SentinelOne MCP Server

A Model Context Protocol server that connects AI assistants to your SentinelOne tenant. Manage threats, investigate endpoints, hunt with Deep Visibility, and triage alerts -- all from natural language.

Zero dependencies. Stdlib-only Go binary. No runtime requirements. Just copy and run.

---

Quick Start

1. Build

git clone https://github.com/c0tton-fluff/sentinelone-mcp-server.git
cd sentinelone-mcp-server
go build -o sentinelone-mcp-server .

2. Get your API token

S1 Console > Profile (top right) > My Profile > Actions > API token operations > Regenerate API token

3. Configure your MCP client

Add to ~/.mcp.json:

{
  "mcpServers": {
    "sentinelone": {
      "command": "/path/to/sentinelone-mcp-server",
      "env": {
        "SENTINELONE_API_KEY": "your_api_token_here",
        "SENTINELONE_API_BASE": "https://your-tenant.sentinelone.net"
      }
    }
  }
}

4. Go

"List all unmitigated threats"
"Investigate threat 1234567890"
"Show infected agents"
"Hunt for PowerShell processes in the last 24 hours"
"What's the reputation of this SHA256?"
"Create an exclusion for /opt/myapp on Linux"
"What applications are installed on Benedict's laptop?"

---

Tools (21)

Threats

Tool	What it does
s1_list_threats	List threats with classification, status, and endpoint filters
s1_get_threat	Full threat details -- hashes, file path, storyline
s1_mitigate_threat	Kill, quarantine, un-quarantine, remediate, or rollback
s1_investigate_threat	One-call investigation: threat + correlated alerts + timeline
s1_set_analyst_verdict	Set verdict: true_positive, false_positive, suspicious, undefined
s1_set_incident_status	Set status (with optional verdict in the same call)

Agents

Tool	What it does
s1_list_agents	List agents with OS, status, infection filters, and count-by grouping
s1_get_agent	Agent details -- version, site, network info, account ID
s1_isolate_agent	Network isolate an endpoint (maintains S1 comms)
s1_reconnect_agent	Remove network isolation

Alerts

Tool	What it does
s1_list_alerts	Query unified alerts via GraphQL with severity, verdict, and status filters
s1_set_alert_verdict	Bulk set analyst verdict on matching alerts
s1_set_alert_status	Bulk set incident status (with optional verdict)

Deep Visibility

Tool	What it does
s1_dv_query	Run a threat hunting query with automatic polling
s1_dv_get_events	Retrieve events from a completed query

Intelligence

Tool	What it does
s1_hash_reputation	Hash verdict + fleet-wide hunt via Deep Visibility

Exclusions

Tool	What it does
s1_list_exclusions	List exclusions (path, hash, certificate, browser, file type)
s1_create_exclusion	Create an exclusion to suppress false-positive detections
s1_delete_exclusion	Delete exclusions by ID

STAR Rules

Tool	What it does
s1_create_star_rule	Create a custom detection rule from a Deep Visibility query

Applications

Tool	What it does
s1_list_applications	List installed software on endpoints by name or computer

---

Full parameter reference

s1_list_threats

Parameter	Type	Description

... View full README on GitHub