Securitycopilotmcpserver

A Python-based MCP server project that integrates Microsoft Security Copilot and Microsoft Sentinel, supports KQL query execution, skill set management, and security prompt running, and uses Azure authentication.

Security Developer tools #Security integration #KQL query #Skill management #Azure authentication .Python

rating : 2.5 points

downloads : 19

update time : 2025-04-28

What is the Security Copilot MCP Server?

This is a Python-based middleware server that can establish a connection between the Microsoft security ecosystem (including Sentinel and Security Copilot) and your development environment. It is particularly suitable for security analysts and developers to test, deploy, and execute security automation skills.

How to use the MCP server?

Through simple configuration and command-line operations, you can query security data, manage security skills, and implement security automation workflows. The server supports multiple authentication methods to meet the needs of different environments.

Use cases

Security skill development and testing, automated security analysis, cross-platform security data query, and automation of Security Operations Center (SOC) workflows

Main features

Sentinel integrationExecute KQL queries directly in the Microsoft Sentinel workspace to obtain real-time security analysis data

Security Copilot managementView, upload, and update Security Copilot skills/plugins to achieve security automation expansion

Prompt executionRun prompts or predefined skills directly in Security Copilot to test security analysis results

Flexible authenticationSupport multiple Azure authentication methods such as interactive browser, client secret, and managed identity

Advantages and limitations

Advantages

Seamlessly connect the development environment with Microsoft security products

Simplify the development and testing process of security skills

Support multiple authentication methods to adapt to different environments

Provide real-time security data analysis capabilities

Limitations

Requires subscription permissions for Microsoft security products

Currently only supports the Python environment

Advanced features require Azure administrator permissions

How to use

Environment preparation

Ensure that Python 3.8+ is installed and the necessary Azure permissions are obtained

Clone the repository

Get the project source code

Install dependencies

Install the Python libraries required for running

Configure the environment

Edit the.env file to set your authentication and workspace information

Start the server

Run the server program

Usage examples

Security incident investigationQuickly query high-priority security alerts in the past 24 hours

Skill testingTest newly developed security analysis skills

Skill deploymentDeploy the developed security skills to the production environment

Frequently Asked Questions

What Azure permissions are required to use this server?

What authentication methods are supported?

How to test if the server is running normally?

Can it be integrated with the enterprise internal system?

Related resources

GitHub repository

Project source code and latest updates

Microsoft Sentinel documentation

Official Sentinel usage guide

Security Copilot overview

Security Copilot product introduction

Cursor MCP protocol documentation

MCP client configuration reference

🚀 Security Copilot and Sentinel MCP Server

A Python-based MCP server integrated with Microsoft Security Copilot and Microsoft Sentinel using the FastMCP library, supporting authentication via Azure Identity.

Architecture Diagram

🚀 Quick Start

This project implements an MCP server with the following functions:

Execute KQL queries on Microsoft Sentinel.
Upload/update skill sets/plugins in Microsoft Security Copilot.
Execute prompts and skills in Microsoft Security Copilot.

This server acts as a bridge between the development environment and Microsoft Security Copilot, supporting the testing, deployment, and execution of skills and plugins. It is an MCP server using SSE as the transport layer.

There are many use cases for the current integration, and one of the most interesting is supporting the development, testing, and deployment of Security Copilot KQL skills.

Proxy Process 1 Proxy Process 2

✨ Features

Sentinel Integration: Execute KQL queries in the Sentinel workspace.
Security Copilot Management:
- List existing skill sets/plugins.
- Upload new or update existing skill sets/plugins.
- Execute prompts or skills in Security Copilot.
Authentication Support: Multiple authentication methods, including interactive browser, client secret, and managed identity.

🗺️ Roadmap

The upcoming features will include:

Promptbook testing and updating
Running advanced hunting queries in Defender XDR

📋 Prerequisites

Python 3.8+
A Microsoft Sentinel workspace
Access to Microsoft Security Copilot
Appropriate Azure permissions for Sentinel and Security Copilot

📦 Installation

Clone the repository:

git clone https://github.com/jguimera/SecurityCopilotMCPServer.git
cd SecurityCopilotMCPServer

Install the dependencies:
```
pip install -r requirements.txt
```

Create a .env file and configure it as follows:

# Add an app registration to authenticate with a client ID and secret
# AZURE_TENANT_ID=your_tenant_id
# AZURE_CLIENT_ID=your_client_id
# AZURE_CLIENT_SECRET=your_client_secret
SENTINEL_SUBSCRIPTION_ID=your_subscription_id
SENTINEL_RESOURCE_GROUP=your_resource_group
SENTINEL_WORKSPACE_NAME=your_workspace_name
SENTINEL_WORKSPACE_ID=your_workspace_id
# Authentication options: interactive, client_secret
AUTHENTICATION_TYPE=interactive

💻 Usage Examples

Start the Server

Run the MCP server:

python server.py

Run tests before starting the server:

python server.py --run-tests

Available Tools

The tools provided by the MCP server include:

run_sentinel_query: Execute a KQL query in Sentinel.
get_skillsets: List the skill sets in Security Copilot.
upload_plugin: Upload or update a skill set/plugin.
run_prompt: Run a prompt or skill in Security Copilot.

Configure the MCP Client for Cursor

You can use this MCP server from your chosen client. In this repository, you'll find instructions and configuration files for Cursor.

Add a .cursor folder to your client project to enable the MCP tools. This folder contains two files:

Cursor Project Rules (securitycopilotdev.mdc): This file includes some custom Cursor rules to help the proxy understand the process of user prompts.
MCP Client Configuration (mcp.json): The file for connecting to the MCP server.

You can directly call a tool using the /tool_name parameter1="Value of the tool parameter". For example: /run_prompt content="List users with high risks recently"

For more detailed information, refer to: https://docs.cursor.com/context/model-context-protocol#configuring-an-mcp-server