CyberSentinel MCP

Inspiration

Small teams and small businesses usually can't afford enterprise security tools, and full SIEM platforms take a lot of time and hardware to set up. But they still need to answer simple questions every day: Is antivirus running on every PC? Is the firewall on? Who is missing updates? Is there old software that's a risk? I wanted a tool that answers those questions using only what's already built into Windows, and lets you ask an AI about your devices in plain English.

What it does

CyberSentinel MCP collects security information from Windows PCs and shows it on one dashboard.

For every device, it checks:

• Whether Windows Defender antivirus is running and up to date

• Whether the firewall is turned on

• Which updates are installed and if a restart is pending

• The full list of installed software

Each device gets an exposure score from 0 to 100, so you can see which PCs are the riskiest at a glance. It also matches installed software against known vulnerabilities to flag apps that need attention.

The best part is the MCP server. It connects the data to an AI assistant, so instead of clicking through screens you can just ask things like "which devices have the firewall off?" or "show me the riskiest PC" and get an answer from your real data.

How we built it

A PowerShell script runs on each Windows PC as a scheduled task and sends a security report to the cloud. The data is stored in Supabase with row level security turned on, and a Next.js dashboard on Vercel displays everything. On top of that, I built an MCP server with eight tools, so AI assistants can query the whole fleet directly. Everything uses free tools and built-in Windows features, with no paid security licenses needed.

Challenges we ran into

Making the exposure score fair and easy to understand was tricky. I wanted people to see exactly why a device got its score, not just a number. Collecting reliable data from different Windows setups using only PowerShell also took a lot of testing. And keeping the agent secure was important, since a security tool should never become the weak point itself.

Accomplishments that we're proud of

It works end to end with real data, no mock data anywhere. A small team can get a clear view of their device security for free, and anyone can ask questions about it without learning a dashboard.

What we learned

MCP changes how people use security data. Being able to just ask a question is much faster than building another report. I also learned a lot about designing a scoring system that's simple but still meaningful.

What's next for CyberSentinel MCP

Alerts when a device's score suddenly gets worse, support for Mac and Linux devices, and an option to connect with Wazuh for deeper threat detection.

Built With

• defender
• javascript
• mcp
• next.js
• powershell
• supabase
• vercel