@pmoses-s1/s1-secops-mcp 1.3.4 → 1.3.5

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 1.3.5 - 2026-08-17
+
+Completes the scope work in 1.3.4. **Upgrade from 1.3.4 is recommended.**
+
+### Fixed
+
+- **Query methods ignored `scope`.** 1.3.4 added the `scope` argument to the
+  config-file and dashboard operations but not to the query paths, even though
+  log reads are filtered by the same `S1-Scope` header. A hunt or a
+  panel-validation query run without the intended scope silently answered for
+  the token default, which is the worst shape of this bug: a plausible number
+  for the wrong boundary, with no error.
+
+  Scope now threads through `lrqRun` (launch **and** poll, so the forward-tagged
+  follow-ups stay on the same scope) and through all five Python query methods:
+  `query`, `power_query`, `facet_query`, `numeric_query`, `timeseries_query`.
+  Exposed on the `powerquery_run`, `powerquery_enumerate_sources` and
+  `powerquery_schema_discover` tools.
+
+  Found by using the shipped 1.3.4 client to discover schema at a site scope and
+  getting `power_query() got an unexpected keyword argument 'scope'`.
+
+- **`scopeHeaders` is now exported from `lib/sdl.js`** and imported by the LRQ
+  path in `lib/s1.js`, rather than each surface resolving scope its own way. A
+  second implementation would drift, and the validation rules (numeric ids,
+  `null` suppresses the default) have to be identical on both.
+
+### Tests
+
+- 4 new JS cases: `v1Query` header presence and absence, malformed-scope
+  rejection before any request, and a direct contract test on the exported
+  `scopeHeaders`.
+- 8 new Python cases covering all five query methods, unscoped omission,
+  malformed-scope rejection, and `scope=None` suppression.
+- Totals: 114 JS, 59 Python client, 19 panel-safety. No regressions.
+
+### Docker
+
+Bundle image stays **1.3.2**; its npm pin moves to 1.3.5.
+
 ## 1.3.4 - 2026-08-17
 
 Adds site-level dashboard lifecycle. Two gaps closed: SDL GraphQL calls never

package/README.md

@@ -73,7 +73,7 @@ Add this to `claude_desktop_config.json` (or `.mcp.json` for Claude Code):
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.4"],
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.5"],
       "env": {
         "S1_CONSOLE_URL":       "https://usea1-yourorg.sentinelone.net",
         "S1_CONSOLE_API_TOKEN": "eyJ...",

package/deploy/README.md

@@ -57,7 +57,7 @@ Or, equivalently, by package name without the install:
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.4"]
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.5"]
     }
   }
 }
@@ -376,7 +376,7 @@ Both block the W+X memory mappings V8 needs to JIT JavaScript. Adding them cause
 
 These are supported but not first-class:
 
-- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.4` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
+- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.5` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
 
 - **External bridge (`supergateway`, `mcp-proxy`).** Pre-1.1.0 deployments used these to wrap the stdio-only server. They still work; this server's native HTTP mode is functionally equivalent and removes the extra process. Prefer native unless you have a specific reason.
 

package/lib/s1.js

@@ -9,6 +9,7 @@
  */
 
 import { getCreds } from './credentials.js';
+import { scopeHeaders } from './sdl.js';
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
@@ -191,7 +192,7 @@ export function pickMatchCount(result) {
 }
 
 /** Run a full LRQ PowerQuery lifecycle. Returns { columns, rows, rowCount, matchCount }. */
-export async function lrqRun(query, { startTime, endTime, hours = 24, maxRows = 5000 } = {}) {
+export async function lrqRun(query, { startTime, endTime, hours = 24, maxRows = 5000, scope } = {}) {
   const b = base();
   const tok = jwt();
 
@@ -207,12 +208,17 @@ export async function lrqRun(query, { startTime, endTime, hours = 24, maxRows =
     pq: { query, resultType: 'TABLE' },
   };
 
+  // S1-Scope applies to log reads exactly as it does to config reads: an LRQ
+  // run without the intended scope silently answers for the token default.
+  const scopeHdrs = scopeHeaders(scope);
+
   // Launch
   const launchRes = await fetch(launchUrl, {
     method: 'POST',
     headers: {
       Authorization: `Bearer ${tok}`,
       'Content-Type': 'application/json',
+      ...scopeHdrs,
     },
     body: JSON.stringify(launchBody),
   });
@@ -230,6 +236,7 @@ export async function lrqRun(query, { startTime, endTime, hours = 24, maxRows =
   const pollHeaders = {
     Authorization: `Bearer ${tok}`,
     'Content-Type': 'application/json',
+    ...scopeHdrs,
     ...(forwardTag ? { 'X-Dataset-Query-Forward-Tag': forwardTag } : {}),
   };
 

