An MCP server, that lets an MCP client trigger Microsoft Defender XDR Advanced Hunting
View on GitHub ↗A small Model Context Protocol (MCP) server, written in Node.js, that lets an MCP client (e.g. Claude Desktop) trigger Microsoft Defender XDR advanced hunting KQL queries via the Microsoft Graph security API.
Please note this project was written mostly by Claude and I'm publishing it here for others to use.
It authenticates with the OAuth 2.0 client-credentials flow using an Entra ID app registration, a client secret, and the application permission ThreatHunting.Read.All.
- stdio (default) - what Claude Desktop spawns locally. - HTTP - enable by setting MCPHTTPPORT. Useful for running the server in Docker or on a shared host; every /mcp request must carry a bearer token (MCPACCESSTOKEN). Set MCPHTTPSCERT and MCPHTTPSKEY if you want the server to terminate TLS itself instead of sitting behind a reverse proxy.
Both transports assume Node.js 24 LTS or newer is installed on the machine running Claude Desktop - stdio spawns server.js directly, HTTP shells out to the mcp-remote bridge via npx.
Tool Description ------------------- ------------------------------------------------------------------------------------------------------------ runhuntingquery Runs a KQL string against POST /v1.0/security/runHuntingQuery. Optional timespandays widens the API lookback past the 30-day default. listtables Live discovery of tables this tenant has access to. Cached in-process; pass refresh: true to re-query. describetable Runs \ getschema and returns the column list + types. whoami Diagnostic - shows configured tenant/client IDs and whether a token can be acquired. Never returns secrets.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/rtm516--DefenderAdvancedHuntingMCP.html)
An infinite canvas for learning — select text, ask, and answers branch out as documents. MCP server for Claude Code, Codex, and any agent.
livetennisapi/livetennisapi-mcpMCP server for the Live Tennis API — give Claude, Cursor and other LLM agents real-time tennis scores, odds and model win-probability
talivia-group/agentRevenue-first website analytics installed and verified by AI agents through MCP
upvoteclub/upvote-club-mcp-mcpbClaude Desktop .mcpb bundle for Upvote.club. Part of upvoteclub/upvote-club-mcp-* family — see core repo for all packages.
upvoteclub/upvote-club-mcp-localSelf-serve stdio MCP for Upvote.club. Part of upvoteclub/upvote-club-mcp-* family — see core repo for all packages.
upvoteclub/upvote-club-mcp-remoteStreamable HTTP remote MCP for Upvote.club. Part of upvoteclub/upvote-club-mcp-* family — see core repo for all packages.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.