使用说明
Custom MCP Servers for Security Operations
A collection of custom Model Context Protocol (MCP) servers that bring security operations capabilities to AI platforms like Microsoft Copilot Studio, VS Code, and other MCP-compatible clients.
The Problem
Microsoft provides powerful MCP server collections for security operations (incident triage, threat hunting, data exploration), but not all collections are available on all platforms. For example:
| Sentinel MCP Collection | VS Code | Copilot Studio | Security Copilot |
|---|---|---|---|
| Data Exploration | ✅ | ✅ Built-in | ✅ |
| Graph MCP Server | ✅ | ✅ Built-in | ✅ |
| Triage & Hunting | ✅ | ❌ Not available | ✅ |
The official Triage collection uses an app identity allowlist that blocks third-party App Registrations — meaning it works in VS Code (first-party Microsoft app) but cannot be added as a custom MCP tool in Copilot Studio.
The Solution
This repo provides custom MCP servers that call the same underlying APIs (Microsoft Graph Security, Defender for Endpoint) directly, bypassing the allowlist limitation. They work with any MCP client, including Copilot Studio.
Key Design Principles
- Token passthrough — The servers hold zero credentials. The user's OAuth token is forwarded directly to the downstream API. No secrets to manage, rotate, or leak.
- Stateless — No sessions, no state. Every request is independent. Scales to zero on Azure Container Apps.
- Tenant-agnostic — Deploy once, use from any tenant. Each tenant creates its own App Registration pointing to the shared server.
- RBAC-respecting — Each analyst only sees data their permissions allow, because the API call runs as them.
Available Servers
| Server | Description | Tools | Status |
|---|---|---|---|
| sentinel-triage-mcp | Cases-first triage, case/incident/alert updates & threat hunting via Microsoft Graph Security API | 14 | Stable v1.0 APIs + Cases beta |
| response-actions-mcp | SOC response actions, hostname lookup, action tracking, indicators & file quarantine | 14 | ✅ Production |
sentinel-triage-mcp
Cases-first incident triage, management, and threat hunting via Microsoft Graph Security API. Adds case listing, explicit Case ID/Incident ID resolution, tenant status discovery, and case updates. Existing incident tools prefer /beta/security/caseManagement/cases, with /v1.0/security/incidents fallback on no matching incident case or HTTP 404. Legacy-only query/update capabilities remain intact; accepted case updates are never replayed.
Cases requires delegated CaseManagement.Read.All or CaseManagement.ReadWrite.All, in addition to permissions for the existing incident/alert/hunting operations. Both API versions use the same Graph OAuth connection; no OBO or server credentials are added. CASE_MANAGEMENT_ENABLED=false restores the original incident implementation and response shapes.
Preview notice: Case Management uses Microsoft Graph beta APIs, which Microsoft does not support for production applications. Authentication, permission, throttling, network, and server errors are surfaced instead of hidden by fallback. See the Cases guide for migration, response shapes, and limits.
response-actions-mcp
Write actions for containment and remediation. Companion to sentinel-triage-mcp — after triaging an incident, use this server to take action.
Exposes two separate MCP endpoints to support the two different OAuth scopes required by Copilot Studio:
| Endpoint | API | Tools | Permissions (Delegated) |
|---|---|---|---|
/mcp/identity |
Microsoft Graph | block_user, unblock_user, revoke_sessions, reset_user_password |
User.ReadWrite.All, User.RevokeSessions.All |
/mcp/devices |
Defender for Endpoint | isolate_device, unisolate_device, run_antivirus_scan, restrict_app_execution, unrestrict_app_execution, collect_investigation_package, block_indicator, stop_and_quarantine_file, find_machines, get_machine_action |
Machine.Isolate, Machine.Scan, Machine.RestrictExecution, Machine.CollectForensics, Ti.ReadWrite, Machine.StopAndQuarantine, Machine.ReadWrite (or Machine.Read for lookup only) |
Indicator blocking supports URLs, domains, IP addresses, file hashes, and certificate thumbprints. Every call must explicitly choose device groups or all devices in the tenant. File removal uses Defender's native stop-and-quarantine action on a device and SHA-1 hash, not permanent deletion by file path. Both actions return the Defender resource for tracking; submission does not imply completed enforcement.
find_machines resolves exact hostnames/FQDNs to accessible MDE devices without selecting an ambiguous target. Device actions now return their actual asynchronous machineActionId/status, and get_machine_action reads completion without replaying the action. Compatibility: device-action result is no longer unconditional SUCCESS; consumers must handle pending/final/unknown states. Action tracking requires delegated Machine.ReadWrite; lookup alone can use Machine.Read.
Both servers provide structured API diagnostics with HTTP context and correlation IDs, and clear JSON 404 responses for incorrect MCP routes. These help distinguish permission failures, missing resources, malformed connector URLs, and unconfirmed write outcomes without bypassing authorization or confusing Case/Incident/device IDs. See each server's guide for agent-instruction snippets and error-envelope migration.
Planned Servers
As Microsoft evolves its MCP support, gaps may emerge in other areas. Potential future additions:
| Server | Description | Status |
|---|---|---|
entra-identity-mcp |
Identity investigation — risky users, sign-in logs, conditional access | 💡 Idea |
Architecture
┌─────────────────────────────────────────────────┐
│ Copilot Studio / VS Code │
│ (MCP Client) │
└──────────────────┬──────────────────────────────┘
│ OAuth 2.0 (user's Bearer token)
▼
┌─────────────────────────────────────────────────┐
│ Custom MCP Server │
│ (Azure Container Apps) │
│ │
│ • Stateless JSON-RPC endpoint │
│ • Zero credentials stored │
│ • Forwards user token as-is │
└──────────────────┬──────────────────────────────┘
│ Bearer token passthrough
▼
┌─────────────────────────────────────────────────┐
│ Microsoft Graph Security API │
│ Defender for Endpoint API │
│ (responds based on user's RBAC) │
└─────────────────────────────────────────────────┘
Getting Started
Each server has its own README with detailed setup instructions. The general flow is:
- Deploy the MCP server to Azure Container Apps (one-click or CLI)
- Create an App Registration in the target tenant (Azure Portal)
- Add the MCP tool to your Copilot Studio agent with OAuth 2.0
- Start prompting — triage incidents, hunt for threats, investigate alerts
See the sentinel-triage-mcp README and the response-actions-mcp README for full step-by-step guides.
For an existing deployment, redeploy the updated image, grant admin consent for the new delegated permissions, reconnect the affected OAuth connections, and refresh the MCP tools in the client. The existing endpoint URLs are unchanged.
Tests
npm --prefix sentinel-triage-mcp test
npm --prefix response-actions-mcp test
Each command compiles TypeScript and runs Node's built-in test runner. Tests cover payloads, validation, token handling, existing tools, and local HTTP MCP endpoints with mocked downstream APIs. No tenant actions are executed. Docker builds also run these tests before producing the runtime image.
Contributing
Found a gap in Microsoft's MCP coverage? Have an idea for a new security MCP server? Contributions are welcome:
- Fork the repo
- Create a new folder for your MCP server (e.g.,
defender-endpoint-mcp/) - Follow the same patterns: token passthrough, stateless, no hardcoded credentials
- Submit a PR
License
MIT
