Microsoft Sentinel Data Exploration MCP Server

The data exploration tool collection in the Microsoft Sentinel MCP server lets you search for relevant tables and retrieve data from Microsoft Sentinel's data lake using natural language. It is available as a remote MCP endpoint.

Teams that want a hosted security endpoint instead of running a local process.

VERIFIED ACTIVE

LAST COMMIT 2026-01-14 · ★ 2 · #179 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · how we verify → /methodology

01 · Install Microsoft Sentinel Data Exploration

Claude Code

claude mcp add microsoft-sentinel-data-exploration-mcp --transport http https://sentinel.microsoft.com/mcp/data-exploration

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "microsoft-sentinel-data-exploration-mcp": {
      "url": "https://sentinel.microsoft.com/mcp/data-exploration"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://sentinel.microsoft.com/mcp/data-exploration

transport: streamable-http

endpoint alive - authentication required · probed 2026-08-25

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as remote - your agent's requests go to sentinel.microsoft.com

endpoint auth requires authentication - rejected our unauthenticated MCP initialize

license MIT - declared in the repository

registry vendor namespace com.microsoft - domain-verified with the official MCP registry

03 · Who maintains Microsoft Sentinel Data Exploration

Microsoft Sentinel Data Exploration is maintained by microsoft. We track 9 MCP servers from microsoft - 9 actively maintained, 43,350 combined GitHub stars, oldest repo from Mar 2025. Full record: all servers from microsoft.

04 · Facts

repository: github.com/microsoft/sentinel-data-exploration-mcp
website: https://github.com/microsoft/sentinel-data-exploration-mcp
category: security - ranked #179 of 182 actively-maintained security servers as of 2026-08-25.
registry: com.microsoft/sentinel-data-exploration (active, first published 2026-01-15)

05 · Microsoft Sentinel Data Exploration FAQ

What is Microsoft Sentinel Data Exploration?

Is Microsoft Sentinel Data Exploration still maintained?

Yes - as of 2026-08-25, its last commit was 2026-01-14. We re-verify nightly.

How do I install Microsoft Sentinel Data Exploration?

Run `claude mcp add microsoft-sentinel-data-explor --transport http https://sentinel.microsoft.com/mcp/data-exploration`. You can also paste the ready-made client config above.

Does Microsoft Sentinel Data Exploration require authentication?

Yes - when we probed the endpoint on 2026-08-25, it rejected an unauthenticated MCP initialize; you'll need credentials to connect.

06 · Alternatives to Microsoft Sentinel Data Exploration

Alternatives to Microsoft Sentinel Data Exploration

Maintained security servers if Microsoft Sentinel Data Exploration isn't the fit.

Pairs well with

Servers that cover what Microsoft Sentinel Data Exploration doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Boe MCP · Agent Bom · Mythos Agent · Server Malcolm · Repository Intelligence