# SentinelOne MCP Server (s1-secops-mcp)

> Draft · awaiting review.

> Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

- Badge: `reach ≥2 · not run yet`
- Type: MCP server; tier: not run yet
- Tasks: Alert triage, Detection engineering; mission: Defensive; works with: Any MCP client, Claude Code
- Source: https://github.com/Sentinel-One/ai-siem (mcp/s1-secops-mcp), pinned to `b84fba9` (v_1_99_0), licence AGPL-3.0-only
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** A Node.js MCP server that gives an AI client tools for a SentinelOne tenant's Management Console, Singularity Data Lake, UAM Alert Interface and Hyperautomation APIs over stdio. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Provides PowerQuery, Management Console API, Unified Alert Management, Singularity Data Lake and Hyperautomation tools for one SentinelOne tenant. +2 more
- **Runs:** In a container on your machine. Other modes: Node from a clone (on your machine, started by your AI client); Claude Desktop Extension (on your machine, started by your AI client).
- **Sends data to:** SentinelOne Management Console (always), Singularity Data Lake (<console>/sdl) (by default), Purple AI (console GraphQL) (if you turn it on), HEC ingest host (if you turn it on), raw.githubusercontent.com (by default), sentinelone/secops-mcps image (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, runs commands, according to the capabilities read.
- **Needs:** S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools · S1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only · The console token's role is the authoritative control over writes; the server's read-only mode is a guard on top of it · +5 more

Profile read at commit `b84fba9` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A Node.js MCP server that gives an AI client tools for a SentinelOne tenant's Management Console, Singularity Data Lake, UAM Alert Interface and Hyperautomation APIs over stdio. (mcp/s1-secops-mcp/README.md#L3)

Made for (the author says):

- Provides PowerQuery, Management Console API, Unified Alert Management, Singularity Data Lake and Hyperautomation tools for one SentinelOne tenant. (mcp/s1-secops-mcp/mcpb/manifest.json#L6)
- Combines SentinelOne API access with SOC analyst context that it serves to the AI client. (mcp/s1-secops-mcp/package.json#L4)
- Ships in the ai-siem repository, which the author describes as a community-driven project for SentinelOne's AI SIEM, maintained by SentinelOne but not a formal product. (README.md#L9)

Documented uses:

- Triage UAM alerts by status, analyst verdict, assignee and notes; these changes are refused until read-only mode is turned off. [Alert triage] (mcp/s1-secops-mcp/mcpb/manifest.json#L7)
- Run PowerQuery hunts and test STAR rule logic against Singularity Data Lake telemetry. [Detection engineering] (mcp/s1-secops-mcp/tools/powerquery.js#L73)
- Export full-event forensic timelines with the LOG raw-event search mode of powerquery_run. [Incident response and forensics (DFIR)] (mcp/s1-secops-mcp/tools/powerquery.js#L106)
- Download RemoteOps-fetched files, threat files and CSV or ZIP exports from the console to a local file. [Incident response and forensics (DFIR)] (mcp/s1-secops-mcp/tools/mgmt-console.js#L236)

Not for (the author says):

