ReadBeforeRunAgentic Security Field Guide

Catalog / MCP server

Purple AI MCP Server

Draft · awaiting review

Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

Beta: The package classifier declares Development Status 4 - Beta. pyproject.toml L19

For Alert triage, Threat intel enrichmentWorks with Any MCP client, Claude Code, CodexMaintained Sentinel-One, last push 2026-09-22

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by Sentinel-One · read from the code at 07d4992 (v0.7.0) on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Network. The image entrypoint adds --allow-remote-access by itself while MCP_HOST defaults to 0.0.0.0, so the SSE and HTTP modes listen on all interfaces without authentication of their own.

    docker-entrypoint.sh L35 · cli.py L325-331

  2. Persistence. The optional compose deployment runs the server and its proxy as services that restart automatically with the Docker daemon.

    docker-compose.yml L25

  3. Secrets. Several named tokens are read from environment variables: the console token, an optional VirusTotal key and an optional Logfire token.

    config.py L56-58

  4. Approval. Unknown: no approval settings were found, and the two lines the search patterns match are error messages about token permissions. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Run over stdio, or bind the HTTP modes to localhost behind an authenticating proxy, use an Account- or Site-scoped token, and leave the VirusTotal and Logfire keys unset unless needed.

What we checked, and what we foundDisagree?

MCP server · code showsreach 3 · privileged
13023?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Exposes the SentinelOne platform to AI clients through the Model Context Protocol.
  • Lets an analyst ask security questions and investigate threats through SentinelOne Purple AI.
  • Answers questions about endpoints, cloud resources, identities and network devices in the SentinelOne asset inventory.
Use it when
  • Investigate and triage SentinelOne alerts, including their notes, history and auto-investigation reports Alert triage
  • Enrich indicators of compromise with VirusTotal data for hashes, URLs, domains and IPs Threat intel enrichment
  • Generate PowerQueries with Purple AI for threat hunting and run them against the data lake Detection engineering
  • Track CVEs and vulnerability findings recorded in the SentinelOne console Vulnerability prioritization
Not for
  • The author describes the server as read-only: it is not meant to change the account or any objects in it.
  • The purple_ai tool description states that Purple AI cannot modify configurations or interact with endpoints directly.
You need
  • Needs a SentinelOne account to obtain the console token
  • Needs a console or Service User token with Account or Site scope, not Global, set as PURPLEMCP_CONSOLE_TOKEN
  • Needs PURPLEMCP_CONSOLE_BASE_URL set to the HTTPS console URL

+3 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

uvx --from git+https://github.com/Sentinel-One/purple-mcp.git purple-mcp --mode=stdio
Quoted from README.md#L42 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; run over stdio, or bind the HTTP modes to localhost behind an authenticating proxy, use an Account- or Site-scoped token, and leave the VirusTotal and Logfire keys unset unless needed

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 07d4992 on 2026-10-25: 64 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

No changing, deleting or command-running capability among the groups read.

GroupWhat it coversEffectOn by default
Purple AIpurple_ai sends a natural-language security question to SentinelOne Purple AI and returns its answer, which can include a generated PowerQuery. server.py L142readsyes
Data Lakepowerquery runs a PowerQuery over Singularity Data Lake events for a start and end time; get_timestamp_range builds the time range. README.md L226readsyes
Alertsget_alert, list_alerts, search_alerts, get_alert_notes, get_alert_history and get_alert_investigation_report read alerts, notes, timelines and auto-investigation reports. server.py L146-151readsyes
Vulnerabilitiesget, list and search vulnerabilities and read their notes and history from the console's XSPM vulnerability findings. README.md L238-242readsyes
Misconfigurationsget, list and search misconfigurations and read their notes and history from the console's XSPM misconfiguration findings. README.md L246-250readsyes
Asset Inventoryget_inventory_item, list_inventory_items and search_inventory_items read assets by surface type, with fetch_fields presets MINIMAL, STANDARD or ALL. README.md L254-256readsyes
CVE Search (External)cve_search_by_id, cve_search_by_vendor and cve_database_status query the public CIRCL cve-search service without an API key. README.md L267-271readsyes
Threat Intelligence (External)Seven threat_intel_* tools look up file hashes, URLs, domains and IPs, file relationships, sandbox behaviour and Intelligence search on VirusTotal. README.md L277-286readsno, optional
purple_utilsiso_to_unix_timestamp converts ISO 8601 datetimes to UNIX milliseconds for the date filters of the search tools. server.py L144-145guides only: asks, explains or decides, acts on nothing itselfyes

Where it sends data and who can connect to it

7 outside connections found in the files read: SentinelOne console, SentinelOne Purple AI, Singularity Data Lake API, cve.circl.lu, VirusTotal, Pydantic Logfire, GitHub Sentinel-One/purple-mcp.

