SentinelOne (Purple)

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.0.6Updated Oct 24, 2026

Multitenant Streamable HTTP wrapper for the SentinelOne purple-mcp server.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Multitenant HTTP wrapper that fronts the SentinelOne purple-mcp server, letting a gateway pass per-tenant SentinelOne credentials as request headers.

What you can do
  • Expose the upstream SentinelOne purple-mcp tools over a single Streamable HTTP endpoint (POST /mcp) plus an unauthenticated GET /health check.
  • Accept per-request SentinelOne credentials as headers (X-S1-API-Token and X-S1-Console-URL, with legacy x-purplemcp-* aliases) instead of environment variables.
  • Spawn one isolated purple-mcp child process per tenant credential pair on a private loopback port and proxy request bodies to it.
  • Evict idle tenant children after a configurable timeout and cap the number of concurrent tenants.
  • Verify a service-to-service HMAC proof header before reading any tenant credentials.
When to use it
Intended for operators running a multi-tenant MCP gateway that must serve several SentinelOne consoles from one container, where each request carries its own org credentials. Not useful for a single-user desktop setup, since it is a gateway-side proxy rather than a direct SentinelOne client.
Requirements
Runs as a local container image (stdio/HTTP proxy) with Node/Fastify and a bundled purple-mcp Python environment. Requires CONDUIT_S2S_SECRET to start, plus per-request headers X-Gateway-S2S, X-S1-API-Token and X-S1-Console-URL. Optional settings include PORT, MCP_HTTP_HOST, IDLE_EVICT_MS, SPAWN_READY_TIMEOUT_MS, MAX_CHILDREN, LOG_LEVEL and PURPLE_MCP_DIR. Network access to the SentinelOne console is needed.
Before you install
Handles SentinelOne API tokens and console URLs on every request; keep the listener on loopback and never commit real secrets. CONDUIT_S2S_SECRET is mandatory and placeholder values are rejected; the insecure dev mode (MCP_ALLOW_INSECURE_DEV=1) disables the service-to-service check and must stay local. Requests missing credentials return 401, and tenant children are spawned per credential pair, so concurrency is capped. The proxy forwards credentials to the upstream purple-mcp child processes…

Installation

In SourceWeft

  1. Open SentinelOne (Purple) in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

sentinelone-mcp

Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.

Why

purple-mcp is a great first-party MCP server, but it reads its SentinelOne console token + URL from environment variables at process startup, which makes it single-tenant per container. Our gateway is multi-tenant: every request carries the calling org's credentials as HTTP headers, and the vendor container has to translate those headers into something the upstream understands.

This image bundles purple-mcp plus a small Node/Fastify proxy. The proxy:

  1. Listens on :8080 with POST /mcp and GET /health.
  2. Requires a valid X-Gateway-S2S proof, then reads X-S1-API-Token and X-S1-Console-URL from that request (legacy x-purplemcp-token / x-purplemcp-base-url still accepted). A request missing either the token or the console URL, after per-field fallback, gets 401, which Conduit's vendor-monitor treats as reachable but auth-gated. There is no fallback to PURPLEMCP_CONSOLE_* in the environment.
  3. Lazily spawns one purple-mcp --mode streamable-http child per (token, base-url) tenant on a private loopback port, with the right env vars set.
  4. Proxies the request body to that child and streams the response back.
  5. Evicts idle children after 60 minutes (IDLE_EVICT_MS).

The result is a single container that the gateway can talk to like any other vendor MCP server.

Configuration

Env varDefaultNotes
PORT8080Public listen port.
MCP_HTTP_HOST0.0.0.0 when a real secret is setBind address. A configured CONDUIT_S2S_SECRET honors this value, including 0.0.0.0. Unset keeps that historical bind. The image and Compose set 0.0.0.0 inside the container and publish 127.0.0.1:8080:8080 on the host.
CONDUIT_S2S_SECRET—Required. Service-to-service secret. The process logs an error and exits non-zero when this is empty or a known placeholder (changeme, secret, replace-me, replace-with-a-real-secret, and the other example values). Generate one with openssl rand -hex 32. Compose will not start without it. The value is never logged.
MCP_ALLOW_INSECURE_DEVunsetSet to exactly 1 only for local development to start without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST refuses to start. A known placeholder secret still refuses to start.
PURPLE_MCP_DIR/opt/purple-mcpWhere purple-mcp source + venv live.
PURPLE_MCP_PYTHON/opt/purple-mcp/.venv/bin/pythonPython interpreter from the upstream venv.
IDLE_EVICT_MS3600000Idle tenant timeout (60 min). Longer keeps children warm and avoids repeated cold starts.
SPAWN_READY_TIMEOUT_MS30000How long to wait for a child to start serving HTTP.
MAX_CHILDREN50Cap on distinct concurrent tenant children. A new-tenant spawn beyond the cap is rejected (502) rather than evicting an existing child.
LOG_LEVELinfoFastify log level. Startup refusals and the insecure-dev warning go to stderr and are not filtered by this level.

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file; put a real value only in an uncommitted .env or the process environment.

Request headers

This server is gateway mode. It does not read PURPLEMCP_CONSOLE_TOKEN or PURPLEMCP_CONSOLE_BASE_URL from the environment for an incoming request. The gateway must forward these headers on every /mcp request. Names are case-insensitive. When both pairs are present, the X-S1-* value wins per field.

HeaderSentinelOne credential
X-Gateway-S2SService-to-service proof. Required on /mcp when CONDUIT_S2S_SECRET is set. Not a SentinelOne credential.
X-S1-API-TokenPURPLEMCP_CONSOLE_TOKEN passed to that request's child (Account- or Site-level service user token). Catalog headerMapping name.
X-S1-Console-URLPURPLEMCP_CONSOLE_BASE_URL passed to that request's child (e.g. https://yourtenant.sentinelone.net). Catalog headerMapping name.
x-purplemcp-tokenLegacy alias for the API token.
x-purplemcp-base-urlLegacy alias for the console URL.

X-Gateway-S2S

With CONDUIT_S2S_SECRET set, every POST /mcp must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 of the literal string t=<unix seconds> keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header is HTTP 401, before tenant credentials are read, and the secret is not logged.

X-Gateway-S2S: t=1710000000,v1=<hmac-sha256 hex of "t=1710000000">

In gateway mode, /mcp also requires X-S1-API-Token and X-S1-Console-URL (or the legacy x-purplemcp-* pair, including a mixed pair). A request missing either credential is HTTP 401 (JSON-RPC -32001) and does not fall back to PURPLEMCP_CONSOLE_* in the process environment. Vendor-monitor's credless initialize probe relies on that: 401/403 means the sidecar is up but auth-gated, while 400 marks the slug DOWN.

GET /health stays unauthenticated and does not read credentials.

Build

bash
docker build -t ghcr.io/wyre-ai/sentinelone-mcp:latest .

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and refuses to start until CONDUIT_S2S_SECRET is set. Publish the port on loopback. SentinelOne credentials arrive on each request as headers; they are not read from the environment.

bash
docker run --rm \  -e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \  -p 127.0.0.1:8080:8080 \  ghcr.io/wyre-ai/sentinelone-mcp:latest

Compose refuses to start when CONDUIT_S2S_SECRET is unset, publishes 127.0.0.1:8080:8080, and does not inject PURPLEMCP_CONSOLE_TOKEN or PURPLEMCP_CONSOLE_BASE_URL:

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up --build

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) makes startup exit:

bash
npm run buildMCP_ALLOW_INSECURE_DEV=1 npm start

License

Apache-2.0. The bundled purple-mcp is MIT-licensed by SentinelOne.

Source: README.md at commit 74b12e4

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.6LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts