Connectors · Identity & security
BeyondTrust Password Safe MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to BeyondTrust Password Safe and the rest of your systems. It gives your agent 272 BeyondTrust Password Safe actions (131 reads, 77 writes and 64 that wait for a confirmation) and holds the BeyondTrust Password Safe credential itself, so the agent never does. It paces BeyondTrust Password Safe's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "beyondtrust_password_safe.users.list", intent: "check which BeyondTrust Password Safe account is connected"}# Get users · read · 1 upstream call- 272actionsin one signed file
- 131readlook, never change
- 77writecreate and update
- 64wait for a yesdestructive, confirmed first
Set up
Connect BeyondTrust Password Safe in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect BeyondTrust Password Safe.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idClient ID of a BeyondInsight Application userclient_secretClient secret of that Application user (it can be recycled with users.recycleclientsecret)hostWhere your BeyondTrust Password Safe lives: your host
account { op: "connections.requirements", service: "beyondtrust_password_safe" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "beyondtrust_password_safe.users.list" }# get users · read · 1 upstream callcheck { action: "beyondtrust_password_safe.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
BeyondTrust Password Safe at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
host- Limits we pace to
- 300 calls a minute, per connection
- API covered
- BeyondInsight and Password Safe public API v3 (OpenAPI 3.0 fragments per operation), at your BeyondTrust Password Safe instance's API base URL, which you enter when connecting (path /BeyondTrust/api/public/v3)
- Built from
- BeyondTrust Password Safe's documentation, read 23 October 2026docs.beyondtrust.comdocs.beyondtrust.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 91 of 131 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line BeyondTrust Password Safe up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in BeyondTrust Password Safe.
272 actions in 49 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 131readlook, never change
- 77writecreate and update
- 64destructivewait for a confirmation
Secrets safe
3516 read · 13 write · 6 destructive
Create folder · Create credential secret · Create text secret · Create safe
Managedaccounts
278 read · 7 write · 12 destructive
Assign application to managed account · Assign attribute to managed account · Assign propagation actions to managed account · Create Synced Account
Managedsystems
205 read · 5 write · 10 destructive
Assign attribute to managed system · Create Linked Account · Create Managed Account in Managed System · Get Managed Systems
Usergroups
156 read · 5 write · 4 destructive
Get user groups · Create new user group · Get user group · Delete user group by ID
Quickrules
134 read · 5 write · 4 destructive
Create Quick Rule · Add Managed Account to Quick Rule · Add Managed System to Quick Rule · Get all Quick Rules
Assets
125 read · 4 write · 3 destructive
Search assets · Get by ID · Update asset · Delete by ID
Users
113 read · 3 write · 5 destructive
Get users · Create user account · Get User · Update user
Workgroups
115 read · 5 write · 1 destructive
Create workgroup · Create asset workgroup by ID · Create asset workgroup by name · Create directory in workgroup
41 more areas · 128 actions
- Smartrules 10
- Addressgroups 8
- Organizations 8
- Apiregistrations 7
- Requests 7
- Attributetypes 6
- Databases 6
- Directories 6
- Sessions 6
- Functionalaccounts 5
- Aliases 4
- Customplatforms 4
- Oracleinternetdirectories 4
- PBSM 4
- Accesspolicies 3
- Addresses 3
- Keystrokes 3
- Applications 2
- Attributes 2
- Credentials 2
- Dsskeyrules 2
- Entitytypes 2
- Passwordrules 2
- Platforms 2
- Propagationactions 2
- Requestsets 2
- Useraudits 2
- Accesslevels 1
- Auth 1
- Configuration 1
- Entitlements 1
- Epmpolicies 1
- Isarequests 1
- Isasessions 1
- Nodes 1
- Operatingsystems 1
- Permissions 1
- Propagationactiontypes 1
- Roles 1
- Subscriptions 1
- Ticketsystems 1
Top actions
The BeyondTrust Password Safe API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 15 of BeyondTrust Password Safe's 15 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
beyondtrust_password_safe.users.listGet users | Get users. | read | identity.user.list474 connectors |
beyondtrust_password_safe.usergroups.listGet user groups | Get user groups. | read | identity.group.list262 connectors |
beyondtrust_password_safe.roles.listGet all roles | Get all roles. | read | identity.role.list184 connectors |
beyondtrust_password_safe.users.createCreate user account | Create user account. | write | identity.user.create262 connectors |
beyondtrust_password_safe.usergroups.createCreate new user group | Create new user group. | write | identity.group.create205 connectors |
beyondtrust_password_safe.users.updateUpdate user | Update user. | write | identity.user.update280 connectors |
beyondtrust_password_safe.users.deleteDelete user | Delete user. | destructive | identity.user.delete253 connectors |
beyondtrust_password_safe.usergroups.list_usersGet all users in group | Get all users in group. | read | identity.group_member.list103 connectors |
beyondtrust_password_safe.assets.searchSearch assets | Search assets. | read | asset.asset.search6 connectors |
beyondtrust_password_safe.assets.getGet by ID | Get by ID. | read | asset.asset.get40 connectors |
beyondtrust_password_safe.nodes.listGet all Nodes | Get all Nodes. | read | this connector |
beyondtrust_password_safe.aliases.listGet requestable managed account aliases | Get requestable managed account aliases. | read | this connector |
Try it
Prompts to paste into Claude.
Each one names the BeyondTrust Password Safe actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in BeyondTrust Password Safe? List every user and their role.
calls
beyondtrust_password_safe.users.list - Writewrite
Create user account in BeyondTrust Password Safe. Show me exactly what you will send before you save it.
calls
beyondtrust_password_safe.users.create
Governance for BeyondTrust Password Safe
Destructive actions wait for a yes.
64 BeyondTrust Password Safe actions are destructive. The first 10:
- Delete user
beyondtrust_password_safe.users.delete - Delete user group by ID
beyondtrust_password_safe.usergroups.delete_by_id - Delete by ID
beyondtrust_password_safe.assets.delete - Delete address by ID
beyondtrust_password_safe.addresses.delete - Delete database by ID
beyondtrust_password_safe.databases.delete - Quarantine user
beyondtrust_password_safe.users.quarantine - Delete attribute
beyondtrust_password_safe.attributes.delete - Delete directory by ID
beyondtrust_password_safe.directories.delete - Terminates the replay session
beyondtrust_password_safe.pbsm.delete_replay - Delete address group
beyondtrust_password_safe.addressgroups.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
dobeyondtrust_password_safe.users.deleteconfirm_policy: human
Delete user?
intent: the user asked me to delete user
run suspended · waiting for a named person · key beyondtrust-password-safe-agent cannot confirm itself
In the console, or from an emailed signed link.
account { op: "keys.create", name: "beyondtrust-password-safe-agent", allowed_actions: ["beyondtrust_password_safe.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "beyondtrust_password_safe.users.delete", approver: "[email protected]" }, { match: "beyondtrust_password_safe.usergroups.delete_by_id", approver: "[email protected]" }, { match: "beyondtrust_password_safe.assets.delete", approver: "[email protected]" } ]}Cost
What BeyondTrust Password Safe costs on actionlake.
Every BeyondTrust Password Safe action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call BeyondTrust Password Safe refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 272 BeyondTrust Password Safe actions
- 272actions pageeach page of a long list is one call
- 91reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every BeyondTrust Password Safe action.
272 actions by area: the id your agent calls, what it does, and its effect.
