Sentinel Solutions MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_GITHUB_TOKEN | No | Optional GitHub personal access token used to avoid rate limits when querying live repositories or to access private repositories. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_solutionsB | Run full analysis on all Microsoft Sentinel solutions, extracting connector-table mappings |
| get_connector_tablesB | Get table mappings for a specific connector ID |
| search_solutionsB | Search solutions by name, publisher, or keyword |
| get_solution_detailsA | Get detailed information about a specific solution (fast - only analyzes requested solution) |
| list_tablesB | Get all unique tables across all solutions |
| validate_connectorC | Validate a connector JSON definition and extract tables |
| list_detectionsA | List and filter Microsoft Sentinel detection rules (analytics) - search by solution, severity, tactic, technique, name, query content, or file path. Returns max 100 results by default. |
| get_detection_detailsB | Get detailed information about a specific detection rule |
| list_workbooksA | List and filter Microsoft Sentinel workbooks - search by solution, category, name, or file path. Returns max 100 results by default. |
| get_workbook_detailsC | Get detailed information about a specific workbook |
| list_hunting_queriesB | List and filter Microsoft Sentinel hunting queries - search by solution, tactic, technique, name, query content, or file path. Returns max 100 results by default. |
| list_playbooksC | List Microsoft Sentinel playbooks (Logic Apps) - search by solution, name, or file path. Returns max 100 results by default. |
| list_parsersB | List Microsoft Sentinel parsers (KQL functions) - search by solution, name, query content, or file path. Returns max 100 results by default. |
| list_watchlistsB | List Microsoft Sentinel watchlists - search by solution, name, or file path. Returns max 100 results by default. |
| list_notebooksC | List Microsoft Sentinel Jupyter notebooks - search by solution, name, or file path. Returns max 100 results by default. |
| list_exploration_queriesC | List Microsoft Sentinel exploration queries - search by solution, name, query content, or file path. Returns max 100 results by default. |
| list_functionsC | List Microsoft Sentinel saved functions - search by solution, name, query content, or file path. Returns max 100 results by default. |
| list_asim_contentB | List Microsoft Sentinel ASIM (Advanced Security Information Model) content - search by type, name, or file path. Returns max 100 results by default. |
| list_summary_rulesB | List Microsoft Sentinel summary rules - search by solution, name, query content, or file path. Returns max 100 results by default. |
| list_toolsC | List Microsoft Sentinel tools and utilities - search by category, name, or file path. Returns max 100 results by default. |
| list_tutorialsB | List Microsoft Sentinel tutorials and learning resources - search by name or file path. Returns max 100 results by default. |
| list_dashboardsC | List Microsoft Sentinel dashboards - search by solution, name, or file path. Returns max 100 results by default. |
| list_data_connectorsB | List Microsoft Sentinel data connectors - search by connector type, name, or file path. Returns max 100 results by default. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 23 tools
Each tool targets a distinct type of Microsoft Sentinel resource (e.g., solutions, connectors, detections, workbooks, etc.) with clear descriptions. The many list_* tools are differentiated by the specific content type they handle, preventing confusion.
All tools follow a consistent verb_noun pattern in snake_case (e.g., list_detections, get_solution_details, analyze_solutions). No mixing of styles or ambiguous verbs, making the naming predictable.
With 23 tools, the count is slightly above the typical 3-15 range but justified by the broad domain of Microsoft Sentinel. Each tool serves a distinct purpose, and the number is not excessive for the scope covered.
The tool set provides comprehensive read and analysis capabilities for Sentinel solutions, including listing, getting details, searching, and validating. For the stated purpose of analyzing solutions, it covers all necessary operations without obvious gaps.