Home › Servers › Microsoft Sentinel

Microsoft Sentinel MCP server

Microsoft's hosted server for exploring security data in a Sentinel data lake.

Transport	Streamable HTTP (remote)
Auth	No secrets declared in registry entry; uses your account with the vendor
Registry name	com.microsoft/sentinel-data-exploration · 1.0.1
Source	https://github.com/microsoft/sentinel-data-exploration-mcp
Remote endpoints	https://sentinel.microsoft.com/mcp/data-exploration
Data source	Official MCP Registry
Date checked	2026-10-17

Install

Configs are generated only from packages and remotes on the registry entry. Empty optional flags are listed instead of inserted. Nothing is added that the entry does not declare.

Remote

https://sentinel.microsoft.com/mcp/data-exploration

Claude Desktop · mcpServers

{
  "mcpServers": {
    "microsoft-sentinel": {
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

Cursor · mcpServers

{
  "mcpServers": {
    "microsoft-sentinel": {
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "microsoft-sentinel": {
      "type": "http",
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

Claude Code · .mcp.json

{
  "mcpServers": {
    "microsoft-sentinel": {
      "type": "http",
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

claude mcp add

claude mcp add --transport http microsoft-sentinel https://sentinel.microsoft.com/mcp/data-exploration

FAQ

What transport does Microsoft Sentinel use?

Streamable HTTP (remote).

What credentials are declared for Microsoft Sentinel?

No secrets declared in registry entry; uses your account with the vendor.

When was this checked, and what is the source?

These facts were checked on 2026-10-17. Registry name: com.microsoft/sentinel-data-exploration. Source: https://github.com/microsoft/sentinel-data-exploration-mcp.

Similar servers

Auth0

Security & Identity

Manages Auth0 tenants (applications, APIs, actions, logs, forms) through conversational requests.

stdio (local, npm)

OSCAL (AWS Labs)

Security & Identity

An AWS Labs server for OSCAL security-control documents. It is a different registry entry from the AWS MCP Server.

stdio (local, pypi)

Snyk

Security & Identity

Runs Snyk security scans from an agent so vulnerabilities can be found and fixed in code.

stdio (local, npm)

SonarQube

Security & Identity

SonarSource's local server for code quality and security findings in SonarQube Server or Cloud.

stdio (local, oci)