SentinelOne (Purple)

Name: SentinelOne (Purple)
Author: wyre-technology

作者：wyre-technology版本 1.0.6i★ –i在你的电脑上运行

注册名称io.github.wyre-technology/sentinelone-mcp

安装

概览

作者提供的说明（英文原文）

Multitenant Streamable HTTP wrapper for the SentinelOne purple-mcp server.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 其他

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： PORT, IDLE_EVICT_MS, SPAWN_READY_TIMEOUT_MS, LOG_LEVEL

你需要

Docker已安装 Docker

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "sentinelone": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "PORT",
        "-e",
        "IDLE_EVICT_MS",
        "-e",
        "SPAWN_READY_TIMEOUT_MS",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/sentinelone-mcp:v1.0.6"
      ],
      "env": {
        "PORT": "your-value",
        "IDLE_EVICT_MS": "your-value",
        "SPAWN_READY_TIMEOUT_MS": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add sentinelone --env PORT=your-value --env IDLE_EVICT_MS=your-value --env SPAWN_READY_TIMEOUT_MS=your-value --env LOG_LEVEL=your-value -- docker run -i --rm -e PORT -e IDLE_EVICT_MS -e SPAWN_READY_TIMEOUT_MS -e LOG_LEVEL ghcr.io/wyre-technology/sentinelone-mcp:v1.0.6

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "sentinelone": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "PORT",
        "-e",
        "IDLE_EVICT_MS",
        "-e",
        "SPAWN_READY_TIMEOUT_MS",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/sentinelone-mcp:v1.0.6"
      ],
      "env": {
        "PORT": "your-value",
        "IDLE_EVICT_MS": "your-value",
        "SPAWN_READY_TIMEOUT_MS": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "sentinelone": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "PORT",
        "-e",
        "IDLE_EVICT_MS",
        "-e",
        "SPAWN_READY_TIMEOUT_MS",
        "-e",
        "LOG_LEVEL",
        "ghcr.io/wyre-technology/sentinelone-mcp:v1.0.6"
      ],
      "env": {
        "PORT": "your-value",
        "IDLE_EVICT_MS": "your-value",
        "SPAWN_READY_TIMEOUT_MS": "your-value",
        "LOG_LEVEL": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

PORT env
Public listen port for the proxy (POST /mcp, GET /health)
IDLE_EVICT_MS env
Idle tenant timeout before a purple-mcp child is evicted (ms)
SPAWN_READY_TIMEOUT_MS env
How long to wait for a spawned child to start serving HTTP (ms)
LOG_LEVEL env
Fastify log level: debug, info, warn, error

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 wyre-technology 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“其他”中的其他服务器比较i

星标数多于此分类中其他 18499 个服务器的 0%
发布到注册中心的时间比此分类中其他 18499 个服务器的 28% 更新
基础检查结果等于或优于此分类中其他 18499 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

SentinelOne (Purple) 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（1.0.6）于3个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Docker。

有什么可以替代它？

同一分类中有：Spec Driven Development, Remote Desktop Commander, SolveHub

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

作者：formulahendry起步阶段↓ 66/周★ 44014个月前更新

在你的电脑上运行

安装

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

作者：desktop-commander正在增长★ 2113天前更新

在云端运行✓ desktopcommander.app

安装

SolveHub

CAPTCHA and anti-bot solving for Turnstile, DataDome, Akamai, PerimeterX and Imperva.

作者：seencxy非常新今天更新

在你的电脑上运行

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

sentinelone-mcp

Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.

Why

purple-mcp is a great first-party MCP server, but it reads its SentinelOne console token + URL from environment variables at process startup, which makes it single-tenant per container. Our gateway is multi-tenant: every request carries the calling org's credentials as HTTP headers, and the vendor container has to translate those headers into something the upstream understands.

This image bundles purple-mcp plus a small Node/Fastify proxy. The proxy:

Listens on :8080 with POST /mcp and GET /health.
Requires a valid X-Gateway-S2S proof, then reads X-S1-API-Token and X-S1-Console-URL from that request (legacy x-purplemcp-token / x-purplemcp-base-url still accepted). A request missing either the token or the console URL, after per-field fallback, gets 401, which Conduit's vendor-monitor treats as reachable but auth-gated. There is no fallback to PURPLEMCP_CONSOLE_* in the environment.
Lazily spawns one purple-mcp --mode streamable-http child per (token, base-url) tenant on a private loopback port, with the right env vars set.
Proxies the request body to that child and streams the response back.
Evicts idle children after 60 minutes (IDLE_EVICT_MS).

The result is a single container that the gateway can talk to like any other vendor MCP server.