package/lib/sdl.js

@@ -62,8 +62,10 @@ function resolveScope(scope) {
   return trimmed;
 }
 
-/** Header object carrying S1-Scope, or empty when the request is unscoped. */
-function scopeHeaders(scope) {
+/** Header object carrying S1-Scope, or empty when the request is unscoped.
+ *  Exported so the LRQ path in lib/s1.js scopes identically; a second
+ *  implementation would drift. */
+export function scopeHeaders(scope) {
   const resolved = resolveScope(scope);
   return resolved ? { 'S1-Scope': resolved } : {};
 }

package/lib/server-core.js

@@ -94,7 +94,7 @@ const PROMPTS = [
 
 export const SERVER_INFO = {
   name: 's1-secops-mcp-server',
-  version: '1.3.4',
+  version: '1.3.5',
 };
 
 export const PROTOCOL_VERSION = '2024-11-05';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmoses-s1/s1-secops-mcp",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "MCP server orchestrating SentinelOne skills, APIs, and SOC analyst context. Stdio or Streamable HTTP transport with per-user bearer auth for team deployments.",
   "type": "module",
   "main": "index.js",

package/tools/powerquery.js

@@ -23,15 +23,19 @@ export const tools = [
           description: 'Lookback window in hours (default 24). Increase to 168 (7d) if the last 24h had low volume.',
           default: 24,
         },
+        scope: {
+          type: 'string',
+          description: 'Optional S1-Scope, "<accountId>" or "<accountId>:<siteId>". LOG READS ARE SCOPE-FILTERED just like config reads, so this changes which events the query can see. Use it to hunt within one site, and to validate a site-scoped dashboard panel against the same boundary the dashboard will see. Omit to use S1_SCOPE from credentials.json, or the token default when that is unset.',
+        },
       },
       required: [],
     },
-    async handler({ hours = 24 } = {}) {
+    async handler({ hours = 24, scope } = {}) {
       const query = `| group UniqueDataSourceNames = array_agg_distinct(dataSource.name),
         UniqueVendors = array_agg_distinct(dataSource.vendor),
         UniqueCategories = array_agg_distinct(dataSource.category)
 | limit 1000`;
-      const result = await lrqRun(query, { hours });
+      const result = await lrqRun(query, { hours, scope });
       return JSON.stringify(result, null, 2);
     },
   },
@@ -65,11 +69,15 @@ export const tools = [
           description: 'Client-side cap on rows returned (default 1000). Not a hard backend limit: the LRQ engine returns as many rows as the query\'s own `| limit N` asks for (live-verified 2026-07-29: a `| limit 20000` query returned 20,000 rows in one response). Raise this to match a large `| limit`; the real ceiling is LRQ response size, not a fixed 5000.',
           default: 1000,
         },
+        scope: {
+          type: 'string',
+          description: 'Optional S1-Scope, "<accountId>" or "<accountId>:<siteId>". LOG READS ARE SCOPE-FILTERED just like config reads, so this changes which events the query can see. Use it to hunt within one site, and to validate a site-scoped dashboard panel against the same boundary the dashboard will see. Omit to use S1_SCOPE from credentials.json, or the token default when that is unset.',
+        },
       },
       required: ['query'],
     },
-    async handler({ query, startTime, endTime, hours = 24, maxRows = 1000 }) {
-      const result = await lrqRun(query, { startTime, endTime, hours, maxRows });
+    async handler({ query, startTime, endTime, hours = 24, maxRows = 1000, scope }) {
+      const result = await lrqRun(query, { startTime, endTime, hours, maxRows, scope });
       return JSON.stringify(result, null, 2);
     },
   },
@@ -95,17 +103,21 @@ export const tools = [
           description: 'Lookback string or ISO date, e.g. "24h", "7d", or "2026-04-20T00:00:00Z" (default "24h").',
           default: '24h',
         },
+        scope: {
+          type: 'string',
+          description: 'Optional S1-Scope, "<accountId>" or "<accountId>:<siteId>". Schema discovery is scope-filtered: a source present at one site may be absent at another, so discover at the scope you will query.',
+        },
       },
       required: ['dataSourceName'],
     },
-    async handler({ dataSourceName, maxEvents = 5, startTime = '24h' }) {
+    async handler({ dataSourceName, maxEvents = 5, startTime = '24h', scope }) {
       // Escape backslashes first, then single quotes, to keep tenant-defined
       // source names from breaking (or altering) the V1 filter expression.
       // Quote-only escaping let a trailing backslash neutralise the added
       // escape (e.g. name\' -> \\' which re-opens the string).
       const safeName = String(dataSourceName).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
       const filter = `dataSource.name=='${safeName}'`;
-      const result = await v1Query(filter, { maxCount: Math.min(maxEvents, 50), startTime });
+      const result = await v1Query(filter, { maxCount: Math.min(maxEvents, 50), startTime, scope });
 
       const matches = result.matches || [];
       if (matches.length === 0) {