Secrets safe35
beyondtrust_password_safe.secrets_safe.create_foldersCreate folderwritebeyondtrust_password_safe.secrets_safe.create_folders_secretsCreate credential secretwritebeyondtrust_password_safe.secrets_safe.create_folders_secrets_textCreate text secretwritebeyondtrust_password_safe.secrets_safe.create_safesCreate safewritebeyondtrust_password_safe.secrets_safe.create_secrets_sharesShare secret to folder by IDwritebeyondtrust_password_safe.secrets_safe.delete_foldersDelete folder by IDdestructivebeyondtrust_password_safe.secrets_safe.delete_safesDelete safe by IDdestructivebeyondtrust_password_safe.secrets_safe.delete_safes_safe_permissionsRevoke safe permissions by IDdestructivebeyondtrust_password_safe.secrets_safe.delete_secretsDelete secretdestructivebeyondtrust_password_safe.secrets_safe.delete_secrets_shares_by_folder_idDelete sharedestructivebeyondtrust_password_safe.secrets_safe.delete_secrets_shares_by_secret_idDelete all shares of secretdestructivebeyondtrust_password_safe.secrets_safe.folders_moveMove folderwritebeyondtrust_password_safe.secrets_safe.get_foldersGet folder by IDreadbeyondtrust_password_safe.secrets_safe.get_safesGet safe by IDreadbeyondtrust_password_safe.secrets_safe.get_secret_file_metadataGet file secret by IDreadbeyondtrust_password_safe.secrets_safe.get_secret_textGet text secret by IDreadbeyondtrust_password_safe.secrets_safe.get_secret_totp_codeGet the current one-time (TOTP) code for a credential secretreadbeyondtrust_password_safe.secrets_safe.get_secretsGet credential secret by IDreadbeyondtrust_password_safe.secrets_safe.get_secrets_password_versionsGet historical password value for a specific versionreadbeyondtrust_password_safe.secrets_safe.get_secrets_text_versionsGet historical text value for a specific versionreadbeyondtrust_password_safe.secrets_safe.get_secrets_versionsGet secret version historyreadbeyondtrust_password_safe.secrets_safe.list_foldersGet all foldersreadbeyondtrust_password_safe.secrets_safe.list_folders_secretsGet all secrets by folder IDreadbeyondtrust_password_safe.secrets_safe.list_safesGet all safes accessible to current userreadbeyondtrust_password_safe.secrets_safe.list_safes_safe_permissions_allGet all possible safe permissionsreadbeyondtrust_password_safe.secrets_safe.list_safes_safe_permissions_by_idGet permissions assigned to safereadbeyondtrust_password_safe.secrets_safe.list_secretsGet all secretsreadbeyondtrust_password_safe.secrets_safe.list_secrets_sharesGet all shares of secretreadbeyondtrust_password_safe.secrets_safe.secrets_moveMove secrets and shares to folderwritebeyondtrust_password_safe.secrets_safe.secrets_versions_rollbackRollback secret to a previous versionwritebeyondtrust_password_safe.secrets_safe.update_foldersUpdate folderwritebeyondtrust_password_safe.secrets_safe.update_safesUpdate safe by IDwritebeyondtrust_password_safe.secrets_safe.update_safes_safe_permissionsUpdate safe permissions by IDwritebeyondtrust_password_safe.secrets_safe.update_secretsUpdate credential secretwritebeyondtrust_password_safe.secrets_safe.update_secrets_textUpdate text secretwrite
Managedaccounts27
beyondtrust_password_safe.managedaccounts.create_applicationsAssign application to managed accountwritebeyondtrust_password_safe.managedaccounts.create_attributesAssign attribute to managed accountwritebeyondtrust_password_safe.managedaccounts.create_propagationactionsAssign propagation actions to managed accountwritebeyondtrust_password_safe.managedaccounts.create_syncedaccountsCreate Synced Accountwritebeyondtrust_password_safe.managedaccounts.credentials_changeChange managed account credentialswritebeyondtrust_password_safe.managedaccounts.credentials_testTest managed account credentialsreadbeyondtrust_password_safe.managedaccounts.deleteDelete