Skip to main content
Glama
deenesjakoruzh
wojtekkura

Purple AI MCP Server

by wojtekkura
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Purple AI MCP Server

Fork of Sentinel-One/purple-mcp with added support for storing the API token in the OS credential store (Windows Credential Manager) instead of plaintext configuration files.

What is Purple AI MCP?

Purple AI MCP is a Model Context Protocol server that connects AI clients (Claude Desktop, Cursor, etc.) to SentinelOne's security platform. It gives AI assistants direct access to:

  • Purple AI — natural language queries against your security data

  • Singularity Data Lake — run and retrieve SDL queries

  • Alerts — list, search, and inspect security alerts

  • Vulnerabilities — query vulnerability findings

  • Misconfigurations — review cloud and Kubernetes misconfigurations

  • Asset Inventory — search and explore your asset inventory

Purple AI MCP is read-only — it cannot make changes to your SentinelOne account.

Related MCP server: Sprinklr MCP Server

Quick Start

Install uv

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Requirements

  • uv installed

  • A SentinelOne Console API token with Account or Site level permissions (not Global)

  • Your SentinelOne console base URL (e.g. https://usea1-008.sentinelone.net)

1. Store your token in Windows Credential Manager

Run this once in PowerShell:

cmdkey /generic:"purple-mcp" /user:"PURPLEMCP_CONSOLE_TOKEN" /pass:"your-token-here"

To verify:

cmdkey /list:"purple-mcp"

To remove:

cmdkey /delete:"purple-mcp"

2. Configure Claude Desktop

Edit %APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "purple-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "purple-mcp @ https://github.com/wojtekkura/purple-mcp/archive/refs/heads/main.tar.gz",
        "purple-mcp",
        "--mode",
        "stdio"
      ],
      "env": {
        "PURPLEMCP_CONSOLE_BASE_URL": "https://your-console.sentinelone.net"
      }
    }
  }
}

Replace https://your-console.sentinelone.net with your actual console URL. The token is read automatically from Windows Credential Manager at startup — no token in the config file.

Restart Claude Desktop after saving the file.

License

MIT — see LICENSE

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Purple AI MCP Server by Sentinel-One

    Purple AI MCP Serverofficial

    Sentinel-One
    A
    license
    B
    quality
    B
    maintenance
    Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
    33
    98
    MIT

  • Sprinklr MCP Server

    daiict218
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants read-only access to Sprinklr data via MCP, allowing querying reports, searching cases, and calling Sprinklr API endpoints.
    7 npm
    ISC

  • mcp-data-server

    dkautomation23
    A
    license
    Not graded
    quality
    B
    maintenance
    Provides read-only, guarded access to business databases via MCP. Enables natural language querying with built-in security barriers like table allowlists, PII masking, and audit logging.
    MIT