docs: purple-mcp uses the canonical S1_* variables; SDL REST is on the console host - #87
Merged
marcorottigni-s1 merged 1 commit intoAug 7, 2026
Conversation
…e console host Follow-up to Sentinel-One#86. - docs/installation.md and docs/vm-deployment.md configured purple-mcp with PURPLEMCP_CONSOLE_TOKEN / PURPLEMCP_CONSOLE_BASE_URL. The image entrypoint derives both from S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, so the examples now use the canonical two. Verified live against the 1.3.1 image. - README advertised :1.2.3 bundling s1-secops-mcp 1.2.2; now :1.3.1 / 1.3.1. - sdl-api, sdl-dashboard and the RBA workflow template still described the SDL REST endpoints as living on xdr.us1; they are reachable at <console>/sdl/api/* with identical results. Left alone: the LRQ docs that name xdr.us1 to warn against it, the V1 deprecation notices, and the hyperautomation catalogs where the host is mined corpus data. Plugin rebuilt at 1.3.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #86. Corrects documentation that still described the pre-1.3.x topology, and re-syncs three skills that changed in claude-skills after #86 was cut.
Configuration examples still used the old purple-mcp variables
docs/installation.mdanddocs/vm-deployment.mdconfigured purple-mcp withPURPLEMCP_CONSOLE_TOKENandPURPLEMCP_CONSOLE_BASE_URL. When running through the s1-mcps image the entrypoint derives both fromS1_CONSOLE_URLandS1_CONSOLE_API_TOKEN, so those examples taught a second set of names for no reason. Both files now use the canonical two.Verified live against the published
1.3.1image: purple-mcp completesinitializewith onlyS1_CONSOLE_URLandS1_CONSOLE_API_TOKENset.Stale version claim
README.mdadvertised:1.2.3as the current pinned release bundling s1-secops-mcp 1.2.2. Now:1.3.1/ 1.3.1.SDL host references that described the old topology
The SDL REST endpoints are reachable at
<console>/sdl/api/*and return results identical to the regional XDR host, so guidance no longer sends people to a second hostname:skills/sdl-api/SKILL.md— the sandbox-proxy notes claimed the shell blocks HTTPS toxdr.us1.sentinelone.netspecifically and that the MCP tools call it; both now refer to*.sentinelone.netand the console host. The trigger description also droppedxdr.us1as a keyword.skills/sdl-dashboard/references/lessons-learned.md— same sandbox-proxy wording.skills/sdl-solutions/assets/rba_collector.workflow.template.json— the_commentpointed the synchronous PowerQuery endpoint at the xdr/SDL host; it is the console host. JSON re-validated.Deliberately unchanged: the LRQ docs in
mgmt-console-apiandpowerqueryname that host in order to warn against it,CHANGELOG/release notes carry the V1 deprecation and sunset date, and the hyperautomation catalogs record it as observed data mined from real workflows.Verification
Dockerfile,entrypoint.sh,build.shbyte-identical.