SentinelOne (Purple)

Name: SentinelOne (Purple)
Author: WYRE-AI

CommunityIncomplete39/100Claim

oci ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7stdioApache-2.0updated 8d ago

Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.

Source Website

What can you do with SentinelOne (Purple)?

sentinelone-mcp

Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.

Why

purple-mcp is a great first-party MCP server, but it reads its SentinelOne console token + URL from environment variables at process startup, which makes it single-tenant per container. Our gateway is multi-tenant: every request carries the calling org's credentials as HTTP headers, and the vendor container has to translate those headers into something the upstream understands.

This image bundles purple-mcp plus a small Node/Fastify proxy. The proxy:

Listens on :8080 with POST /mcp and GET /health.
Reads x-purplemcp-token and x-purplemcp-base-url from each incoming request.
Lazily spawns one purple-mcp --mode streamable-http child per (token, base-url) tenant on a private loopback port, with the right env vars set.
Proxies the request body to that child and streams the response back.
Evicts idle children after 60 minutes (IDLE_EVICT_MS).

The result is a single container that the gateway can talk to like any other vendor MCP server.

Configuration

Env var	Default	Notes
`PORT`	`8080`	Public listen port.
`PURPLE_MCP_DIR`	`/opt/purple-mcp`	Where purple-mcp source + venv live.
`PURPLE_MCP_PYTHON`	`/opt/purple-mcp/.venv/bin/python`	Python interpreter from the upstream venv.
`IDLE_EVICT_MS`	`3600000`	Idle tenant timeout (60 min). Longer keeps children warm and avoids repeated cold starts.
`SPAWN_READY_TIMEOUT_MS`	`30000`	How long to wait for a child to start serving HTTP.
`MAX_CHILDREN`	`50`	Cap on distinct concurrent tenant children. A new-tenant spawn beyond the cap is rejected (`502`) rather than evicting an existing child.
`LOG_LEVEL`	`info`	Fastify log level.

Request headers

The gateway must forward these headers on every /mcp request:

Header	SentinelOne credential
`x-purplemcp-token`	`PURPLEMCP_CONSOLE_TOKEN` (Account- or Site-level service user token)
`x-purplemcp-base-url`	`PURPLEMCP_CONSOLE_BASE_URL` (e.g. `https://yourtenant.sentinelone.net`)

Build

docker build -t ghcr.io/wyre-ai/sentinelone-mcp:latest .

License

Apache-2.0. The bundled purple-mcp is MIT-licensed by SentinelOne.

Install

Add SentinelOne (Purple) to your client. Pick the one you use.

claude mcp add ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7 -- docker run -i --rm ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7

codex mcp add ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7 -- docker run -i --rm ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7

amp mcp add ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7 -- docker run -i --rm ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ]
    }
  }
}

Add to `claude_desktop_config.json`, then restart Claude Desktop.

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ]
    }
  }
}

Add to `~/.cursor/mcp.json`, or `.cursor/mcp.json` for a single project.

code --add-mcp '{"name":"ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7","command":"docker","args":["run","-i","--rm","ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"]}'

Or add the block manually to `.vscode/mcp.json` under `servers`.

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ]
    }
  }
}

Add to `~/.codeium/windsurf/mcp_config.json`.

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ]
    }
  }
}

Add to `cline_mcp_settings.json` via the MCP Servers panel.

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ]
    }
  }
}

Add to `~/.gemini/settings.json`.

{
  "mcpServers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "type": "local",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
      ],
      "tools": [
        "*"
      ]
    }
  }
}

Add to `~/.copilot/mcp-config.json`, or run `/mcp add` inside the CLI.

{
  "context_servers": {
    "ghcr-io-wyre-ai-sentinelone-mcp-v1-0-7": {
      "command": {
        "path": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7"
        ]
      }
    }
  }
}

Add to your Zed `settings.json`.

docker run -i --rm ghcr.io/wyre-ai/sentinelone-mcp:v1.0.7

Run `goose configure`, choose **Add Extension → Command-line Extension**, and paste this command.