Managed Accountdestructivebeyondtrust_password_safe.managedaccounts.delete_applications_by_application_idRemove application from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_applications_by_managed_account_idRemove all applications from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_attributes_by_attribute_idDelete attribute from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_attributes_by_managed_account_idDelete all attributes from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_propagationactions_by_managed_account_idUnassign propagation actions from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_propagationactions_by_propagation_action_idUnassign propagation action from managed accountdestructivebeyondtrust_password_safe.managedaccounts.delete_syncedaccounts_by_idRemove all Synced Accounts by Managed Accountdestructivebeyondtrust_password_safe.managedaccounts.delete_syncedaccounts_by_synced_account_idRemove Synced Accountdestructivebeyondtrust_password_safe.managedaccounts.getGet Managed Accountreadbeyondtrust_password_safe.managedaccounts.get_credentialsGet credentials by Managed Account IDreadbeyondtrust_password_safe.managedaccounts.listGet Requestable Managed Account(s)readbeyondtrust_password_safe.managedaccounts.list_applicationsGet applications by managed account IDreadbeyondtrust_password_safe.managedaccounts.list_attributesGet attributes for managed accountreadbeyondtrust_password_safe.managedaccounts.list_propagationactionsGet managed account propagation actionsreadbeyondtrust_password_safe.managedaccounts.list_syncedaccountsGet Synced Accounts by Managed Accountreadbeyondtrust_password_safe.managedaccounts.requests_terminateTerminate requests by managed account IDdestructivebeyondtrust_password_safe.managedaccounts.sessions_lockLock active Sessions by Managed Accountdestructivebeyondtrust_password_safe.managedaccounts.sessions_terminateTerminate active Sessions by Managed Accountdestructivebeyondtrust_password_safe.managedaccounts.updateUpdate Managed Accountwritebeyondtrust_password_safe.managedaccounts.update_credentialsUpdate managed account credentials by IDwrite
Managedsystems20
beyondtrust_password_safe.managedsystems.create_attributesAssign attribute to managed systemwritebeyondtrust_password_safe.managedsystems.create_linkedaccountsCreate Linked Accountwritebeyondtrust_password_safe.managedsystems.create_managedaccountsCreate Managed Account in Managed Systemwritebeyondtrust_password_safe.managedsystems.deleteDelete Managed Systemdestructivebeyondtrust_password_safe.managedsystems.delete_attributes_by_attribute_idDelete attribute from managed systemdestructivebeyondtrust_password_safe.managedsystems.delete_attributes_by_managed_system_idDelete all attributes from managed systemdestructivebeyondtrust_password_safe.managedsystems.delete_linkedaccounts_by_directory_account_idRemove Linked Accountdestructivebeyondtrust_password_safe.managedsystems.delete_linkedaccounts_by_managed_system_idRemove all Linked Accounts by Managed Systemdestructivebeyondtrust_password_safe.managedsystems.delete_managedaccounts_by_account_nameDelete Managed Account by Managed System ID and Managed Account namedestructivebeyondtrust_password_safe.managedsystems.delete_managedaccounts_by_managed_system_idDelete all Managed Accounts by Managed Systemdestructivebeyondtrust_password_safe.managedsystems.getGet Managed Systemreadbeyondtrust_password_safe.managedsystems.listGet Managed Systemsreadbeyondtrust_password_safe.managedsystems.list_attributesGet attributes for managed systemreadbeyondtrust_password_safe.managedsystems.list_linkedaccountsGet Linked Accounts by Managed Systemreadbeyondtrust_password_safe.managedsystems.list_managedaccountsGet Managed Account(s) by Managed Systemreadbeyondtrust_password_safe.managedsystems.managedaccounts_credentials_changeUpdate all managed account credentials by Managed System IDwritebeyondtrust_password_safe.managedsystems.requests_terminateTerminate requests by managed system IDdestructivebeyondtrust_password_safe.managedsystems.sessions_lockLock active Sessions by Managed Systemdestructivebeyondtrust_password_safe.managedsystems.sessions_terminateTerminate active Sessions by Managed Systemdestructivebeyondtrust_password_safe.managedsystems.updateUpdate Managed Systemwrite
