Custom Servers

This repository addresses a common challenge where official Microsoft Model Context Protocol (MCP) server collections for critical security operations, such as incident triage and threat hunting, are not uniformly available across all platforms. Specifically, these official collections might be blocked from third-party app registrations in environments like Copilot Studio. The solution offers custom-built MCP servers that bypass these limitations by directly calling underlying APIs like Microsoft Graph Security and Defender for Endpoint, ensuring that security operations capabilities are accessible from any MCP-compatible client. These servers are designed with key principles such as token passthrough, statelessness, tenant-agnostic deployment, and RBAC-respecting interactions to ensure security, scalability, and broad applicability.

Key Features

Use Cases