3 listeners in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

A Python FastMCP server (purple-mcp) runs on the user's machine over stdio, or over SSE or streamable HTTP via uvicorn; its tools call SentinelOne console GraphQL/REST and SDL APIs over HTTPS, plus cve.circl.lu and VirusTotal. server.py L139

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 0README.md L26 the author declares a read-only service that cannot change the account or any of its objects
  • Network · 3DOCKER.md L72 the documented Docker default binds the SSE and HTTP modes to all interfaces, which declares a network listener
  • Secrets · 2README.md L288 the author declares a VirusTotal API key in addition to the required console token, so several tokens

Code shows: the evidence

  • Files · 1docker-compose.yml L111 the optional proxy service mounts the project's ssl directory with certificate and key into the nginx container, read-only
  • Network · 3docker-entrypoint.sh L35 the image entrypoint adds --allow-remote-access by itself while MCP_HOST defaults to 0.0.0.0, so the SSE and HTTP modes listen on all interfaces without authentication of their own
    cli.py L325-331 outside Docker stdio is the default mode, and the HTTP modes refuse non-loopback hosts unless --allow-remote-access is given
  • Execution · 0none found: patterns exec-v0.1 in 76 files at 07d4992
  • Secrets · 2config.py L56-58 several named tokens are read from environment variables: the console token, an optional VirusTotal key and an optional Logfire token
  • Persistence · 3docker-compose.yml L25 the optional compose deployment runs the server and its proxy as services that restart automatically with the Docker daemon
  • Approval · ?no evidence: no approval settings were found, and the two lines the search patterns match are error messages about token permissions

Valid for commit 07d4992 (v0.7.0) · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientAny MCP client, Claude Code, Codex; sign-in: Access token
AccountNeeds a SentinelOne account to obtain the console token. BEDROCK_AGENTCORE_DEPLOYMENT.md L5
CredentialsNeeds a console or Service User token with Account or Site scope, not Global, set as PURPLEMCP_CONSOLE_TOKEN. README.md L82-83
SettingNeeds PURPLEMCP_CONSOLE_BASE_URL set to the HTTPS console URL. README.md L295
RuntimeNeeds Python 3.11 or later. pyproject.toml L6
Other toolsNeeds uv, whose uvx command fetches and runs the server. README.md L34-35
CredentialsThe threat-intel tools need a VirusTotal API key in PURPLEMCP_VT_API_KEY; threat_intel_search needs a Premium API key. README.md L285-288

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Source
github.com/Sentinel-One/purple-mcp · MIT · manifest pyproject.toml
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
07d4992 · v0.7.0 · last upstream push 2026-09-22 · no release since the pinned commit (current v0.7.0)
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 07d4992, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 07d4992 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (64 of 64), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Purple AI MCP Server". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/sentinelone-purple-mcp/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/sentinelone-purple-mcp.svg)](https://readbeforerun.ai/catalog/sentinelone-purple-mcp/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Alert triage, Threat intel enrichment. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 23122?
    GitGuardian MCP ServerMCP server · by GitGuardian · reach 3, privilegedDraft · awaiting review

    MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent.

    Can tunnel or exfiltrate · write outside the project · read broad tokens or the environment · +1 more · Approval: no evidence · ran once, 2026-11-07: did no more than it said · checked 2026-11-07

    Code shows
  3. 11032?
    Google Security Operations MCP ServerMCP server · by google · reach 3, privilegedDraft · awaiting review

    MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

    Can read credential stores · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  4. 212?10
    Threat Intel ToolkitPlugin · by kevinmhorvath · reach ≥2, openDraft · awaiting review

    Claude Code plugin with a subagent and two skills that triage IOCs and CVEs against free threat-intel feeds, without API keys.

    Can write outside the project · run shell commands or eval · Secrets: no evidence · not run yet · checked 2026-10-21

    Code shows
  5. 21122?
    SentinelOne MCP Server (s1-secops-mcp)MCP server · by Sentinel-One · reach ≥2, openDraft · awaiting review

    Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

    Can write outside the project · read broad tokens or the environment · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  6. 23223?
    SentinelOne AI Analyst: Claude SkillsPlugin · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

    Can tunnel or exfiltrate · add autostart, users or keys · write outside the project · +2 more · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows