ReadBeforeRunAgentic Security Field Guide

Catalog / MCP server

GitGuardian MCP Server

Draft · awaiting review

MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent.

Beta: The package metadata classifies the project as Development Status 4 - Beta. pyproject.toml L23

“Listed detectors through the lab stub with nothing beyond its declaration: network only to the API, no credential reads; it does write bytecode caches into its own environment.” Would we use it again: with limits.

For Dependencies and secrets, Alert triageWorks with Any MCP client, CursorMaintained GitGuardian, last push 2026-10-14

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by GitGuardian · read from the code at 7a75a34 (v0.7.3) on 2026-11-07The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Ran once on 2026-11-07 and did no more than it said.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Network. The repository container image sets the HTTP bind host to all interfaces, so the server listens on every interface, while the stdio default is the loopback address.

    Dockerfile L76 · settings.py L63

  2. Files. Writes the token JSON to the user's configuration directory outside the working directory.

    oauth.py L116 · client.py L307-310

  3. Secrets. Unless scopes are set the OAuth flow requests the full scope list including write scopes, so the server holds a broadly privileged token.

    settings.py L157 · mcp_server.py L385-390

  4. Persistence. Deletes workspace custom tags and other calls change incident state, i.e. target configuration.

    client.py L1452

  5. Approval. Unknown: the server code sets no approval configuration and carries no MCP tool safety annotations; the README only advises reviewing agent actions. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Derived from the code.
  2. Of it, the lab ran stdio with a PAT from the environment and ENABLE_LOCAL_OAUTH=false against a stub of the API (runs/2026-11-07).
  3. Prefer the stdio transport, pass a PAT through the environment and set ENABLE_LOCAL_OAUTH=false, set GITGUARDIAN_SCOPES to a read-only set rather than the default all-scopes, never run the HTTP container bound to 0.0.0.0 without TLS and auth in front, create the PAT with read scopes only, and do not run the HTTP mode with a PAT in the environment.

What we checked, and what we foundDisagree?

MCP server · code showsreach 3 · privileged
23122?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Lets an AI agent scan code for credentials, triage existing secret incidents, generate honeytokens and remediate findings from an IDE or chat client.
  • Lets AI agents scan projects for secrets through the GitGuardian API, manage security incidents and create honeytokens.
Use it when
Not for

Nothing excluded by the author in the files read

You need
  • A GitGuardian workspace (US or EU SaaS, or self-hosted) where a personal access token can be created in the dashboard
  • The code defines scan, incidents:read and sources:read as MINIMAL_SCOPES
  • The ggmcp package requires Python 3.11 or later

+5 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

{ "mcpServers": { "GitGuardian": { "command": "uvx", "args": [ "--from", "git+https://github.com/GitGuardian/ggmcp.git", "gg-mcp-server" ], "env": { "ENABLE_LOCAL_OAUTH": "false", "GITGUARDIAN_PERSONAL_ACCESS_TOKEN": "your_pat_here", "GITGUARDIAN_URL": "https://dashboard.gitguardian.com" } } } }
Quoted from README.md#L161-177 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code; of it, the lab ran stdio with a PAT from the environment and ENABLE_LOCAL_OAUTH=false against a stub of the API (runs/2026-11-07); prefer the stdio transport, pass a PAT through the environment and set ENABLE_LOCAL_OAUTH=false, set GITGUARDIAN_SCOPES to a read-only set rather than the default all-scopes, never run the HTTP container bound to 0.0.0.0 without TLS and auth in front, create the PAT with read scopes only, and do not run the HTTP mode with a PAT in the environment

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 7a75a34 on 2026-10-25: 61 facts, each with its quoted line confirmed by script; see the lab runs below.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Run and written by Ilja Schlak, 2026-11-07. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, sends data out, according to the capabilities read.

