MCP server CX Codex

SentinelOne MCP — Claude Code MCP server: install

Q: How do I install SentinelOne MCP in Claude Code?

Add the marketplace with `/plugin marketplace add Servosity/msp-skills`, then install the plugin with `/plugin install sentinelone@msp-skills`.

This MCP server connects agents to the SentinelOne API and adds an offline SQLite store with cross-entity analytics.

Open on GitHub

What SentinelOne MCP does

SentinelOne MCP exposes SentinelOne v2.1 management endpoints to an AI agent. It also maintains an offline SQLite store and derives views for fleet health, threat triage, blast radius, and drift. These cross-entity views are not available in the console.

The server supports Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, and Zed. It ships with sentinelone-cli, while agents that read SKILL.md can discover the skill from that file. SentinelOne authentication is required.

Do not start HTTP mode in this build, including on localhost; use the default stdio transport. MCP tools can make changes with your credentials, so a remote tunnel should be shut down.

What it helps with

query SentinelOne management endpoints
store SentinelOne data in local SQLite
inspect the health of an endpoint fleet
trace a threat’s blast radius
spot drift across SentinelOne entities

Example prompts for the agent

Show the SentinelOne fleet health and flag affected devices.
Triage this SentinelOne threat and map its blast radius.
Compare SentinelOne entities and report any drift.

How to install SentinelOne MCP

Install

The MCP registry has no launch command for it: see the repository README

Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more

Questions about SentinelOne MCP

How do I install SentinelOne MCP in Claude Code?

Add the marketplace with /plugin marketplace add Servosity/msp-skills, then install the plugin with /plugin install sentinelone@msp-skills.

What does SentinelOne MCP do?

It connects an agent to SentinelOne v2.1 management endpoints, keeps an offline SQLite store, and provides analytics for fleet health, threats, blast radius, and drift.

Which transport should SentinelOne MCP use?

Use the default stdio transport. HTTP mode must not run, even on localhost, because this build lacks request-size and execution-time limits for that mode.

Similar MCP servers

All MCP servers for Agent setup: memory, context, orchestration →

REA morluto Analyzes binaries, Electron bundles, and JavaScript runtimes directly from your agent. It inspects compiled apps without source code to recreate specific features. CX Codex +1 ★ 386,989repo stars GitHub official github Wires your AI agent into GitHub: read code, open issues and pull requests, watch Actions runs. Saves a trip to the browser. CX Codex +1 ★ 33,918repo stars Netdata netdata Hands your AI agent live monitoring data: metrics, logs, alerts and anomaly detection. Useful when you need to know what a server is doing without opening the dashboard. CX Codex +1 ★ 81,115repo stars browser-use browser-use Give an agent browser tasks such as finding information, extracting page data, and filling forms. Connect it when those actions need to happen on the web. CX Codex +1 ★ 119,160repo stars Codebase Memory DeusData A local MCP server that maps your repo's code, docs and infrastructure into a graph. Gives the agent structural context without re-reading files. CX Codex +1 ★ 47,392repo stars mcp-server HeyPuter Connects your AI agent to Puter for files, websites and workers. Useful when the project already lives in Puter's cloud. CX Codex +1 ★ 43,872repo stars

From the same set32