Skip to main content
Glama
jamescash1976

SentinelOne MCP Server

s1_agents

List and filter endpoint agents to monitor machine health and status. Drill down into OS, site, and last active details.

Instructions

List endpoint agents with filters — the drill-down tool for machines. Returns each agent's computer name, site, OS, agent version, online/infected/up-to-date status, last active date, last logged-in user and network status. Filter by site, name, health flags or OS. Returns a compact summary per agent by default; set full_details=true for complete raw records (large). Call s1_list_sites first to resolve site IDs.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMax records per response (default 25, max 1000).
cursorNoPagination cursor: pass the nextCursor from the previous response to get the next page.
infectedNoOnly agents with (true) or without (false) unresolved threats
os_typesNoComma-separated OS types: "windows", "macos", "linux", "windows_legacy"
site_idsNoComma-separated site IDs to scope to (sites are how clients are segmented)
is_activeNoOnline status: true = online now, false = offline
full_detailsNoReturn complete raw agent records instead of the compact summary. Default false.
computer_nameNoFilter to computer names containing this text
is_up_to_dateNofalse = agents whose SentinelOne agent software needs updating
machine_typesNoComma-separated machine types: "desktop", "laptop", "server", "kubernetes node", "unknown"
reboot_requiredNotrue = agents waiting on a reboot to complete threat mitigation
network_statusesNoComma-separated: "connected", "disconnected", "connecting", "disconnecting"
last_active_afterNoOnly agents last active after this ISO 8601 datetime
last_active_beforeNoOnly agents last active before this ISO 8601 datetime (find stale machines), e.g. "2026-07-01T00:00:00Z"
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does a good job: it discloses the default compact summary format, warns that full_details=true returns 'large' raw records, and lists the exact fields returned. It does not mention pagination behavior or rate limits, but the cursor is documented in the schema and the warning about large payloads adds useful safety context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences deliver a wealth of information without fluff. The description is front-loaded with the core purpose, then lists return fields, then covers the key behavioral switch (full_details) and the prerequisite call—every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 14 parameters, no output schema, and no annotations, the description is remarkably complete. It explains the compact summary fields, the alternative raw mode and its size caveat, and the site-resolution prerequisite. Minor gaps include no explicit mention of pagination or how the filters combine, but the schema covers parameters and the cursor field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds high-level grouping of filters ('site, name, health flags or OS') and the crucial instruction to call s1_list_sites for site IDs, but it does not elaborate on parameter syntax or value formats beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('List endpoint agents with filters') and immediately positions it as 'the drill-down tool for machines', clearly distinguishing it from sibling tools like s1_estate_overview. The description further specifies the output fields (computer name, site, OS, status) and the default vs full-details modes, making the tool's purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete guidance to resolve site IDs using s1_list_sites before calling this tool, which is essential for using the site_ids filter correctly. It also implies when to use it (drill-down, compact summaries) versus other estate-level tools, though it does not explicitly list alternative tools or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/jamescash1976/sentinelone-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server