- The author says to turn off read-only mode only when authorised to make changes in the tenant. (mcp/s1-secops-mcp/mcpb/manifest.json#L103)
- The credential commands setup, status and forget are meant for a terminal on the user's own machine, not inside a chat. (mcp/s1-secops-mcp/README.md#L177)
- The .mcpb Desktop Extension is built for Claude Desktop; other MCP clients use the keychain CLI or the Docker path. (mcp/s1-secops-mcp/mcpb/README.md#L114-115)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| PowerQuery | powerquery_enumerate_sources, powerquery_run (PQ pipelines, LOG raw-event search, parallel time slices) and powerquery_schema_discover on the Singularity Data Lake. (mcp/s1-secops-mcp/README.md#L14-16) | reads | yes |
| Mgmt Console | s1_api_get, s1_api_download, uam_list_alerts, uam_get_alert, uam_available_actions and purple_ai_alert_summary read console REST v2.1 and UAM GraphQL data. (mcp/s1-secops-mcp/lib/access.js#L40-46) | reads | yes |
| SDL API | sdl_list_files, sdl_get_file, sdl_list_dashboards and sdl_get_dashboard read SDL configuration files (parsers, dashboards, alerts, lookups) and dashboards at a scope. (mcp/s1-secops-mcp/lib/access.js#L44) | reads | yes |
| Hyperautomation | ha_list_workflows, ha_get_workflow and ha_export_workflow list, read and export Hyperautomation workflows as a ZIP archive. (mcp/s1-secops-mcp/lib/access.js#L45) | reads | yes |
| Write tools (S1_READ_ONLY=false) | 18 WRITE_TOOLS: s1_api_put/patch/delete, four UAM triage writes, uam_post_alert, uam_ingest_alert, hec_ingest, six SDL tools, ha_import_workflow, ha_delete_workflow. (mcp/s1-secops-mcp/lib/access.js#L25-33) | changes, deletes | no |
| UAM Ingest | uam_ingest_alert creates a synthetic test alert in Unified Alert Management (UAM) via the SentinelOne ingest API. (mcp/s1-secops-mcp/tools/uam-ingest.js#L28) | changes | no |
| CLI (setup / status / forget / exec) | setup, status and forget store, show and remove credentials in the OS keychain; exec starts another program with the stored values in its environment. (mcp/s1-secops-mcp/lib/cli.js#L2-7) | reads, changes, deletes, runs commands | yes |
| Resources and prompts | sentinelone://soc-context and sentinelone://credentials-status resources, plus soc_analyst and session_init prompts that serve CLAUDE.md and a session start sequence. (mcp/s1-secops-mcp/README.md#L55-63) | reads | yes |

## How it runs

index.js starts either the credential CLI (setup, status, forget, exec) or the stdio server; server-core.js dispatches JSON-RPC over a stdin/stdout loop, keystore.js reads the OS keychain and credentials.js resolves each value from environment variables, then the keychain. (mcp/s1-secops-mcp/README.md#L207-213)

- Starts: In a container on your machine. The recommended install runs the server in a container on the user's machine, behind a host launcher that reads the OS keychain. (mcp/s1-secops-mcp/README.md#L71)
- Can also run: On your machine, started by your AI client (Node from a clone). The MCP client starts node index.js from a clone of the repository. (mcp/s1-secops-mcp/README.md#L109)
- Can also run: On your machine, started by your AI client (Claude Desktop Extension). A .mcpb Desktop Extension runs the server with Node inside Claude Desktop, with credentials from the extension settings. (mcp/s1-secops-mcp/mcpb/manifest.json#L7)
- Your machine: **Keychain launcher (s1-secops-mcp-launch.sh)**: Host launcher script the AI client starts; reads the OS keychain and hands the values to the container over stdin. (mcp/s1-secops-mcp/README.md#L71)
- Your machine: **OS keychain**: Holds each value under service sentinelone-mcp, account <profile>:<NAME>, profile from S1_PROFILE (default default); read once, then cached for the process. (mcp/s1-secops-mcp/README.md#L129)
- Your machine: **CLAUDE.md SOC context**: SOC analyst instructions file loaded at startup and served as the soc-context resource and soc_analyst prompt. (mcp/s1-secops-mcp/README.md#L257)
- Container on your machine: **s1-secops-mcp server**: The MCP server the host launcher runs from image sentinelone/secops-mcps:1.5.6 with the server name s1-secops-mcp. (mcp/s1-secops-mcp/README.md#L84)
- Outside your machine: **SentinelOne Management Console**: The tenant's console, reached for the Mgmt Console REST API, LRQ PowerQuery, Purple AI and UAM GraphQL. (mcp/s1-secops-mcp/lib/s1.js#L2)
- Outside your machine: **HEC ingest host**: SentinelOne HEC ingest host (for example ingest.us1.sentinelone.net) to which the UAM Alert Interface tools push OCSF alerts. (mcp/s1-secops-mcp/tools/uam-ingest.js#L2-3)
- Sends data to SentinelOne Management Console (vendor API, always): Mgmt REST API calls to the configured console, authenticated with S1_CONSOLE_API_TOKEN in an Authorization: ApiToken header. (mcp/s1-secops-mcp/README.md#L237)
- Sends data to Singularity Data Lake (<console>/sdl) (vendor API, by default): PowerQuery LRQ queries are launched at /sdl/v2/api/queries under the configured console URL. (mcp/s1-secops-mcp/lib/s1.js#L312)
- Sends data to Purple AI (console GraphQL) (vendor API, if you turn it on): purple_ai_alert_summary sends the full OCSF alert JSON to the console GraphQL endpoint and returns a Purple AI summary. (mcp/s1-secops-mcp/tools/mgmt-console.js#L272)
- Sends data to HEC ingest host (vendor API, if you turn it on): HEC log ingest posts to /services/collector/raw or /event on the S1_HEC_INGEST_URL host, with the SDL Log Write Key as Bearer. (mcp/s1-secops-mcp/lib/hec.js#L10-13)
- Sends data to raw.githubusercontent.com (download, by default): The documented one-line install downloads s1-secops-mcp-launch.sh from the main branch of Sentinel-One/ai-siem. (mcp/s1-secops-mcp/README.md#L74)
- Sends data to sentinelone/secops-mcps image (download, by default): install pulls the container image and runs setup if no values are stored in the OS keychain. (mcp/s1-secops-mcp/README.md#L77)

