# SentinelOne MCP

This MCP server connects agents to the SentinelOne API and adds an offline SQLite store with cross-entity analytics.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/sentinelone
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/sentinelone-mcp

## What it does

SentinelOne MCP exposes SentinelOne v2.1 management endpoints to an AI agent. It also maintains an offline SQLite store and derives views for fleet health, threat triage, blast radius, and drift. These cross-entity views are not available in the console.

The server supports Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, and Zed. It ships with `sentinelone-cli`, while agents that read `SKILL.md` can discover the skill from that file. SentinelOne authentication is required.

Do not start HTTP mode in this build, including on `localhost`; use the default stdio transport. MCP tools can make changes with your credentials, so a remote tunnel should be shut down.

## Requirements
- Environment variables: `SENTINELONE_API_TOKEN`, `SENTINELONE_BASE_URL`, `SENTINELONE_USER_AGENT`, `SENTINELONE_MCP_HTTP_TOKEN`, `PRINTING_PRESS_CLIENT_PROFILE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- query SentinelOne management endpoints
- store SentinelOne data in local SQLite
- inspect the health of an endpoint fleet
- trace a threat’s blast radius
- spot drift across SentinelOne entities

## Example prompts
- Show the SentinelOne fleet health and flag affected devices.
- Triage this SentinelOne threat and map its blast radius.
- Compare SentinelOne entities and report any drift.

## Similar
- [safedb-mcp](https://affpapa.org/en/nevibecode/mcp/safedb-mcp.md) — MCP server · ★ 9
- [employee-performance-analytics-hr](https://affpapa.org/en/nevibecode/skills/employee-performance-analytics-hr.md) — skill · 2100 installs
- [hermes-marketing-dashboard](https://affpapa.org/en/nevibecode/skills/hermes-marketing-dashboard.md) — skill · 1000 installs
- [mantis-advise](https://affpapa.org/en/nevibecode/skills/mantis-advise.md) — skill · 1000 installs
- [crowbar](https://affpapa.org/en/nevibecode/mcp/crowbar.md) — MCP server · ★ 8
- [SAME - Stateless Agent Memory Engine](https://affpapa.org/en/nevibecode/mcp/same-stateless-agent-memory-engine.md) — MCP server · ★ 24

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 32 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md