GroupWhat it coversEffectOn by default
Repository AnalysisIn local stdio mode find_current_source_id runs git config --get remote.origin.url in the given repository path to identify the repository. find_current_source_id.py L140-148reads, runs commandsyes
Proactive Secret Scanningscan_secrets passes the documents the agent supplies to the GitGuardian API through the client's multiple_scan call and returns the scan results. scan_secret.py L84-85reads, sends data outyes
Incident ManagementLists and filters internal and public incidents, and assigns, resolves, ignores, reopens and tags them. register_tools.py L95-96reads, changesyes
RemediationLocates occurrences with list_remediation_targets, reads the workspace instructions with get_remediation_workflow, and create_code_fix_request opens automated pull requests. register_tools.py L101-103reads, changesyes
Honeytoken Managementgenerate_honeytoken creates an AWS GitGuardian honeytoken with injection recommendations; names must be unique among the workspace's active honeytokens. register_tools.py L220-225reads, changesyes
user information and token managementrevoke_current_token revokes the current API token and cleans up stored credentials. mcp_server.py L267-270reads, changesyes

Where it sends data and who can connect to it

6 outside connections found in the files read: GitGuardian API, GitGuardian /multiscan, mcp.gitguardian.com, Sentry, GitGuardian dashboard login, github.com/GitGuardian/ggmcp.

3 listeners in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

gg-mcp-server picks its transport at start: StreamableHTTP when MCP_PORT is set, otherwise stdio. run.py L52-61

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Container on your machine

Parts inside a container that the tool starts on your machine.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 2README.md L21-22 code-fix automation opens pull requests in the repositories the workspace monitors, writing on the target
  • Network · 3README.md L207 the documented self-hosted container launch binds the StreamableHTTP server to every network interface on port 8000, a declared listener beyond the loopback default
  • Secrets · 1README.md L180 the user creates one personal access token for the server
  • Persistence · 2README.md L18-19 incident management assigns, resolves and tags incidents, which changes workspace state

Code shows: the evidence

  • Files · 2oauth.py L116 writes the token JSON to the user's configuration directory outside the working directory
    client.py L307-310 only in the local OAuth flow, because a personal access token in the environment is used before any token file
  • Network · 3Dockerfile L76 the repository container image sets the HTTP bind host to all interfaces, so the server listens on every interface, while the stdio default is the loopback address
    settings.py L63 outside Docker the HTTP host defaults to 127.0.0.1, and HTTP runs only when MCP_PORT is set
  • Execution · 1find_current_source_id.py L142 runs the fixed program git with fixed arguments in the stdio transport, with no free shell
  • Secrets · 2settings.py L157 unless scopes are set the OAuth flow requests the full scope list including write scopes, so the server holds a broadly privileged token
    mcp_server.py L385-390 with ENABLE_LOCAL_OAUTH=false and a personal access token, as in the quoted install, the server uses that token and runs no OAuth flow
  • Persistence · 2client.py L1452 deletes workspace custom tags and other calls change incident state, i.e. target configuration
  • Approval · ?no evidence: the server code sets no approval configuration and carries no MCP tool safety annotations; the README only advises reviewing agent actions

Valid for commit 7a75a34 (v0.7.3) · checked 2026-11-07 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientAny MCP client, Cursor; sign-in: OAuth 2
AccountA GitGuardian workspace (US or EU SaaS, or self-hosted) where a personal access token can be created in the dashboard. README.md L180-181
CredentialsThe code defines scan, incidents:read and sources:read as MINIMAL_SCOPES. scopes.py L5-9
RuntimeThe ggmcp package requires Python 3.11 or later. pyproject.toml L35
SettingLocal stdio with a PAT sets ENABLE_LOCAL_OAUTH=false and GITGUARDIAN_PERSONAL_ACCESS_TOKEN in the client's env block. README.md L170-173
Authorisationcreate_code_fix_request needs Manager access level and the incidents:write scope. create_code_fix_request.py L115-118
SettingSelf-hosted GitGuardian instances need IS_ON_PREM=true so the server uses the /exposed/v1 API path and the self-hosted scope set. README.md L210-214
OtherClaude Desktop versions that pre-date HTTP MCP support need the local stdio fallback instead of the hosted server. README.md L89-91
SettingFor Claude Desktop on macOS the local stdio configuration needs the absolute path to uvx in the command field, because Claude Desktop does not resolve $PATH for MCP servers. README.md L183-185

What the documented installer does

Lab runs (1) one run is an observation, not a benchmark

Lab run 2026-11-07

Run and written by Ilja Schlak, 2026-11-07 · observation

One run is an observation, not a benchmark.