## What you need

- Credentials: S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools. (mcp/s1-secops-mcp/mcpb/manifest.json#L116)
- Credentials: S1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only. (mcp/s1-secops-mcp/README.md#L140)
- Authorisation: The console token's role is the authoritative control over writes; the server's read-only mode is a guard on top of it. (mcp/s1-secops-mcp/lib/access.js#L9-10)
- Authorisation: ha_import_workflow needs the Hyper Automate.write permission on the token's role. (mcp/s1-secops-mcp/tools/hyperautomation.js#L231)
- Runtime: Node 24 or later when running from a clone. (mcp/s1-secops-mcp/README.md#L98)
- Container runtime: Docker for the recommended keychain-launcher install. (mcp/s1-secops-mcp/README.md#L69)
- Setting: Write tools need S1_READ_ONLY=false, which install --read-write adds to the Docker launcher entry. (mcp/s1-secops-mcp/README.md#L90)
- Other tools: An OS keychain backend: /usr/bin/security on macOS, secret-tool with a D-Bus session on Linux, or @napi-rs/keyring on Windows; otherwise environment variables. (mcp/s1-secops-mcp/README.md#L131)
- Installer: The one-line install downloads s1-secops-mcp-launch.sh from the main branch (not a pinned commit) with curl into ~/.local/bin and runs it with sh install. (mcp/s1-secops-mcp/README.md#L74)
- Installer: install adds s1-secops-mcp, purple-mcp and virustotal entries to the Claude Desktop config (other entries kept, old file backed up), pulls the image and runs setup if no values are stored. (mcp/s1-secops-mcp/README.md#L77)
- Installer: For the Node path, npm link in the server folder puts s1-secops-mcp on PATH; on Windows the keychain needs npm install @napi-rs/keyring. (mcp/s1-secops-mcp/README.md#L114)

