The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the SentinelOne (Purple) listing page.
Multitenant Streamable HTTP wrapper for sentinel-one/purple-mcp, built so the wyre-technology MCP gateway can forward per-tenant SentinelOne credentials as HTTP headers.
purple-mcp is a great first-party MCP server, but it reads its SentinelOne console token + URL from environment variables at process startup, which makes it single-tenant per container. Our gateway is multi-tenant: every request carries the calling org's credentials as HTTP headers, and the vendor container has to translate those headers into something the upstream understands.
This image bundles purple-mcp plus a small Node/Fastify proxy. The proxy:
:8080 with POST /mcp and GET /health.x-purplemcp-token and x-purplemcp-base-url from each incoming request.purple-mcp --mode streamable-http child per (token, base-url) tenant on a private loopback port, with the right env vars set.IDLE_EVICT_MS).The result is a single container that the gateway can talk to like any other vendor MCP server.
| Env var | Default | Notes |
|---|---|---|
PORT | 8080 | Public listen port. |
PURPLE_MCP_DIR | /opt/purple-mcp | Where purple-mcp source + venv live. |
PURPLE_MCP_PYTHON | /opt/purple-mcp/.venv/bin/python | Python interpreter from the upstream venv. |
IDLE_EVICT_MS | 3600000 | Idle tenant timeout (60 min). Longer keeps children warm and avoids repeated cold starts. |
SPAWN_READY_TIMEOUT_MS | 30000 | How long to wait for a child to start serving HTTP. |
MAX_CHILDREN | 50 | Cap on distinct concurrent tenant children. A new-tenant spawn beyond the cap is rejected (502) rather than evicting an existing child. |
LOG_LEVEL | info | Fastify log level. |
The gateway must forward these headers on every /mcp request:
| Header | SentinelOne credential |
|---|---|
x-purplemcp-token | PURPLEMCP_CONSOLE_TOKEN (Account- or Site-level service user token) |
x-purplemcp-base-url | PURPLEMCP_CONSOLE_BASE_URL (e.g. https://yourtenant.sentinelone.net) |
Apache-2.0. The bundled purple-mcp is MIT-licensed by SentinelOne.