The lab values hold for exactly this configuration: commit 7a75a34 (v0.7.3), the runtime and the model below.

Setup

Target
Lab stub of the GitGuardian API (fixtures/api-stub, plain HTTP on the lab target) 0.1.0
Model
claude-haiku-5-5 (dated 2026-11-07, direct, global)
Client
Claude Code 2.1.311, mode dontAsk with the lab approver: every tool call asks, the task list below allows, everything else is denied
Access
white-box
Task
Lab measurement task. Use only the tools of the MCP server gitguardian. Call list_detectors once without arguments. Then answer in one sentence what the call returned. Do not call any other tool.
Timebox
6 min
Duration
2:14
Tokens
63,533 in · 71 out
Cost
$0.01 (tool-reported)

Result

Reported
0 findings
Validated
sample of 0: 0 true, 0 false positives
Score
Task done: list_detectors returned the empty list the lab stub serves. Nothing to score: this run measures reach, not detection.
Scope violations
none
Notes
ggmcp reads its token's scopes from the API's /api_tokens/self to decide which tools to offer (packages/gg_api_core/src/gg_api_core/mcp_server.py line 225 at the pinned commit). The lab points GITGUARDIAN_URL at its own stub of the API, which reports a token with only the scan scope (tool-cmd.sh). The server made three requests, all to the stub: two token look-ups and one detector list (target-access.txt lines 3 to 5). While it ran, the beartype library it depends on wrote 30 bytecode cache files with its own optimization tag into the tool's virtual environment, outside the working directory (fs-diff.json); that is what files 2 and persistence 1 read here, and nothing else was written. No credential store was read, and the runner made no DNS query and no connection outside the lab. The install took the 70 locked packages with their hashes from the workspace's uv.lock through the lab proxy and built the two workspace packages from the pinned tree.

What it did, per right

  • Files · 2 writes outside the projectfs-diff.json#L1 write outside /home/tool/work: /home/tool/.local/ggmcp-venv/lib/python3.13/site-packages/beartype/_util/os/__pycache__/utilostty.cpython-313.opt-beartype0v22v9.pyc{
  • Network · 1 talks only to declared hoststarget-access.txt#L3-5 connection to the declared target (run->tgt)2026-11-07T18:04:56+00:00 10.73.2.10 GET path=/exposed/v1/api_tokens/self status=200 route=token-self2026-11-07T18:04:56+00:00 10.73.2.10 GET path=/exposed/v1/api_tokens/self status=200 route=token-self2026-11-07T18:04:58+00:00 10.73.2.10 GET path=/exposed/v1/secret_detectors status=200 route=secret-detectors
  • Execution · 0 runs no programsnone found: no execve besides the tool itself (tool start host-events.jsonl#L3: python3); harness starts L1, L2 (timeout, start wrapper, preparation) are not counted for the tool
  • Secrets · 0 touches no credentialsnone found: no reads of the watched credential stores (auditd cred/cred_sys/cred_agent: SSH, cloud CLIs, Kubernetes, GnuPG, browser profiles, Docker, netrc, npmrc, pypirc, agent tokens, /etc/shadow, sudoers); no canary in egress.jsonl; no canary in DNS names (dns.jsonl); canary files planted for this run (AWS credentials, netrc, npmrc; offline before the start); environment variables are not observable
  • Persistence · 1 leaves cache or temp filesfs-diff.json#L1 30 file(s) written outside /home/tool/work stay after the run (first: /home/tool/.local/ggmcp-venv/lib/python3.13/site-packages/beartype/_util/os/__pycache__/utilostty.cpython-313.opt-beartype0v22v9.pyc): caches or temp files outside the working directory{
  • Approval · 0 asks each timenone found: no pre-approvals brought by the tool and no bypass: each of the 1 actions produced an event in the lab approver (1 allowed by the task list, 0 denied; hitl-events.jsonl), 1 executions, all approved; no tool output in session.txt asks for an auto mode or a bypass

Lab verdict

Within declared on every right the lab could observe.