Configuration

Env var	Default	Notes
`PORT`	`8080`	Public listen port.
`MCP_HTTP_HOST`	`0.0.0.0` when a real secret is set	Bind address. A configured `CONDUIT_S2S_SECRET` honors this value, including `0.0.0.0`. Unset keeps that historical bind. The image and Compose set `0.0.0.0` inside the container and publish `127.0.0.1:8080:8080` on the host.
`CONDUIT_S2S_SECRET`	—	Required. Service-to-service secret. The process logs an error and exits non-zero when this is empty or a known placeholder (`changeme`, `secret`, `replace-me`, `replace-with-a-real-secret`, and the other example values). Generate one with `openssl rand -hex 32`. Compose will not start without it. The value is never logged.
`MCP_ALLOW_INSECURE_DEV`	unset	Set to exactly `1` only for local development to start without `CONDUIT_S2S_SECRET`. The process logs a warning, does not enforce `X-Gateway-S2S`, and binds `127.0.0.1` only. A non-loopback `MCP_HTTP_HOST` refuses to start. A known placeholder secret still refuses to start.
`PURPLE_MCP_DIR`	`/opt/purple-mcp`	Where purple-mcp source + venv live.
`PURPLE_MCP_PYTHON`	`/opt/purple-mcp/.venv/bin/python`	Python interpreter from the upstream venv.
`IDLE_EVICT_MS`	`3600000`	Idle tenant timeout (60 min). Longer keeps children warm and avoids repeated cold starts.
`SPAWN_READY_TIMEOUT_MS`	`30000`	How long to wait for a child to start serving HTTP.
`MAX_CHILDREN`	`50`	Cap on distinct concurrent tenant children. A new-tenant spawn beyond the cap is rejected (`502`) rather than evicting an existing child.
`LOG_LEVEL`	`info`	Fastify log level. Startup refusals and the insecure-dev warning go to stderr and are not filtered by this level.

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file; put a real value only in an uncommitted .env or the process environment.

Request headers

This server is gateway mode. It does not read PURPLEMCP_CONSOLE_TOKEN or PURPLEMCP_CONSOLE_BASE_URL from the environment for an incoming request. The gateway must forward these headers on every /mcp request. Names are case-insensitive. When both pairs are present, the X-S1-* value wins per field.

Header	SentinelOne credential
`X-Gateway-S2S`	Service-to-service proof. Required on `/mcp` when `CONDUIT_S2S_SECRET` is set. Not a SentinelOne credential.
`X-S1-API-Token`	`PURPLEMCP_CONSOLE_TOKEN` passed to that request's child (Account- or Site-level service user token). Catalog `headerMapping` name.
`X-S1-Console-URL`	`PURPLEMCP_CONSOLE_BASE_URL` passed to that request's child (e.g. `https://yourtenant.sentinelone.net`). Catalog `headerMapping` name.
`x-purplemcp-token`	Legacy alias for the API token.
`x-purplemcp-base-url`	Legacy alias for the console URL.

X-Gateway-S2S

With CONDUIT_S2S_SECRET set, every POST /mcp must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t= ,v1= , where the hex is HMAC-SHA256 of the literal string t= keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header is HTTP 401, before tenant credentials are read, and the secret is not logged.

X-Gateway-S2S: t=1710000000,v1=<hmac-sha256 hex of "t=1710000000">

In gateway mode, /mcp also requires X-S1-API-Token and X-S1-Console-URL (or the legacy x-purplemcp-* pair, including a mixed pair). A request missing either credential is HTTP 401 (JSON-RPC -32001) and does not fall back to PURPLEMCP_CONSOLE_* in the process environment. Vendor-monitor's credless initialize probe relies on that: 401/403 means the sidecar is up but auth-gated, while 400 marks the slug DOWN.

GET /health stays unauthenticated and does not read credentials.

Build

docker build -t ghcr.io/wyre-ai/sentinelone-mcp:latest .

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and refuses to start until CONDUIT_S2S_SECRET is set. Publish the port on loopback. SentinelOne credentials arrive on each request as headers; they are not read from the environment.

docker run --rm \

-e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \ -p 127.0.0.1:8080:8080 \ ghcr.io/wyre-ai/sentinelone-mcp:latest

Compose refuses to start when CONDUIT_S2S_SECRET is unset, publishes 127.0.0.1:8080:8080, and does not inject PURPLEMCP_CONSOLE_TOKEN or PURPLEMCP_CONSOLE_BASE_URL:

CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up --build

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) makes startup exit:

npm run build

MCP_ALLOW_INSECURE_DEV=1 npm start

License

Apache-2.0. The bundled purple-mcp is MIT-licensed by SentinelOne.