ms-sentinel-mcp-server
Related Servers
Alternatives to ms-sentinel-mcp-server
No user-submitted related servers found.
Related Servers
- AlicenseNot gradedqualityDmaintenanceA Python-based MCP server that enables integration with Microsoft Security Copilot and Microsoft Sentinel, allowing users to run KQL queries, manage skillsets/plugins, and execute prompts in Security Copilot.23MIT
- AlicenseAqualityBmaintenanceMCP server for Azure resource management, AI Foundry, and Entra ID — inspect and operate Azure infrastructure through AI agents.3MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for executing Kusto Query Language (KQL) queries against Azure Data Explorer clusters, integrating with Claude Desktop and VS Code via Azure CLI authentication.-
- AlicenseNot gradedqualityCmaintenanceA Model Context Protocol server that gives Claude Code (or any MCP client) controlled access to Microsoft 365 through the Microsoft Graph API: mail, calendar, contacts, files, notes, tasks, Teams, SharePoint, and the full tenant-admin surface.411MIT
- FlicenseNot gradedqualityCmaintenanceRead-only MCP server for querying Microsoft Purview unified audit logs across M365 workloads, wrapping the Graph API's asynchronous audit log search.-
- AlicenseAqualityDmaintenanceMCP server for Claude to access Outlook data via Microsoft Graph API20861MIT
TDQS
Scored across 49 tools
Most tools have distinct purposes targeting specific Sentinel resources (e.g., incidents, rules, connectors) with clear action verbs, though some overlap exists between sentinel_logs_search and sentinel_logs_search_with_dummy_data, and between markdown_template_get and tool_docs_get. The descriptions help clarify differences, but agents might occasionally confuse similar tools.
Tool names follow a highly consistent snake_case pattern with a clear verb_noun structure throughout (e.g., sentinel_incident_get, sentinel_analytics_rule_list). All tools adhere to this convention, making them predictable and easy to parse, with no mixing of styles or chaotic naming.
With 49 tools, the count is excessive for a single server, likely overwhelming for agents and indicating poor scoping. While Sentinel is a broad domain, this many tools suggests fragmentation or redundancy, such as multiple counting tools (e.g., sentinel_analytics_rules_count_by_tactic, sentinel_analytics_rules_count_by_technique) that could be consolidated.
The tool set provides comprehensive coverage of the Sentinel domain, including CRUD operations for incidents, rules, connectors, watchlists, and metadata, plus utilities for logs, queries, and documentation. No obvious gaps exist; agents can perform full lifecycle management and analysis tasks without dead ends.