Fit
fits (our judgement whether the reach fits the task)
Use again
with limits
In one sentence
Listed detectors through the lab stub with nothing beyond its declaration: network only to the API, no credential reads; it does write bytecode caches into its own environment.
Limits
Measured once against a lab stub of the GitGuardian API with a dummy token that grants only the scan scope, calling one read-only tool; incident, honeytoken and remediation tools, the HTTP mode and real workspace data were not run. Use it as measured: stdio, a personal access token with read scopes from the environment and ENABLE_LOCAL_OAUTH=false, because the default starts a browser OAuth flow and asks for all scopes. Its beartype dependency writes bytecode caches into the tool's virtual environment while it runs.

Tested minimal configuration

claude code
claude -p with model claude-haiku-5-5, MCP server over stdio (gitguardian: $HOME/.local/ggmcp-venv/bin/gg-mcp-server); no other tools allowed by the task list

Incidents

0 real-time alerts · run not aborted

Recording

The player loads only on request and needs JavaScript. Without it: session.cast (asciicast v3) and the plain textsession.txt.

Plain-text transcript
[+    0.6s] system ui_invalidate {"event": "ui.render"}
[+    1.5s] system init model=claude-haiku-5-5 permissionMode=dontAsk apiKeySource=none mcp=gitguardian:connected tools=29 version=2.1.311
[+    3.2s] assistant tool_use mcp__gitguardian__list_detectors id=toolu_01ETtYzw5sVsB4LAwrDYJZN5 input={}
[+    3.2s] rate_limit_event status=allowed
[+    3.2s] user tool_result id=toolu_01ETtYzw5sVsB4LAwrDYJZN5 error=false: {"detectors":[],"next_cursor":null,"has_more":false}
[+    4.5s] assistant text The list_detectors call returned an empty result: no detectors, no next cursor, and no further pages.
[+    4.5s] result success is_error=false turns=2 cost_usd=0.006718130000000001 denials=0
Artifacts with SHA-256 (16 files)
  • blocked.jsonle3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • cost.jsona0361ae3b35c37b24461afde0a9fa433d12ccf78846ba2e7940a5f15a0eb5fe4
  • declared.json221b6494b9398b21f4fe0f2018131eec158e65deacc8aec06d50bc2c76068581
  • dns.jsonl5a9d3f9f009d806d27700861080328beb3cdce46e5873e641fa93e1adf19f34f
  • egress.jsonl8218c15b4a32e9ba2650583794eaa03f525a56343fd539ff95cbe3312ad13cea
  • findings.jsonle3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • fs-diff.jsonf54e6ba925b8ae925a8446eecd7ce5816d414e4cde8fb1606a9fe91388d2e794
  • gateway-sets.txtc4da9ef400e835150075596c3c302b3875c13c176e18b16c50872f420e59d4e0
  • hitl-events.jsonl571e2748e9ed1609e6da93f382f075a46c5c8baddf66ca742629e96dbf41d632
  • host-events.jsonld50d1e5d8872eb1ba8f2cf8f4a10ed1284d90b5142a66931f32c7dcdad1dafa9
  • install-egress.jsonle4d3aa05c1c86750169dfb209c8a9fbc9dd5c15b42000a8628d09065d0977c34
  • score.json769a09e8a18fdead445ec93d5ae30463569d06c3fb668c894dc3844f66a215fb
  • session.caste9885c887e24706ac2222db2434bc9d44c7995f7aae7d02fa49921307942d20c
  • session.txtab738f80e998841d4287fc2dd5e7b68cfc4b94b344ccff30f72e0b04d4c7d088
  • target-access.txtcc665947e05de23ad1a46fe150d65e9dea3d52142b3f2c7ac57828b035d0999d
  • tool-cmd.sh2084c491887817a2ca3e61e2b732858537d3256cd70218a8aea28a1cc8510f45
  • manifest.jsonlists the hashes above

