MCP Defender (mcp-msdefenderkql)
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AZURE_CLIENT_ID | Yes | Azure AD client ID | |
| AZURE_TENANT_ID | Yes | Azure AD tenant ID | |
| AZURE_CLIENT_SECRET | No | Azure AD client secret | |
| AZURE_CLIENT_CERTIFICATE_PATH | No | Path to combined certificate file (private key + certificate) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| run_hunting_queryA | Execute a KQL (Kusto Query Language) query against Microsoft Defender Advanced Hunting. Use this to investigate security events across endpoints, email, identity, and cloud apps. Always call get_hunting_schema first to understand available tables and columns. |
| get_hunting_schemaA | Get the Advanced Hunting schema with available tables and columns. Call this before writing queries to understand what data is available. Returns table names, column names, and data types. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: one for exploring the schema and one for executing queries. No overlap or ambiguity exists.
Both tools follow a consistent verb_noun pattern ('get_hunting_schema' and 'run_hunting_query'), making them predictable and easy to understand.
With only 2 tools, the server feels minimal. While it covers the core workflow (schema discovery + query execution), additional tools for result handling or query management could enhance the set.
The tools cover the basic hunting loop (schema first, then query), but missing features like saving queries, paginating results, or managing sessions leave notable gaps for a security investigation tool.