Skip to main content
Glama
merabytes

sentinelone-mcp

by merabytes
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to sentinelone-mcp

No user-submitted related servers found.

    Related Servers

    • Purple AI MCP Server

      vamsitejeswar
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables interaction with SentinelOne's security platform, including Purple AI, events, alerts, vulnerabilities, and asset inventory, through MCP.
      MIT
    • Purple AI MCP Server by Sentinel-One

      Purple AI MCP Serverofficial

      Sentinel-One
      A
      license
      B
      quality
      C
      maintenance
      Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
      33
      98
      MIT

    • soc-siem-mcp

      JoaquinHernandez
      A
      license
      Not graded
      quality
      B
      maintenance
      Unified SIEM MCP gateway for AI-driven SOC operations and threat hunting across Azure Sentinel, Splunk, Wazuh, IBM QRadar, and Securonix.
      MIT

    • SSH Vault MCP

      qsobad
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables AI agents to securely access encrypted secrets (SSH keys, API tokens, passwords) with real-time user approval via Passkey, and supports SSH remote execution through the MCP protocol.
      -

    • Response MCP Server

      markolauren
      F
      license
      Not graded
      quality
      D
      maintenance
      Enables agentic SecOps by executing Microsoft Defender XDR response actions (device isolation, antivirus scans, forensic collection, incident management) through natural language with orchestrators like GitHub Copilot.
      21
      -
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.4/5.0

    Scored across 14 tools

    Disambiguation3/5

    Core resources (tenants, rules, Purple AI) are distinct, but several tools overlap in intent: get_threats vs get_unresolved_threats are near-duplicates, and get_storyline_events, run_dv_query, and xdr_query all offer event querying with only backend/scope differences. Descriptions help, but an agent could easily pick the wrong one without careful reading.

    Naming Consistency4/5

    Most tools follow a readable snake_case verb_noun pattern like get_threats, list_tenants, and mark_threat_resolved. There are minor deviations: run_dv_query and xdr_query both represent query actions but use different forms, and purple_ai_query/reset are not strictly verb-first. Overall the pattern is consistent enough to be predictable.

    Tool Count4/5

    14 tools is reasonable for a security operations server covering threats, alerts, Deep Visibility/XDR queries, tenants, and Purple AI. The count is slightly high because some event-query tools could be consolidated, but each tool still represents a plausible capability.

    Completeness4/5

    The set covers the main incident triage flow well: list unresolved threats, get threat context, query related events, and mark resolved. Minor gaps exist around cloud-detection rule management and alert status updates, but core investigative and response workflows are present.

    Maintenance

    ActivityMaintained
    ResponsivenessNo issues

    Resources