Mcp Defender

Lets an assistant run KQL queries against Microsoft Defender Advanced Hunting from natural language requests.

What you can do

This local MCP server connects an assistant to Microsoft Defender Advanced Hunting so it can execute KQL queries. The registry description states it translates natural language into those queries, letting the assistant retrieve hunting data without the user writing KQL by hand. No individual tools are listed in the manifest.

When to use it

Worth adding when you work with Microsoft Defender Advanced Hunting and want an assistant to query that data conversationally instead of writing KQL yourself. It is a desktop-only local process, so it suits individual analyst workstations rather than shared or browser-based setups.

Requirements

Runs as a local stdio process on the user's machine, installed from the PyPI package mcp-defender, so a Python runtime is needed. The manifest declares no authentication, environment variables, or headers, but connecting to Microsoft Defender Advanced Hunting normally requires access to that service; the input does not specify how credentials are supplied.