Does this skill allow modifying SentinelOne resources?

No, all tools provided by the Purple MCP server are strictly read-only, focusing on investigation, asset inventory, and data retrieval.

Do I need Node.js to run this SentinelOne integration?

No, the Purple MCP server is a Python-based package. You must have Python installed and use the 'uvx' command to manage the installation.

Why is a Global-level token rejected by the MCP server?

The Purple MCP server requires Service User tokens to be scoped at the Account or Site level for security and architectural reasons; Global tokens will return a 403 Forbidden error.

How do I handle complex PowerQuery syntax?

The recommended best practice is to use the 'purple_ai' tool to generate the correct syntax from a natural language description before executing it via the 'powerquery' tool.

What is the SentinelOne Purple MCP skill?

It is a specialized set of implementation patterns and documentation that allows Claude to interact with SentinelOne's Singularity XDR platform for threat hunting and security reporting.

SentinelOne Purple MCP API Patterns

Name: SentinelOne Purple MCP API Patterns
Author: wyre-technology

bywyre-technology

•

Security & Testing

Provides comprehensive guidance and implementation patterns for integrating SentinelOne's Purple MCP tools into Claude Code workflows.

This skill serves as a master reference for the SentinelOne Purple MCP server, enabling Claude to effectively navigate the Singularity XDR platform's dual API architecture. It provides detailed documentation for 23 specialized tools covering threat investigation with Purple AI, alert management, vulnerability tracking, and PowerQuery execution. By standardizing connection setups, authentication protocols, and transport modes, this skill ensures robust read-only investigation and reporting capabilities within the Claude environment, specifically tailored for Managed Service Providers and security analysts.

Key Features

01Expert instruction on PowerQuery syntax and Purple AI natural language generation

02Implementation patterns for dual GraphQL and REST API architectures

03Troubleshooting guides for transport modes, rate limiting, and connection errors

04Detailed authentication guidance for Service User tokens and Account/Site level scoping

053 GitHub stars

06Comprehensive documentation for 23 Purple MCP tools covering alerts and vulnerabilities

Use Cases

01Automating cybersecurity threat investigations and multi-site alert triaging

02Generating and executing complex PowerQueries via natural language prompts using Purple AI

03Performing read-only asset inventory audits and vulnerability posture reporting

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add wyre-technology/msp-claude-plugins api-patterns

For use in Claude.ai and ChatGPT

Download Skill