Usergroups15
beyondtrust_password_safe.usergroups.createCreate new user groupwritebeyondtrust_password_safe.usergroups.create_permissionsAssign permissions to user groupwritebeyondtrust_password_safe.usergroups.create_smartrules_accesslevelsCreate access level assignmentwritebeyondtrust_password_safe.usergroups.create_smartrules_rolesAssign role to user group and smart rulewritebeyondtrust_password_safe.usergroups.create_usersCreate user in groupwritebeyondtrust_password_safe.usergroups.delete_allDelete user group by namedestructivebeyondtrust_password_safe.usergroups.delete_by_idDelete user group by IDdestructivebeyondtrust_password_safe.usergroups.delete_permissionsDelete all permissions for user groupdestructivebeyondtrust_password_safe.usergroups.delete_smartrules_rolesRemove role from user group and smart ruledestructivebeyondtrust_password_safe.usergroups.getGet user groupreadbeyondtrust_password_safe.usergroups.listGet user groupsreadbeyondtrust_password_safe.usergroups.list_permissionsGet all permissions for user groupreadbeyondtrust_password_safe.usergroups.list_smartrulesGet all Smart Rules for user group and access levelreadbeyondtrust_password_safe.usergroups.list_smartrules_rolesGet roles assigned to user group and smart rulereadbeyondtrust_password_safe.usergroups.list_usersGet all users in groupread
Quickrules13
beyondtrust_password_safe.quickrules.createCreate Quick Rulewritebeyondtrust_password_safe.quickrules.create_managedaccountsAdd Managed Account to Quick Rulewritebeyondtrust_password_safe.quickrules.create_managedsystemsAdd Managed System to Quick Rulewritebeyondtrust_password_safe.quickrules.delete_allDelete Quick Rule by titledestructivebeyondtrust_password_safe.quickrules.delete_by_idDelete Quick Rule by IDdestructivebeyondtrust_password_safe.quickrules.delete_managedaccountsRemove Managed Account from Quick Ruledestructivebeyondtrust_password_safe.quickrules.delete_managedsystemsRemove Managed System from Quick Ruledestructivebeyondtrust_password_safe.quickrules.getGet Quick Rule by IDreadbeyondtrust_password_safe.quickrules.listGet all Quick Rulesreadbeyondtrust_password_safe.quickrules.list_managedaccountsGet Managed Accounts by Quick Rulereadbeyondtrust_password_safe.quickrules.list_managedsystemsGet Managed Systems by Quick Rulereadbeyondtrust_password_safe.quickrules.update_managedaccountsUpdate Quick Rule Managed Accountswritebeyondtrust_password_safe.quickrules.update_managedsystemsUpdate Quick Rule Managed Systemswrite
Assets12
beyondtrust_password_safe.assets.create_attributesAssign attribute to assetwritebeyondtrust_password_safe.assets.create_databasesCreate database for assetwritebeyondtrust_password_safe.assets.create_managedsystemsCreate Asset-based Managed Systemwritebeyondtrust_password_safe.assets.deleteDelete by IDdestructivebeyondtrust_password_safe.assets.delete_attributes_by_asset_idDelete all attributes for assetdestructivebeyondtrust_password_safe.assets.delete_attributes_by_attribute_idDelete attribute from assetdestructivebeyondtrust_password_safe.assets.getGet by IDreadbeyondtrust_password_safe.assets.get_managedsystemsGet Managed System by Assetreadbeyondtrust_password_safe.assets.list_attributesGet all attributes for assetreadbeyondtrust_password_safe.assets.list_databasesGet all databases by asset IDreadbeyondtrust_password_safe.assets.searchSearch assetsreadbeyondtrust_password_safe.assets.updateUpdate assetwrite
