From d2d196812840f97b1c4cb327de59597304a30a43 Mon Sep 17 00:00:00 2001
From: "detections-ai[bot]"
 <222691694+detections-ai[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:57:37 +0000
Subject: [PATCH] Update file at
 /KQL/tenant-mcp-server-connectivity-risk-assessment.kql

---
 KQL/tenant-mcp-server-connectivity-risk-assessment.kql | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 KQL/tenant-mcp-server-connectivity-risk-assessment.kql

diff --git a/KQL/tenant-mcp-server-connectivity-risk-assessment.kql b/KQL/tenant-mcp-server-connectivity-risk-assessment.kql
new file mode 100644
index 0000000..f4ab5d6
--- /dev/null
+++ b/KQL/tenant-mcp-server-connectivity-risk-assessment.kql
@@ -0,0 +1,9 @@
+AgentsInfo 
+| where Platform == @"LocalAgents"
+| where PublishedStatus == @"Published"
+| where isnotempty(McpServers)
+| summarize arg_max(Timestamp, *) by AgentId
+| mv-expand McpServers
+| extend McpSrv = tolower(tostring(parse_json(McpServers).endpoint))
+| summarize Count=count() by McpSrv
+| sort by Count desc 
\ No newline at end of file