MCP Defender is a free MCP server designed to bridge AI applications with Microsoft Defender Advanced Hunting. Developed by MCP Defender, this tool operates on the mcp platform, enabling security analysts and AI assistants to interact with Defender's security data. It uses Python 3.10+ and connects to Azure AD for authentication, providing a structured way to query and interpret security events. This server supports advanced threat investigation and incident response workflows.

What does MCP Defender connect to?

MCP Defender serves as an MCP (Model Context Protocol) server, establishing connections primarily with the Microsoft Defender Advanced Hunting API. It also integrates with Azure AD to manage authentication and access control. This setup allows it to act as a crucial intermediary, translating requests from various AI assistants into actionable queries for Defender. Its core function is to provide a secure and structured interface for security data interactions within the mcp ecosystem.

Core features and tools

MCP Defender offers capabilities centered on security event investigation. It provides the ability to execute KQL queries directly against the Defender Advanced Hunting API. A key feature is its dynamic schema discovery, which enables fetching available tables and columns from the connected Defender instance. While specific callable tools are not explicitly named, these features allow AI assistants to interact with Defender's data effectively for threat analysis.

Who is it for?

MCP Defender is built for security analysts and AI assistants involved in threat detection and incident response. It helps these users by enabling natural language interaction with Microsoft Defender Advanced Hunting data, simplifying complex query processes. This server is particularly useful for organizations aiming to enhance their security operations with AI-driven insights. Skip this if your security operations do not rely on Microsoft Defender Advanced Hunting.

How to get started

The server authenticates using certificate authentication via Azure AD certificates or client secret authentication. Credentials, including tenant ID, client ID, and either a certificate path or client secret, are configured in a .env file, and it supports streamable HTTP as a transport protocol.

Use cases

• AI translates natural language queries (e.g., "Show me suspicious PowerShell activity in the last hour") into KQL, executes them against the Defender API, and interprets the results.
• AI assistants investigate incidents, hunt threats, manage devices, and query vulnerabilities using natural language.
• Execute KQL queries against Defender's Advanced Hunting API.

MCP Defender provides a specialized bridge for AI assistants and security analysts to interact with Microsoft Defender Advanced Hunting. Its design supports advanced security event investigation and threat hunting through KQL queries and dynamic schema discovery. The server's reliance on Azure AD for authentication ensures secure access to sensitive data.