## Limits and risks

- Read-only mode (default since 1.5.5) refuses the 18 write tools, s1_api_post outside a query allowlist and powerquery_run with | savelookup before any network request. (mcp/s1-secops-mcp/README.md#L51)
- With write enabled, s1_api_post is described for actions such as creating IOCs, isolating agents, adding exclusions, creating detection rules and triggering RemoteOps. (mcp/s1-secops-mcp/tools/mgmt-console.js#L124)
- With no scope argument and no S1_SCOPE set, a PowerQuery runs across every account a global or multi-account token is authorized for. (mcp/s1-secops-mcp/tools/powerquery.js#L16)
- The SOC context CLAUDE.md is looked up at S1_CLAUDE_MD_PATH, then in the server process's working directory, then in folders near index.js. (mcp/s1-secops-mcp/lib/server-core.js#L33-38)
- sdl_create_dashboard shares new dashboards with all users in scope unless isPublic is set to false. (mcp/s1-secops-mcp/tools/sdl-api.js#L286)
- outputFile (powerquery_run, s1_api_get, s1_api_download, ha_export_workflow) writes only inside S1_OUTPUT_DIRS, default home and temp, or in Docker only the install --output-dir folder; symlinks are refused. (mcp/s1-secops-mcp/README.md#L150)
- The author states the OS keychain does not isolate the stored tokens from other processes running as the same user. (mcp/s1-secops-mcp/README.md#L154)
- exec runs another program (purple-mcp, the VirusTotal MCP, anything) with the keychain values in its environment, where the same OS user can read them (ps eww, /proc/<pid>/environ). (mcp/s1-secops-mcp/lib/cli.js#L214-218)
- Since 1.5.0 the server has no HTTP transport, no credentials file and no shared team server; each user runs their own instance with their own credentials. (mcp/s1-secops-mcp/README.md#L5)
- With write enabled, writes are refused without a console token (except hec_ingest) or with an expired JWT, and each allowed write logs one stderr line with tool and path, without request bodies or tokens. (mcp/s1-secops-mcp/README.md#L179)
- Paths passed to the s1_api_* tools must start with a single "/" and resolve to the configured console origin, so a path cannot send the ApiToken to another host. (mcp/s1-secops-mcp/lib/s1.js#L52-58)
- The soc_analyst prompt returns the loaded CLAUDE.md inside a user message that tells the model to act as a Principal SOC Analyst and follow it precisely. (mcp/s1-secops-mcp/lib/server-core.js#L205-213)
- With write enabled, the initialize instructions ask the client's model to confirm intent with the user before creating, changing or deleting tenant objects. (mcp/s1-secops-mcp/lib/server-core.js#L143-146)

## Rights in plain language

- Declared: files 2 (writes outside the project), network 1 (talks only to declared hosts), execution 1 (runs only declared programs), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 0 (asks each time).
- Code: reach ≥2 (open): files 2 (writes outside the project), secrets 2 (reads broad tokens or the environment), persistence 2 (changes config or installs globally); unknown: approval.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open), one right unknown.

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 2 writes outside the project | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 1 talks only to declared hosts | not run yet |
| Execution: what does it run? | 1 runs only declared programs | 1 runs only declared programs | not run yet |
| Secrets: which credentials does it touch? | 2 reads broad tokens or the environment | 2 reads broad tokens or the environment | not run yet |
| Persistence: what survives the run? | 3 adds autostart, users or keys | 2 changes config or installs globally | not run yet |
| Approval: does it ask before acting? | 0 asks each time | ? unknown | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `mcp/s1-secops-mcp/README.md#L74` at the pinned commit (not a command to copy): `mkdir -p ~/.local/bin && curl -fsSL https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/mcp/docker/s1-secops-mcp-launch.sh -o ~/.local/bin/s1-secops-mcp-launch.sh && sh ~/.local/bin/s1-secops-mcp-launch.sh install`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; keep the default read-only mode, give the console token the Viewer role, and run index.js from a clone at the pinned commit instead of the launcher from the main branch`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does SentinelOne MCP Server (s1-secops-mcp) declare?**

files 2 (writes outside the project), network 1 (talks only to declared hosts), execution 1 (runs only declared programs), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 0 (asks each time).

**What does its code suggest?**

reach ≥2 (open): files 2 (writes outside the project), secrets 2 (reads broad tokens or the environment), persistence 2 (changes config or installs globally); unknown: approval.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-20; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; keep the default read-only mode, give the console token the Viewer role, and run index.js from a clone at the pinned commit instead of the launcher from the main branch

Method: https://readbeforerun.ai/method/