Skip to main content
Glama
Sign In
sentinelone-mcp

sentinelone-mcp

by merabytes
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Get Alerts

get_alerts

Fetch Cloud Detection alerts from SentinelOne Management API. Filter by site IDs or creation date to quickly investigate detected threats.

Instructions

Fetch Cloud Detection alerts from SentinelOne Management API. Optional filters: site_ids (comma-separated), created_after (ISO8601).

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "get_alerts"
  }
}

Input Schema

NameRequiredDescriptionDefault
limitNo
tenantNo
site_idsNo
created_afterNo

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. The verb 'Fetch' reasonably conveys a read-only operation, and the source API is named, which adds context. However, pagination behavior around the limit parameter, the scoping meaning of tenant=null, and any auth prerequisites are never disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler, and the purpose is front-loaded in the first sentence. The second sentence earns its place by adding format details that the schema does not provide. This is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because an output schema exists, return values need no explanation, and this is a simple optional-filter read tool. However, in a 14-tool sibling family with no usage guidance, and with two parameters (limit, tenant) whose semantics are unexplained, the definition is adequate but has clear gaps an agent must guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it partially does: 'comma-separated' for site_ids and 'ISO8601' for created_after are real format semantics beyond the plain 'string' type in the schema. But limit (default 20, any maximum?) and tenant (what does null mean?) are left entirely unexplained, so the compensation is incomplete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Fetch Cloud Detection alerts from SentinelOne Management API.' The resource name 'Cloud Detection alerts' implies differentiation from siblings like get_threats and get_cloud_detection_rules, though the description never makes that distinction explicit. It is clear and specific, but sibling differentiation is implicit rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus its 13 siblings. 'From SentinelOne Management API' provides provenance context but no conditions, exclusions, or routing advice, such as when to prefer get_threats or process_pending_alerts. The agent is left to infer selection entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools