dstreefkerk/ms-sentinel-mcp-server

Implements MCP (Model Context Protocol) with Azure CLI authentication, providing read-only access to Sentinel's KQL query engine, Log Analytics schemas, and incident data alongside Entra ID directory querying—all exposed as discrete tools for LLM consumption. Built around modular tool categories (KQL, incidents, analytics rules, hunting queries, threat intelligence) with built-in KQL validation and mock-data testing to catch query errors before execution. Designed for test/non-production environments only, with explicit warnings against connecting to production Sentinel or public LLMs due to exposure of sensitive security and directory metadata.