menkw/defender-mcp

本页由 AI 翻译，技术细节请以原文为准。查看原文

10 stars 4 forks 质量 70 趋势 18MIT

MCP server for Microsoft Defender XDR — incidents, alerts, machines, advanced hunting, and threat intelligence for AI assistants

概览

A for Microsoft Defender XDR and Microsoft Defender for Endpoint. Enables AI assistants (Claude, Kilo, etc.) to interact with your security environment using natural language — investigating incidents, hunting threats, managing devices, and querying vulnerabilities. - across 9 security categories - — separate Azure AD tokens for the MTP API (api.security.microsoft.com) and the WDATP API (api.securitycenter.microsoft.com) - — query endpoint, identity, email, and cloud app data in a single KQL query - — list, get, update incidents with full alert and evidence detail - — isolate machines, run AV scans, collect investigation packages, execute live response - — create, import, and manage IOC indicators (file hashes, IPs, domains, URLs) - — CVE lookup, software inventory, security recommendations, remediation tracking - 18.0.0 or higher - (Microsoft Entra ID) with the following API permissions granted as permissions (not delegated): - AdvancedHunting.Read.All - Incident.Read.

README

以下为原文 README 节选，完整内容请查看原文。

Defender-MCP

A Model Context Protocol (MCP) server for Microsoft Defender XDR and Microsoft Defender for Endpoint. Enables AI assistants (Claude, Kilo, etc.) to interact with your security environment using natural language — investigating incidents, hunting threats, managing devices, and querying vulnerabilities.

Features

~45 tools across 9 security categories
Dual-token authentication — separate Azure AD tokens for the MTP API (api.security.microsoft.com) and the WDATP API (api.securitycenter.microsoft.com)
XDR cross-workload hunting — query endpoint, identity, email, and cloud app data in a single KQL query
Incident management — list, get, update incidents with full alert and evidence detail
Device response actions — isolate machines, run AV scans, collect investigation packages, execute live response
Threat intelligence — create, import, and manage IOC indicators (file hashes, IPs, domains, URLs)
Vulnerability management — CVE lookup, software inventory, security recommendations, remediation tracking

Tool Categories

Category	Tools	Description
Incidents	4	List, get, get alerts, update incidents
Alerts	5	List, get, update, batch-update, create alerts
Machines	16	Get devices, isolate, AV scan, restrict code execution, live response
Advanced Hunting	2	WDATP KQL query + XDR cross-workload KQL query
Entities	11	File hashes, domains, IPs, user alerts and machines
Indicators (IoC)	5	Get, create, import, delete threat indicators
Machine Actions	12	Investigation packages, live response, automated investigations
Scoring	5	Exposure score, secure score, AV health, device health
Vulnerabilities	17	CVEs, software inventory, recommendations, remediation activities

Prerequisites

Node.js 18.0.0 or higher
Azure AD App Registration (Microsoft Entra ID) with the following API permissions granted as Application permissions (not delegated):

Required API Permissions

api.security.microsoft.com (Microsoft Threat Protection):

AdvancedHunting.Read.All
Incident.Read.All
Incident.ReadWrite.All

WindowsDefenderATP (Microsoft Defender for Endpoint):

Alert.Read.All
Alert.ReadWrite.All
Machine.Read.All
Machine.ReadWrite.All
Machine.Isolate
Machine.LiveResponse
Machine.Scan
Ti.Read.All
Ti.ReadWrite.All
Vulnerability.Read.All
Software.Read.All
Score.Read.All
SecurityRecommendation.Read.All

Important: All permissions must be Application type and require admin consent.

Setup

Clone the repository:

git clone https://github.com/MenkW/Defender-MCP.git
cd Defender-MCP

Install dependencies:
```
npm install
```
Configure credentials:
```
cp .env.example .env
```
Edit .env and fill in your Azure AD app registration details:

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "defender": {
      "command": "node",
      "args": ["C:/path/to/Defender-MCP/dist/index.js"],
      "env": {
        "DEFENDER_TENANT_ID": "your-tenant-id",
        "DEFENDER_CLIENT_ID": "your-client-id",
        "DEFENDER_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}