Users11
beyondtrust_password_safe.users.createCreate user accountwritebeyondtrust_password_safe.users.create_usergroupsAdd user to user groupwritebeyondtrust_password_safe.users.deleteDelete userdestructivebeyondtrust_password_safe.users.delete_usergroupsRemove user from user groupdestructivebeyondtrust_password_safe.users.getGet Userreadbeyondtrust_password_safe.users.listGet usersreadbeyondtrust_password_safe.users.list_usergroupsGet user groups for userreadbeyondtrust_password_safe.users.quarantineQuarantine userdestructivebeyondtrust_password_safe.users.recycle_client_secretGenerate OAuth client secret for userdestructivebeyondtrust_password_safe.users.requests_terminateTerminate requests by requestor user IDdestructivebeyondtrust_password_safe.users.updateUpdate userwrite
Workgroups11
beyondtrust_password_safe.workgroups.createCreate workgroupwritebeyondtrust_password_safe.workgroups.create_assets_by_workgroup_idCreate asset workgroup by IDwritebeyondtrust_password_safe.workgroups.create_assets_by_workgroup_nameCreate asset workgroup by namewritebeyondtrust_password_safe.workgroups.create_directoriesCreate directory in workgroupwritebeyondtrust_password_safe.workgroups.create_managedsystemsCreate Managed System in Workgroupwritebeyondtrust_password_safe.workgroups.delete_assetsDelete by workgroup and asset namedestructivebeyondtrust_password_safe.workgroups.getGet workgroup by IDreadbeyondtrust_password_safe.workgroups.listGet workgroups by namereadbeyondtrust_password_safe.workgroups.list_assets_by_workgroup_idGet all assets by workgroup IDreadbeyondtrust_password_safe.workgroups.list_assets_by_workgroup_nameGet all assets by workgroup namereadbeyondtrust_password_safe.workgroups.list_managedsystemsGet Managed Systems by Workgroupread
Smartrules10
beyondtrust_password_safe.smartrules.delete_allDelete Smart Rule by titledestructivebeyondtrust_password_safe.smartrules.delete_by_idDelete Smart Rule by IDdestructivebeyondtrust_password_safe.smartrules.filter_asset_attributeCreate asset filtering Smart Rulewritebeyondtrust_password_safe.smartrules.filter_managed_account_attributeCreate Managed Account Smart Rule from Assigned Attributes and an optional Smart Groupwritebeyondtrust_password_safe.smartrules.getGet Smart Rule by IDreadbeyondtrust_password_safe.smartrules.listGet Smart Rulesreadbeyondtrust_password_safe.smartrules.list_assetsGet all assets by Smart Rule IDreadbeyondtrust_password_safe.smartrules.list_managedaccountsGet Managed Accounts by Smart Rulereadbeyondtrust_password_safe.smartrules.list_managedsystemsGet Managed Systems by Smart Rulereadbeyondtrust_password_safe.smartrules.processProcess Smart Rulewrite
Addressgroups8
beyondtrust_password_safe.addressgroups.createCreate address groupwritebeyondtrust_password_safe.addressgroups.create_addressesCreate address within address groupwritebeyondtrust_password_safe.addressgroups.deleteDelete address groupdestructivebeyondtrust_password_safe.addressgroups.delete_addressesDelete address by group IDdestructivebeyondtrust_password_safe.addressgroups.getGet address group by IDreadbeyondtrust_password_safe.addressgroups.listGet address groupsreadbeyondtrust_password_safe.addressgroups.list_addressesGet all addresses in address groupreadbeyondtrust_password_safe.addressgroups.updateUpdate address groupwrite
Organizations8
