Microsoft Sentinel Data Exploration MCP server
Checked 2026-09-07. Alive: no. Handshake: gated.
Category: observability. API and field schema.
Facts
| id | microsoft--sentinel-data-exploration-mcp |
| name | Microsoft Sentinel Data Exploration |
| registry_name | com.microsoft/sentinel-data-exploration |
| repo_url | https://github.com/microsoft/sentinel-data-exploration-mcp |
| endpoint_url | https://sentinel.microsoft.com/mcp/data-exploration |
| transport | streamable-http |
| alive | no |
| liveness_reason | stale |
| check_reachable | yes |
| check_recent_commit | no |
| check_installable | yes |
| handshake_status | gated |
| handshake_checked_at | 2026-09-07T18:08:02Z |
| handshake_protocol_version | not available |
| handshake_auth_hint | Bearer error="invalid_request", error_description="No access token was provided in this request", resource_metadata="https://sentinel.microsoft.com/mcp/.well-known/oauth-protected-resource/data-exploration" |
| handshake_auth_discoverable | resource_metadata |
| handshake_failure_layer | none |
| handshake_latency_ms | 182 |
| handshake_tools_state | not available |
| handshake_tool_count | not available |
| maintenance_status | dormant |
| last_commit_at | 2026-01-14T06:09:26Z |
| category | observability |
| license_spdx | MIT |
How to install or connect
Connect your MCP client to https://sentinel.microsoft.com/mcp/data-exploration.
What the checks mean
alive combines the applicable repository, package, and endpoint checks. A null result is not verifiable, not a failure. The MCP handshake is a separate structural probe and is not a security audit. Read the methodology.