securitycopilotdev

Project rules for developing and testing components for Microsoft Security Copilot and Sentinel. They explain how to identify, run, validate, and deploy Security Copilot skills, including Sentinel KQL queries.

In plain words
What is it for?
They are for testing KQL skills, running Security Copilot prompts, displaying results for review, and handling required parameters.
Why use it?
They give contributors consistent testing instructions and clarify which inputs are required before a query or skill can run.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/jguimera/securitycopilotmcpserver/securitycopilotdev
Clone the repo
git clone --depth 1 https://github.com/jguimera/SecurityCopilotMCPServer

Made for: Cursor.

Per session 454 This file is loaded in full into every session.
When invoked 454 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00454 $0.00454
Opus 5 $0.00227 $0.00227
Sonnet 5 $0.00091 $0.00091
Haiku 4.5 $0.00045 $0.00045

Measured yesterday against content hash 21fa5e81cc5e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

securitycopilotdev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/securitycopilotdev.mdc · 27 lines

What it actually says

Security Copilot and Sentinel Integration Guidelines

This project is focused on developting and testing components for Microsoft Security Copilot.

When working with Microsoft Security Copilot functionality:

  1. The terms "plugin," "skill," and "skillset" all refer to Microsoft Security Copilot components.

  2. In the Security Copilot architecture, "skillset" and "plugin" are equivalent terms.

  3. For skill testing:

    • Identify Sentinel KQL skills looking at the SkillSet Format and Target fields.
    • To test Sentinel KQL skills use the appropriate Sentinel KQL query MCP tool. Show the results of the KQL execution after running the tool.
    • If required input parameters are missing, please request them to the user. Only parameters inside Ipunts sections are needed, the ones in Settings are already set inside the platform. For the input parameters values always use String type.
    • If asked to test a skill inside Security Copilot run a prompt in for the selected skill using the run prompt skill. Show the results of the prompt to allow user validation. Considering reformating the output to enhance user experience.
    • IF asked to run a full test and deploy a particular skill this is the process you need to follow:
      1. Extract the KQL query from the Yaml File
      2. Run the KQL query in Sentinel with the appropriate Sentinel KQL query MCP tool. Display a summary of the results.
      3. Validate that the results match with the description of the Skill and the intent of the KQL query.
      4. If the previous validation is successful, Upload or Update the Skill in Security Copilot following the intruction below.
      5. Run a Prompt to test the Skill inside Security Copilot.
      6. Create a summary of the resting , the validation and the results. I need to understand if the SKill does what it is suposed to do , if the deployment was sucessfull and if the prompt results align with the initial test.
  4. To deploy, update, or upload a skill/skillset/plugin:

    • Use the appropriate plugin Upload tool
    • Include the complete YAML file content as input for the deployment process
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 27 lines · 454 tokens per session scan A 21fa5e81cc5e

Subscribe to this mod's changes

securitycopilotdev is a cursor rule published in the GitHub repository jguimera/SecurityCopilotMCPServer (23 stars, last pushed 10mo ago), licensed MIT. It adds 454 tokens to every session, about $0.0023 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.