An MCP server, that lets an MCP client trigger Microsoft Defender XDR Advanced Hunting
View on GitHub ↗A small Model Context Protocol (MCP) server, written in Node.js, that lets an MCP client (e.g. Claude Desktop) trigger Microsoft Defender XDR advanced hunting KQL queries via the Microsoft Graph security API.
Please note this project was written mostly by Claude and I'm publishing it here for others to use.
It authenticates with the OAuth 2.0 client-credentials flow using an Entra ID app registration, a client secret, and the application permission ThreatHunting.Read.All.
- stdio (default) - what Claude Desktop spawns locally. - HTTP - enable by setting MCPHTTPPORT. Useful for running the server in Docker or on a shared host; every /mcp request must carry a bearer token (MCPACCESSTOKEN). Set MCPHTTPSCERT and MCPHTTPSKEY if you want the server to terminate TLS itself instead of sitting behind a reverse proxy.
Both transports assume Node.js 24 LTS or newer is installed on the machine running Claude Desktop - stdio spawns server.js directly, HTTP shells out to the mcp-remote bridge via npx.
Tool Description ------------------- ------------------------------------------------------------------------------------------------------------ runhuntingquery Runs a KQL string against POST /v1.0/security/runHuntingQuery. Optional timespandays widens the API lookback past the 30-day default. listtables Live discovery of tables this tenant has access to. Cached in-process; pass refresh: true to re-query. describetable Runs \ getschema and returns the column list + types. whoami Diagnostic - shows configured tenant/client IDs and whether a token can be acquired. Never returns secrets.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/rtm516--DefenderAdvancedHuntingMCP.html)
Open-source MCP server for comparing products and asking the buyer before purchase.
sv-number/mcp-serverMCP server for AI agents that need a phone number: order a private number in 200+ countries, read the SMS verification code, hand it back. The widest country coverage in the category, and you can chec
vibeinging/deepseek-harness-desktop-appDeepSeek Harness Desktop App: a local AI desktop workspace for DSH Sessions, projects, files, web research, plugins, and Office artifacts.
shlokkhemani/rabbitholeAn infinite canvas for learning — select text, ask, and answers branch out as documents. MCP server for Claude Code, Codex, and any agent.
livetennisapi/livetennisapi-mcpMCP server for the Live Tennis API — give Claude, Cursor and other LLM agents real-time tennis scores, odds and model win-probability
springvoiceswell/semrush-ai-toolSemrush SEO AI-powered analysis tool MCP server & CLI for keyword research, domain analytics, backlink analysis
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.