Secret scan: not run: not installed on the lab host; the scan above instead (2026-11-07); gateway-sets.txt: lines 1-11 only: the allow sets run_allow and run_tgt at run time; the rest of the gateway ruleset is not published; scan of all published files by analysis/export-package.py for this run's canary values, bait texts, key patterns and host identifiers: no hits. Not published: allowlist-driver.txt, allowlist.txt, approver-policy.json, diff/driver.json, diff/gateway.json, diff/runner.json, diff/target.json, dns-servers.txt, pcap/labctl0.pcap, pcap/labrun0.pcap, pcap/labtgt0.pcap, pcap/labwan0.pcap, preflight.json, preflight.log, profile.yaml, proxy-policy.json, raw/allowlist-all.txt, raw/canaries.txt, raw/cred-inventory-after.csv, raw/cred-inventory-before.csv, raw/driver.xml, raw/fs-diff-raw.csv, raw/install-lock.json, raw/install-pip-freeze.txt, raw/install-source-tree.json, raw/mcp_ed25519, raw/mcp_ed25519.pub, raw/model-drive.log, raw/model-in/budget_usd, raw/model-in/max_turns, raw/model-in/mcp.json, raw/model-in/model, raw/model-in/route, raw/model-in/task.txt, raw/model-in/timebox, raw/model/claude-version.txt, raw/model/end, raw/model/end_epoch, raw/model/rc, raw/model/start, raw/model/start_epoch, raw/model/stderr.txt, raw/model/stream.tsjsonl, raw/phase-times.txt, raw/runner-audit.log, raw/runner-tmp-fstype.txt, raw/seed/aws-credentials, raw/seed/netrc, raw/seed/npmrc, raw/session.jsonl, raw/tool-status.json, sensors/dns.log, sensors/egress.flows, sensors/gw-sets.txt, sensors/install-dns.log, sensors/install-fs-diff.json, target-url.txt, task.txt.

Interests. Private project, privately funded. The author is employed by an IT consultancy; the company is neither client nor sponsor of this measurement and had no influence on selection, execution or result. No business relationship with the maintainers of the tested tool; no credits, licences or payments accepted from tested vendors. Deviations are stated in this field.

Right of reply: dispute process. Replications: none yet.

About this entry

Source
github.com/GitGuardian/ggmcp · MIT · manifest server.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
7a75a34 · v0.7.3 · last upstream push 2026-10-14 · no release since the pinned commit (current v0.7.3)
In the catalog
tried · added 2026-10-19 · last checked 2026-11-07 · next check 2027-05-06 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
1 change to published values, the last on 2026-11-07: see Changes
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 7a75a34, each with one evidence line. A “?” means no evidence, never zero; zero never means safe. The lab run shows what happened in exactly one configuration; it is a lower bound, not a benchmark.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 7a75a34 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (61 of 61), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "GitGuardian MCP Server". Agentic Security Field Guide, checked 2026-11-07, method reach-v0.1. https://readbeforerun.ai/catalog/gitguardian-ggmcp/

The method · the rules

For maintainers

Badge for your README (reach 3 · as declared):

[![reach 3 · as declared](https://readbeforerun.ai/badge/gitguardian-ggmcp.svg)](https://readbeforerun.ai/catalog/gitguardian-ggmcp/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Dependencies and secrets, Alert triage. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 11032?
    Google Security Operations MCP ServerMCP server · by google · reach 3, privilegedDraft · awaiting review

    MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

    Can read credential stores · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  3. 13023?
    Purple AI MCP ServerMCP server · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

    Can tunnel or exfiltrate · add autostart, users or keys · read broad tokens or the environment · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  4. 21122?
    SentinelOne MCP Server (s1-secops-mcp)MCP server · by Sentinel-One · reach ≥2, openDraft · awaiting review

    Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

    Can write outside the project · read broad tokens or the environment · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  5. 23223?
    SentinelOne AI Analyst: Claude SkillsPlugin · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

    Can tunnel or exfiltrate · add autostart, users or keys · write outside the project · +2 more · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows