MCP server for Microsoft Defender Advanced Hunting - execute KQL queries via natural language
MCP server for Microsoft Defender Advanced Hunting - execute KQL queries via natural language. The mcp mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 3 defined tools rather than through you.
An MCP (Model Context Protocol) server for Microsoft Defender Advanced Hunting. Enables AI assistants to investigate security events using natural language by translating queries to KQL and executing them against Defender.
The server ships on npm as @modelcontextprotocol/inspector, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.
Everything the assistant can do here goes through one of these:
Endpoint — https://api.securitycenter.microsoft.comrun_hunting_query — Execute KQL queries against Advanced Huntingget_hunting_schema — Get available tables and columns dynamicallyYou will need 5 environment variables: PYTHONPATH, AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_CERTIFICATE_PATH, AZURE_CLIENT_SECRET. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
AdvancedQuery.Read.All - Run advanced queriesAmong the cloud and infrastructure options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. MCP's toolset — Endpoint, run_hunting_query, get_hunting_schema — is a fair guide to whether it matches your workflow.
This entry was verified against MCP's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Endpoint | https://api.securitycenter.microsoft.com |
| run_hunting_query | Execute KQL queries against Advanced Hunting |
| get_hunting_schema | Get available tables and columns dynamically |
{
"mcpServers": {
"defender": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/inspector"],
"env": {
"PYTHONPATH": "your-value",
"AZURE_TENANT_ID": "your-value",
"AZURE_CLIENT_ID": "your-value",
"AZURE_CLIENT_CERTIFICATE_PATH": "your-value",
"AZURE_CLIENT_SECRET": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
AdvancedQuery.Read.All - Run advanced queries| Variable | Description | Required |
|---|---|---|
| PYTHONPATH | Filesystem location the server is allowed to use. | Optional |
| AZURE_TENANT_ID | Configuration value read at startup. | Optional |
| AZURE_CLIENT_ID | Configuration value read at startup. | Optional |
| AZURE_CLIENT_CERTIFICATE_PATH | Filesystem location the server is allowed to use. | Optional |
| AZURE_CLIENT_SECRET | Credential the server authenticates with. | Yes |
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Stop letting your assistant hallucinate n8n node parameters — this server hands it the real schemas, templates and validation.
AWS Labs' official server suite — current AWS docs, CDK guidance, cost analysis and service tools.
Cloud browsers for AI agents — automation sessions that run in Browserbase's fleet, not on your machine.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Dashboards, Prometheus and Loki queries, incidents and alerts — observability by conversation.