mcp-defender-xdr
An MCP server that exposes Microsoft Defender XDR — Advanced Hunting KQL, incidents, and alerts — to Claude. Read-only, certificate auth, multi-tenant.
I build AI security tooling for SMBs & enterprise environments — MCP servers, detection pipelines, and red-team evaluations for Microsoft Defender and Sentinel.
Currently Cyber Lead / L3 Tech at Propulsion Tech, a next-gen MSP helping organizations focus on advanced cybersecurity, compliance, and AI & automation.
Selected projects
mcp-sentinel-detection-engine
An MCP server exposing a Sigma → KQL → Microsoft Sentinel Terraform pipeline to Claude. Local stdio, certificate-based Azure auth, read-only by construction.