Your Auditor Called. Purple AI Already Has the Answers.

How SentinelOne customers are using Claude Code and the Purple AI MCP to respond to security audits in minutes instead of weeks.

Last Tuesday, Anthropic announced Claude Mythos Preview… and the cybersecurity world lost its mind.

The model, which Anthropic is deliberately withholding from public release, can find and exploit zero-day vulnerabilities in every major operating system and every major web browser. Decades-old bugs. Autonomous exploit chains. A 27-year-old vulnerability in OpenBSD. The announcement triggered emergency meetings between Fed Chair Powell, Treasury Secretary Bessent, and the CEOs of America’s largest banks.

My phone started ringing.

Customers wanted to know: What can SentinelOne do about this? How do we prove our security posture to auditors who are going to be asking harder questions? How do we respond faster?

The answer surprised some of them because it was already in their hands.

SentinelOne already has an AI security assistant

While the world was reacting to Mythos, SentinelOne customers have been quietly using Purple AI for years: our AI-powered security analyst built directly into the Singularity Platform. Purple AI understands natural language, queries your live security environment, and provides sourced, documentation-backed answers about your security posture.

And now, with the release of the Purple AI MCP Server (open source on GitHub), that same intelligence is available anywhere you can run an MCP client — including Claude Code and Claude Cowork.

This means you can now sit in your terminal, ask questions about your SentinelOne environment in plain English, and get auditor-ready answers backed by live evidence from your own console. No browser tab-switching. No manual data exports. No spreadsheet hell.

What Is the Purple AI MCP?

The Purple AI MCP Server is an open-source Model Context Protocol (MCP) server that connects any MCP-compatible AI client to your SentinelOne Singularity Platform.

What it exposes:

• Purple AI — ask natural language questions about your security capabilities
• Alerts — search, filter, and investigate alerts with full audit trail history
• Vulnerabilities — query your vulnerability posture with EPSS, KEV, and severity breakdowns
• Misconfigurations — review cloud and infrastructure security findings
• Asset Inventory — prove endpoint coverage across your managed estate
• PowerQuery — run threat hunting queries against the Singularity Data Lake

What it can’t do: The MCP is read-only. It cannot modify alerts, deploy agents, change policies, or take any response actions. It reads data from your console — nothing more. This is a research and evidence-gathering tool, not an operational one.

Getting Started: Installation in 3 Steps

Step 1: Install Claude Code

brew install claude

Step 2: Connect the Purple AI MCP

You’ll need a Service User token from your SentinelOne console. Create one in Policy & Settings → User Management → Service Users.

Then run this command in your terminal (replace with your token and console URL — no trailing slash):

claude mcp add purple-mcp \
  --scope user \
  --env PURPLEMCP_CONSOLE_TOKEN=YOURTOKEN \
  --env PURPLEMCP_CONSOLE_BASE_URL=https://usea1-purple.sentinelone.net \
  -- uvx --from git+https://github.com/Sentinel-One/purple-mcp.git purple-mcp --mode stdio

Note: You’ll need uv installed. If you don’t have it: curl -LsSf https://astral.sh/uv/install.sh | sh

Step 3: Install the Security Audit Skill

The skill is a SKILL.md file that teaches Claude Code how to structure your audit responses using a PARA framework — automatically organizing your research, evidence, and documentation references into a reusable knowledge base.

mkdir -p ~/.claude/skills/s1-audit-assistant
cp SKILL.md ~/.claude/skills/s1-audit-assistant/SKILL.md

That’s it. Launch Claude Code with claude and you’re ready to go.

How Customers Are Using It

Scenario: SOC 2 Type II Audit

Your auditor asks: “Describe how the organization identifies and manages technical vulnerabilities.”

Instead of spending hours pulling screenshots from the console and writing responses in Word, you type:

Start audit for acme-soc2. Framework is SOC 2 Type II. 
Answer control CC7.1: vulnerability identification and management.

