msg result["errors"].append(error_msg) return result
• tools/workspace_tools.py:575-575 (registration)

  The registration of the SentinelMetadataListTool to the MCP server instance via the register_tools function.
  SentinelMetadataListTool.register(mcp)