c0tton-fluff/sentinelone-mcp-server

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

7 stars 6 forks 质量 66 趋势 19MIT

Repository Install

MCP server for SentinelOne Core + Deep Visibility APIs

概览

A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts -- all from natural language. Stdlib-only Go binary. No runtime requirements. Just copy and run. S1 Console > Profile (top right) > > Actions > > At least one of name or agentName is required. MCP logs: ~/.cache/claude-cli-nodejs/*/mcp-logs-sentinelone/

README

以下为原文 README 节选，完整内容请查看原文。

SentinelOne MCP Server

A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts – all from natural language.

Zero dependencies. Stdlib-only Go binary. No runtime requirements. Just copy and run.

Quick Start

1. Build

git clone https://github.com/c0tton-fluff/sentinelone-mcp-server.git
cd sentinelone-mcp-server
go build -o sentinelone-mcp-server .

2. Get your API token

S1 Console > Profile (top right) > My Profile > Actions > API token operations > Regenerate API token

3. Configure your MCP client

Add to ~/.mcp.json:

{
  "mcpServers": {
    "sentinelone": {
      "command": "/path/to/sentinelone-mcp-server",
      "env": {
        "SENTINELONE_API_KEY": "your_api_token_here",
        "SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
      }
    }
  }
}

4. Go

"List all unmitigated threats"
"Investigate threat 1234567890"
"Show infected agents"
"Hunt for PowerShell processes in the last 24 hours"
"What's the reputation of this SHA256?"
"Create an exclusion for /opt/myapp on Linux"
"What applications are installed on Benedict's laptop?"

Tools (21)

Threats

Tool	What it does
`s1_list_threats`	List threats with classification, status, and endpoint filters
`s1_get_threat`	Full threat details – hashes, file path, storyline
`s1_mitigate_threat`	Kill, quarantine, un-quarantine, remediate, or rollback
`s1_investigate_threat`	One-call investigation: threat + correlated alerts + timeline
`s1_set_analyst_verdict`	Set verdict: true_positive, false_positive, suspicious, undefined
`s1_set_incident_status`	Set status (with optional verdict in the same call)

Agents

Tool	What it does
`s1_list_agents`	List agents with OS, status, infection filters, and count-by grouping
`s1_get_agent`	Agent details – version, site, network info, account ID
`s1_isolate_agent`	Network isolate an endpoint (maintains S1 comms)
`s1_reconnect_agent`	Remove network isolation

Alerts

Tool	What it does
`s1_list_alerts`	Query unified alerts via GraphQL with severity, verdict, and status filters
`s1_set_alert_verdict`	Bulk set analyst verdict on matching alerts
`s1_set_alert_status`	Bulk set incident status (with optional verdict)

Deep Visibility

Tool	What it does

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "sentinelone": {
      "command": "/path/to/sentinelone-mcp-server",
      "env": {
        "SENTINELONE_API_KEY": "your_api_token_here",
        "SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
      }
    }
  }
}