ReadBeforeRunAgentic Security Field Guide

Catalog / MCP server

SentinelOne MCP Server (s1-secops-mcp)

Draft · awaiting review

Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default.

For Alert triage, Detection engineeringWorks with Any MCP client, Claude CodeMaintained Sentinel-One, last push 2026-10-20

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by Sentinel-One · read from the code at b84fba9 (v_1_99_0) on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Files. Output files go under the home and temp directories by default, and write mode deletes data-lake files and workflows on the tenant.

    output.js L30

  2. Secrets. Three named secrets are read from environment variables or from the server's own keychain items.

    keystore.js L46-50

  3. Persistence. Write mode imports Hyperautomation workflows and other tools replace policies, which changes target configuration.

    hyperautomation.js L283

  4. Approval. Unknown: no pre-approvals were found, but the search patterns for approvals match several lines, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Keep the default read-only mode, give the console token the Viewer role, and run index.js from a clone at the pinned commit instead of the launcher from the main branch.

What we checked, and what we foundDisagree?

MCP server · code showsreach ≥2 · open
21122?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Provides PowerQuery, Management Console API, Unified Alert Management, Singularity Data Lake and Hyperautomation tools for one SentinelOne tenant.
  • Combines SentinelOne API access with SOC analyst context that it serves to the AI client.
  • Ships in the ai-siem repository, which the author describes as a community-driven project for SentinelOne's AI SIEM, maintained by SentinelOne but not a formal product.
Use it when
Not for
  • The author says to turn off read-only mode only when authorised to make changes in the tenant.
  • The credential commands setup, status and forget are meant for a terminal on the user's own machine, not inside a chat.
  • The .mcpb Desktop Extension is built for Claude Desktop; other MCP clients use the keychain CLI or the Docker path.
You need
  • S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools
  • S1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only
  • The console token's role is the authoritative control over writes; the server's read-only mode is a guard on top of it

+5 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

mkdir -p ~/.local/bin && curl -fsSL https://raw.githubusercontent.com/Sentinel-One/ai-siem/main/mcp/docker/s1-secops-mcp-launch.sh -o ~/.local/bin/s1-secops-mcp-launch.sh && sh ~/.local/bin/s1-secops-mcp-launch.sh install
Quoted from mcp/s1-secops-mcp/README.md#L74 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; keep the default read-only mode, give the console token the Viewer role, and run index.js from a clone at the pinned commit instead of the launcher from the main branch

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit b84fba9 on 2026-10-25: 61 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, runs commands, according to the capabilities read.

The author states 35 tools across five groups. README.md L10

GroupWhat it coversEffectOn by default
Write tools (S1_READ_ONLY=false)18 WRITE_TOOLS: s1_api_put/patch/delete, four UAM triage writes, uam_post_alert, uam_ingest_alert, hec_ingest, six SDL tools, ha_import_workflow, ha_delete_workflow. access.js L25-33changes, deletesno, optional
CLI (setup / status / forget / exec)setup, status and forget store, show and remove credentials in the OS keychain; exec starts another program with the stored values in its environment. cli.js L2-7reads, changes, deletes, runs commandsyes
UAM Ingestuam_ingest_alert creates a synthetic test alert in Unified Alert Management (UAM) via the SentinelOne ingest API. uam-ingest.js L28changesno, optional
PowerQuerypowerquery_enumerate_sources, powerquery_run (PQ pipelines, LOG raw-event search, parallel time slices) and powerquery_schema_discover on the Singularity Data Lake. README.md L14-16readsyes
Mgmt Consoles1_api_get, s1_api_download, uam_list_alerts, uam_get_alert, uam_available_actions and purple_ai_alert_summary read console REST v2.1 and UAM GraphQL data. access.js L40-46readsyes
SDL APIsdl_list_files, sdl_get_file, sdl_list_dashboards and sdl_get_dashboard read SDL configuration files (parsers, dashboards, alerts, lookups) and dashboards at a scope. access.js L44readsyes
Hyperautomationha_list_workflows, ha_get_workflow and ha_export_workflow list, read and export Hyperautomation workflows as a ZIP archive. access.js L45readsyes
Resources and promptssentinelone://soc-context and sentinelone://credentials-status resources, plus soc_analyst and session_init prompts that serve CLAUDE.md and a session start sequence. README.md L55-63readsyes

Where it sends data and who can connect to it

6 outside connections found in the files read: SentinelOne Management Console, Singularity Data Lake (<console>/sdl), Purple AI (console GraphQL), HEC ingest host, raw.githubusercontent.com, sentinelone/secops-mcps image.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

index.js starts either the credential CLI (setup, status, forget, exec) or the stdio server; server-core.js dispatches JSON-RPC over a stdin/stdout loop, keystore.js reads the OS keychain and credentials.js resolves each value from environment variables, then the keychain. README.md L207-213

Your machine

Programs and files on the machine where you run the tool.

