Security Copilot and Sentinel MCP Server

What is Security Copilot and Sentinel MCP Server?

A Python-based MCP server using the FastMCP library that provides integration with Microsoft Security Copilot and Microsoft Sentinel via Azure Identity Authentication. It enables running KQL queries against Sentinel, managing Security Copilot skillsets/plugins, and executing prompts and skills, acting as a bridge between development environments and Microsoft Security Copilot.

How to use Security Copilot and Sentinel MCP Server?

Clone the repository, install dependencies with pip install -r requirements.txt, create a .env file with your Azure and Sentinel configuration, then start the server with python server.py. Optionally run tests with python server.py --run-tests. The server exposes tools that can be invoked from MCP clients like Cursor.

Key features of Security Copilot and Sentinel MCP Server

• Execute KQL queries against Microsoft Sentinel workspaces
• List existing skillsets/plugins in Security Copilot
• Upload or update skillsets/plugins
• Run prompts or skills in Security Copilot
• Supports interactive browser, client secret, and managed identity authentication

Use cases of Security Copilot and Sentinel MCP Server

• Develop, test, and deploy Security Copilot KQL skills
• Integrate Sentinel query results into Security Copilot workflows
• Automate management of Security Copilot plugins and prompts
• Enable AI‑assisted security operations via MCP client (e.g., Cursor)