SentinelOne MCP Server

Tags

MCP server for SentinelOne EDR. Query threats, manage agents, run Deep Visibility hunts, and check hash reputation from AI assistants. Stdlib-only Go binary - zero external dependencies.

Source: c0tton-fluff/sentinelone-mcp-server

Architecture

Claude Code  -->  stdio  -->  sentinelone-mcp-server (Go)  -->  REST API  -->  SentinelOne Console

Single binary, no SDK dependencies. Uses Go stdlib net/http + encoding/json for all API communication.

Install

curl -fsSL https://raw.githubusercontent.com/c0tton-fluff/sentinelone-mcp-server/main/install.sh | bash

Or build from source:

git clone https://github.com/c0tton-fluff/sentinelone-mcp-server.git
cd sentinelone-mcp-server
go build -ldflags "-X main.version=$(git describe --tags)" -o sentinelone-mcp-server .

Requires Go 1.26+.

Auth

Set two environment variables:

  • SENTINELONE_API_KEY — API token from Settings > Users > API Token
  • SENTINELONE_API_BASE — console URL (e.g., https://usea1-partners.sentinelone.net)

Claude Code Config

{
  "mcpServers": {
    "sentinelone": {
      "command": "sentinelone-mcp-server",
      "args": ["serve"],
      "env": {
        "SENTINELONE_API_KEY": "your-api-token",
        "SENTINELONE_API_BASE": "https://your-console.sentinelone.net"
      }
    }
  }
}

Tools (14)

Threat Management

ToolWhat it does
s1_list_threatsList threats with filters (status, classification, time range)
s1_get_threatThreat details by ID
s1_mitigate_threatExecute mitigation action (kill, quarantine, remediate, rollback)
s1_investigate_threatFull threat context — process tree, indicators, timeline
s1_set_analyst_verdictSet verdict (true_positive, false_positive, suspicious, undefined)
s1_set_incident_statusUpdate incident status (in_progress, resolved, unresolved)

Agent Management

ToolWhat it does
s1_list_agentsList agents with filters (OS, status, infection status)
s1_get_agentAgent details by ID
s1_isolate_agentNetwork isolate an endpoint
s1_reconnect_agentRemove network isolation

Alerts & Intelligence

ToolWhat it does
s1_list_alertsList alerts with severity/type filters
s1_hash_reputationCheck file hash reputation (SHA1)

Deep Visibility (Threat Hunting)

ToolWhat it does
s1_dv_queryCreate Deep Visibility query (process, file, network, registry events)
s1_dv_get_eventsGet query results with pagination

Use Cases

Incident triage: “Show me unresolved threats from the last 24 hours, investigate the highest severity one, and isolate the affected endpoint.”

Threat hunting: “Run a Deep Visibility query for processes spawning cmd.exe with encoded PowerShell arguments across all Windows agents.”

Hash lookup: “Check if this SHA1 hash is known malicious and list any agents where it was detected.”

Design

  • Zero external dependencies — stdlib net/http only
  • Structured JSON responses with consistent error format
  • Pagination support on list operations
  • Input validation with length limits
  • API key never logged or exposed in tool output

Backlinks