Container on your machine

Parts inside a container that the tool starts on your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), one right unknown, read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 2README.md L150 the author lets output files go anywhere under the home and temp directories by default, outside the working directory
  • Network · 1README.md L3 the author names only the SentinelOne console APIs as endpoints
  • Execution · 1README.md L131 the author names the fixed keychain programs security and secret-tool
  • Secrets · 2manifest.json L116 one console API token covers the management API, alerts, PowerQuery and the data lake, with a log write key and a VirusTotal key on top
  • Persistence · 3README.md L77 the recommended installer adds three MCP servers to the Claude Desktop configuration, which is a change to agent configuration
  • Approval · 0README.md L51 the author declares the server read-only by default, with write enabled only by the operator, and declares no pre-approvals

Code shows: the evidence

  • Files · 2output.js L30 output files go under the home and temp directories by default, and write mode deletes data-lake files and workflows on the tenant
  • Network · 1s1.js L69 management API calls are pinned to the configured console origin, and there is no listener because the HTTP transport was removed
  • Execution · 1keystore.js L133 the server starts only fixed keychain programs, without a shell
  • Secrets · 2keystore.js L46-50 three named secrets are read from environment variables or from the server's own keychain items
  • Persistence · 2hyperautomation.js L283 write mode imports Hyperautomation workflows and other tools replace policies, which changes target configuration
  • Approval · ?no evidence: no pre-approvals were found, but the search patterns for approvals match several lines, so a zero cannot be written

Valid for commit b84fba9 (v_1_99_0) · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientAny MCP client, Claude Code; sign-in: Access token
CredentialsS1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools. manifest.json L116
CredentialsS1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only. README.md L140
AuthorisationThe console token's role is the authoritative control over writes; the server's read-only mode is a guard on top of it. access.js L9-10
Authorisationha_import_workflow needs the Hyper Automate.write permission on the token's role. hyperautomation.js L231
RuntimeNode 24 or later when running from a clone. README.md L98
Container runtimeDocker for the recommended keychain-launcher install. README.md L69
SettingWrite tools need S1_READ_ONLY=false, which install --read-write adds to the Docker launcher entry. README.md L90
Other toolsAn OS keychain backend: /usr/bin/security on macOS, secret-tool with a D-Bus session on Linux, or @napi-rs/keyring on Windows; otherwise environment variables. README.md L131

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Source
github.com/Sentinel-One/ai-siem · mcp/s1-secops-mcp · AGPL-3.0-only · manifest package.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
b84fba9 · v_1_99_0 · last upstream push 2026-10-20 · no release since the pinned commit (current v_1_99_0)
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit b84fba9, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit b84fba9 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (61 of 61), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "SentinelOne MCP Server (s1-secops-mcp)". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/sentinelone-s1-secops-mcp/

The method · the rules

For maintainers

Badge for your README (reach ≥2 · not run yet):

[![reach ≥2 · not run yet](https://readbeforerun.ai/badge/sentinelone-s1-secops-mcp.svg)](https://readbeforerun.ai/catalog/sentinelone-s1-secops-mcp/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Alert triage, Detection engineering. The task pages compare every tool side by side.
  1. 23112?
    CrowdStrike Falcon MCP ServerMCP server · by CrowdStrike · reach 3, privilegedDraft · awaiting review

    MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

    Can tunnel or exfiltrate · write outside the project · change config or install globally · Approval: no evidence · ran once, 2026-11-07: did more than it said · checked 2026-11-07

    Code shows
  2. 23122?
    GitGuardian MCP ServerMCP server · by GitGuardian · reach 3, privilegedDraft · awaiting review

    MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent.

    Can tunnel or exfiltrate · write outside the project · read broad tokens or the environment · +1 more · Approval: no evidence · ran once, 2026-11-07: did no more than it said · checked 2026-11-07

    Code shows
  3. 11032?
    Google Security Operations MCP ServerMCP server · by google · reach 3, privilegedDraft · awaiting review

    MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration.

    Can read credential stores · change config or install globally · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  4. 13023?
    Purple AI MCP ServerMCP server · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory.

    Can tunnel or exfiltrate · add autostart, users or keys · read broad tokens or the environment · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  5. 23223?
    SentinelOne AI Analyst: Claude SkillsPlugin · by Sentinel-One · reach 3, privilegedDraft · awaiting review

    Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows.

    Can tunnel or exfiltrate · add autostart, users or keys · write outside the project · +2 more · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  6. 102?00
    Malware AnalystSkill · by tomabai · reach ≥2, openDraft · awaiting review

    Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.

    Can run shell commands or eval · Secrets: no evidence · not run yet · checked 2026-10-21

    Code shows