Claude Code does the following — automatically:

1. Scaffolds a PARA directory structure on disk — Projects, Areas, Resources, Archive — so every answer, every piece of evidence, and every documentation link is organized and reusable
2. Queries Purple AI to explain how SentinelOne satisfies CC7.1, pulling official documentation links
3. Pulls live evidence from your environment — total critical vulnerabilities, actively exploited CVEs, CISA KEV catalog coverage, remediation lifecycle proof
4. Writes an auditor-ready response to a markdown file with the control requirement quoted, a clear coverage statement, capability description, live evidence with timestamps, and documentation references
5. Updates a tracker so you can see which controls are done, which have gaps, and which are pending

The response includes a Gaps & Compensating Controls section — because SentinelOne covers endpoint security, not your entire security program. The skill is honest about scope boundaries: SentinelOne doesn’t cover physical security, network firewalls, identity providers, or backup solutions. Auditors respect that honesty.

Scenario: Drop Files, Get Answers

Got a 40-page audit questionnaire as a PDF? Drop it in the inbox folder:

s1-audit/0-inbox/soc2-questionnaire.pdf

Then tell Claude Code to process it:

Process inbox

The skill uses Microsoft MarkItDown to read the PDF, parses every control question, classifies them by domain, and populates the tracker — ready for you to start answering. If you’ve also dropped additional datasheets or previous audit findings in the inbox, those get extracted and routed too.

Scenario: Proving Detection Coverage

Your auditor wants evidence that your security monitoring is effective. Claude Code can pull this directly from your environment:

• Total alert volume over the past 90 days, broken down by severity
• A specific CRITICAL alert showing the full investigation lifecycle — detection, assignment, resolution
• Analyst notes and audit trail for that alert
• Threat hunting queries executed against the Data Lake

Every piece of evidence includes a timestamp (auditors care when evidence was collected) and reproduction steps (the exact MCP tool calls so the evidence can be refreshed right before fieldwork).

The PARA Structure: Knowledge That Compounds

The most powerful aspect of this skill isn’t any single audit response — it’s the fact that your knowledge compounds across audits.

The PARA (Projects, Areas, Resources, Archive) structure separates project-specific work (this year’s SOC 2 audit) from reusable knowledge (how SentinelOne handles vulnerability management). When you answer a question about ransomware detection for your SOC 2 audit, that knowledge also gets written to a canonical Area file. Next year — or next month when your ISO 27001 auditor asks the same thing — Claude Code finds the existing knowledge and uses it as a starting point, only querying Purple AI for updates.

s1-audit/
├── 0-inbox/                    ← Drop files here
├── 1-projects/acme-soc2/       ← This year's audit
├── 2-areas/                    ← Reusable knowledge (compounds over time)
├── 3-resources/                ← Documentation links, framework mappings
└── 4-archive/                  ← Last year's completed audit

After a few audits, you have a comprehensive, source-linked knowledge base of exactly how your SentinelOne deployment maps to every major compliance framework — built from your own environment data, not generic marketing material.

What This Means Post-Mythos

The Mythos announcement doesn’t change what SentinelOne does — it validates why it matters.

Auditors are going to ask harder questions. Regulators are going to demand more evidence. Boards are going to want more frequent proof of security posture. The traditional approach of manually gathering screenshots, copying data into spreadsheets, and writing responses in Word documents doesn’t scale to meet that demand.

With the Purple AI MCP and Claude Code, you can produce auditor-ready evidence directly from your live security environment, structured and documented in a format that survives audit scrutiny. And because the PARA structure preserves and compounds your knowledge, each audit gets faster than the last.

The question isn’t whether AI-powered vulnerability discovery is coming. Mythos made it clear that it’s already here. The question is whether your security evidence can keep pace with the questions that follow.

If you’re a SentinelOne customer, it already can.

Resources:

• Purple AI MCP Server — GitHub (open source)
• Purple AI — SentinelOne
• Claude Code — Anthropic
• Model Context Protocol — Anthropic

The Security Audit Skill (SKILL.md) referenced in this post is available here: https://github.com/plcharbonneau/SKILLS/blob/main/s1-audit-assistant