Skip to main content
Glama
ZeroSOC

defender-xdr

by ZeroSOC
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Related Servers

Alternatives to defender-xdr

No user-submitted related servers found.

    Related Servers

    • Response MCP Server

      markolauren
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables agentic SecOps by executing Microsoft Defender XDR response actions (device isolation, antivirus scans, forensic collection, incident management) through natural language with orchestrators like GitHub Copilot.
      21
      -

    • Defender Hunt MCP

      Soucheff
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables security investigation and threat hunting through Microsoft Defender and Entra ID, with 31 tools for KQL queries, alerts, threat intelligence, identity investigation, and advanced threat hunting.
      MIT

    • defender-xdr-mcp

      MaddogWarner
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables AI assistants to query Microsoft Defender XDR telemetry for read-only threat hunting, incident triage, and vulnerability discovery using delegated per-user authentication and production guardrails.
      1
      MIT

    • Entra ID SecOps MCP Server

      Sultan-zd
      A
      license
      A
      quality
      B
      maintenance
      Enables security analysts to investigate Microsoft Entra ID security logs through natural language, exposing read-only tools for user context, sign-ins, risky users, risk detections, directory audits, and conditional access policies.
      6
      MIT
    • CrowdStrike Falcon MCP Server by CrowdStrike

      CrowdStrike Falcon MCP Serverofficial

      CrowdStrike
      A
      license
      Not graded
      quality
      A
      maintenance
      Connects AI agents with the CrowdStrike Falcon platform to enable intelligent security analysis, providing programmatic access to detections, incidents, threat intelligence, vulnerabilities, and other security capabilities for advanced security operations and automation.
      256
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.2/5.0

    Scored across 66 tools

    Disambiguation4/5

    Most tools use a clear resource-plus-attribute pattern (get_machine_*, get_file_*, get_recommendation_*), so their purposes are largely distinct. A few inverse/overlapping pairs—machine_vulnerabilities vs machines_by_vulnerability, file_info vs file_statistics, incident_alerts vs incident_evidence—require careful reading and could cause misselection.

    Naming Consistency4/5

    The dominant defender_get_<resource> and defender_update_<resource> conventions are consistent and readable. Deviations are minor but visible: mixed get_/list_ for collections, find_machines_by_* instead of get_*, the combined add_remove verb, and an entra_ prefix inside a defender_ server.

    Tool Count1/5

    66 tools is far beyond the typical well-scoped MCP surface and exceeds the 50+ extreme-mismatch boundary. Even though the tools are grouped by domain, this scale creates significant selection and maintenance overhead and would be better split into focused servers.

    Completeness2/5

    Investigation, hunting, alert/incident triage, and vulnerability views are well covered. However, the response half of XDR is missing: there are no tools to isolate/release machines, run live response, create/delete indicators, or mutate remediation activities, leaving obvious dead ends after detection.

    Maintenance

    ActivityMaintained
    ResponsivenessUnresponsive

    Resources