c0tton-fluff/sentinelone-mcp-server

7 stars 6 forks Quality 66 Trend 19MIT

MCP server for SentinelOne Core + Deep Visibility APIs

Overview

A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts -- all from natural language. Stdlib-only Go binary. No runtime requirements. Just copy and run. S1 Console > Profile (top right) > > Actions > > At least one of name or agentName is required. MCP logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-sentinelone/

README

SentinelOne MCP Server

A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts – all from natural language.

Zero dependencies. Stdlib-only Go binary. No runtime requirements. Just copy and run.

Quick Start

1. Build

git clone https://github.com/c0tton-fluff/sentinelone-mcp-server.git
cd sentinelone-mcp-server
go build -o sentinelone-mcp-server .

2. Get your API token

S1 Console > Profile (top right) > My Profile > Actions > API token operations > Regenerate API token

3. Configure your MCP client

Add to ~/.mcp.json:

{
  "mcpServers": {
    "sentinelone": {
      "command": "/path/to/sentinelone-mcp-server",
      "env": {
        "SENTINELONE_API_KEY": "your_api_token_here",
        "SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
      }
    }
  }
}

4. Go

"List all unmitigated threats"
"Investigate threat 1234567890"
"Show infected agents"
"Hunt for PowerShell processes in the last 24 hours"
"What's the reputation of this SHA256?"
"Create an exclusion for /opt/myapp on Linux"
"What applications are installed on Benedict's laptop?"

Tools (21)

Threats

Tool	What it does
`s1_list_threats`	List threats with classification, status, and endpoint filters
`s1_get_threat`	Full threat details – hashes, file path, storyline
`s1_mitigate_threat`	Kill, quarantine, un-quarantine, remediate, or rollback
`s1_investigate_threat`	One-call investigation: threat + correlated alerts + timeline
`s1_set_analyst_verdict`	Set verdict: true_positive, false_positive, suspicious, undefined
`s1_set_incident_status`	Set status (with optional verdict in the same call)

Agents

Tool	What it does
`s1_list_agents`	List agents with OS, status, infection filters, and count-by grouping
`s1_get_agent`	Agent details – version, site, network info, account ID
`s1_isolate_agent`	Network isolate an endpoint (maintains S1 comms)
`s1_reconnect_agent`	Remove network isolation

Alerts

Tool	What it does
`s1_list_alerts`	Query unified alerts via GraphQL with severity, verdict, and status filters
`s1_set_alert_verdict`	Bulk set analyst verdict on matching alerts
`s1_set_alert_status`	Bulk set incident status (with optional verdict)

Deep Visibility

Tool	What it does
`s1_dv_query`	Run a threat hunting query with automatic polling
`s1_dv_get_events`	Retrieve events from a completed query

Intelligence

Tool	What it does
`s1_hash_reputation`	Hash verdict + fleet-wide hunt via Deep Visibility

Exclusions

Tool	What it does
`s1_list_exclusions`	List exclusions (path, hash, certificate, browser, file type)
`s1_create_exclusion`	Create an exclusion to suppress false-positive detections
`s1_delete_exclusion`	Delete exclusions by ID

STAR Rules

Tool	What it does
`s1_create_star_rule`	Create a custom detection rule from a Deep Visibility query

Applications

Tool	What it does
`s1_list_applications`	List installed software on endpoints by name or computer

Troubleshooting

Error	Fix
Configuration error	Ensure `SENTINELONE_API_KEY` and `SENTINELONE_API_BASE` are set
API_BASE must be HTTPS	Use `https://` not `http://` for your tenant URL
HTTP 401	API token expired or invalid – regenerate in S1 console
HTTP 403	Token lacks permissions for this endpoint
HTTP 429	Rate limited – server retries automatically with backoff
Request timeout	S1 API took >30s – narrow your query filters
Tools not appearing	Verify binary path in `~/.mcp.json`, restart your MCP client

MCP logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-sentinelone/

License

MIT

View the full README on GitHub

Install

This server does not publish a one-line install command.

Open the repository installation guide New to MCP? Start with the mcpskill.org guide →

Configuration

{
  "mcpServers": {
    "sentinelone": {
      "command": "/path/to/sentinelone-mcp-server",
      "env": {
        "SENTINELONE_API_KEY": "your_api_token_here",
        "SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
      }
    }
  }
}