ms-sentinel-mcp-server

updated this year

MCP server for Microsoft Sentinel. Enables access to Sentinel logs, incidents, analytics, and Entra ID data via a modular, queryable interface. Strictly non-production. Designed for use with Claude and other LLMs.

Code-only MCP server: no hosted endpoint, so you install and run it yourself. It is not probed, graded or counted in our reachability statistics.

Get it

Repository: github.com/dstreefkerk/ms-sentinel-mcp-server
License: MIT
Last update: 2026-06-19
GitHub stars: ★ 18

azure llm-integration log-analytics mcp mcp-server microsoft-sentinel threat-intelligence

Listed in

github · source

Run this server as a hosted endpoint? Submit the endpoint and it moves to the remote directory, where it is probed and graded.