sentinelone-mcp
sentinelone-mcp
Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.
Why
purple-mcp is a great first-party MCP server, but it reads its SentinelOne console token + URL from environment variables at process startup, which makes it single-tenant per container. Our gateway is multi-tenant: every request carries the calling org's credentials as HTTP headers, and the vendor container has to translate those headers into something the upstream understands.
This image bundles purple-mcp plus a small Node/Fastify proxy. The proxy:
Listens on
:8080withPOST /mcpandGET /health.Reads
x-purplemcp-tokenandx-purplemcp-base-urlfrom each incoming request.Lazily spawns one
purple-mcp --mode streamable-httpchild per(token, base-url)tenant on a private loopback port, with the right env vars set.Proxies the request body to that child and streams the response back.
Evicts idle children after 60 minutes (
IDLE_EVICT_MS).
The result is a single container that the gateway can talk to like any other vendor MCP server.
Related MCP server: Levitate
Configuration
Env var | Default | Notes |
|
| Public listen port. |
|
| Where purple-mcp source + venv live. |
|
| Python interpreter from the upstream venv. |
|
| Idle tenant timeout (60 min). Longer keeps children warm and avoids repeated cold starts. |
|
| How long to wait for a child to start serving HTTP. |
|
| Fastify log level. |
Request headers
The gateway must forward these headers on every /mcp request:
Header | SentinelOne credential |
|
|
|
|
Build
docker build -t ghcr.io/wyre-technology/sentinelone-mcp:latest .License
Apache-2.0. The bundled purple-mcp is MIT-licensed by SentinelOne.
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- Alicense-qualityCmaintenanceMCP server for AI agent security guardrails. Provides input validation, prompt injection detection, PII redaction, output filtering, policy enforcement, rate limiting, and comprehensive audit logging.Last updated501MIT
- Alicense-qualityCmaintenanceLifts local stdio MCP servers into remote Streamable HTTP endpoints for cloud-hosted AI clients, with bearer-token auth and tool policy filtering.Last updated16MIT
- Alicense-qualityCmaintenanceEnables interaction with SentinelOne's security platform, including Purple AI, events, alerts, vulnerabilities, and asset inventory, through MCP.Last updatedMIT
- Alicense-qualityCmaintenanceAn MCP server that wraps the taegis-magic CLI to allow AI assistants to query Secureworks Taegis XDR for alerts, events, investigations, threat intelligence, and tenants via natural language.Last updatedMIT
Related MCP Connectors
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
AI Reasoning Cache & Consensus Layer with 11 MCP tools via Streamable HTTP.
Agent Cost Allocator MCP — multi-tenant LLM cost attribution for chargeback billing. Companion to
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/wyre-technology/sentinelone-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server