beyondtrust_password_safe.organizations.delete_quickrulesDelete Quick Rule by organization and titledestructivebeyondtrust_password_safe.organizations.delete_smartrulesDelete Smart Rule by organization ID and titledestructivebeyondtrust_password_safe.organizations.getGet organization by IDreadbeyondtrust_password_safe.organizations.get_quickrulesGet Quick Rule by organization and titlereadbeyondtrust_password_safe.organizations.get_smartrulesGet Smart Rule by organization ID and titlereadbeyondtrust_password_safe.organizations.listGet organizationsreadbeyondtrust_password_safe.organizations.list_addressgroupsGet address groups for organization IDreadbeyondtrust_password_safe.organizations.list_oracleinternetdirectoriesGet Oracle Internet Directories by organizationread
Apiregistrations7
beyondtrust_password_safe.apiregistrations.createCreate API registrationwritebeyondtrust_password_safe.apiregistrations.deleteDelete API registrationdestructivebeyondtrust_password_safe.apiregistrations.getGet API registration by IDreadbeyondtrust_password_safe.apiregistrations.get_keyGet API key by IDreadbeyondtrust_password_safe.apiregistrations.listGet all API registrationsreadbeyondtrust_password_safe.apiregistrations.rotateRotate API key by IDdestructivebeyondtrust_password_safe.apiregistrations.updateUpdate API registrationwrite
Requests7
beyondtrust_password_safe.requests.approveApprove pending requestwritebeyondtrust_password_safe.requests.checkinCheck-in/release requestwritebeyondtrust_password_safe.requests.createCreate release requestwritebeyondtrust_password_safe.requests.create_sessionsCreate Session by Requestwritebeyondtrust_password_safe.requests.denyDeny/cancel pending requestdestructivebeyondtrust_password_safe.requests.listGet release requestsreadbeyondtrust_password_safe.requests.rotateoncheckinUpdate request to rotate credentials on check-in/expirydestructive
Attributetypes6
beyondtrust_password_safe.attributetypes.createCreate attribute typewritebeyondtrust_password_safe.attributetypes.create_attributesCreate attributewritebeyondtrust_password_safe.attributetypes.deleteDelete attribute typedestructivebeyondtrust_password_safe.attributetypes.getGet attribute type by IDreadbeyondtrust_password_safe.attributetypes.listGet all attribute typesreadbeyondtrust_password_safe.attributetypes.list_attributesGet attributes by typeread
Databases6
beyondtrust_password_safe.databases.create_managedsystemsCreate Database-based Managed Systemwritebeyondtrust_password_safe.databases.deleteDelete database by IDdestructivebeyondtrust_password_safe.databases.getGet database by IDreadbeyondtrust_password_safe.databases.get_managedsystemsGet Managed System by Databasereadbeyondtrust_password_safe.databases.listGet all databasesreadbeyondtrust_password_safe.databases.updateUpdate database by IDwrite
Directories6
beyondtrust_password_safe.directories.create_managedsystemsGet Managed System by Directorywritebeyondtrust_password_safe.directories.deleteDelete directory by IDdestructivebeyondtrust_password_safe.directories.getGet directory by IDreadbeyondtrust_password_safe.directories.get_managedsystemsGet Managed System by Directoryreadbeyondtrust_password_safe.directories.listGet all directoriesreadbeyondtrust_password_safe.directories.updateUpdate directory by IDwrite
Sessions6
beyondtrust_password_safe.sessions.adminCreate Admin Sessionwritebeyondtrust_password_safe.sessions.getGet Sessionreadbeyondtrust_password_safe.sessions.listGet Sessionsreadbeyondtrust_password_safe.sessions.list_keystrokesGet all keystrokes for sessionreadbeyondtrust_password_safe.sessions.lockLock active Sessiondestructivebeyondtrust_password_safe.sessions.terminateTerminate active Sessiondestructive
Functionalaccounts5
beyondtrust_password_safe.functionalaccounts.createCreate functional accountwritebeyondtrust_password_safe.functionalaccounts.deleteDelete functional accountdestructivebeyondtrust_password_safe.functionalaccounts.getGet functional account by IDreadbeyondtrust_password_safe.functionalaccounts.listGet all functional accountsreadbeyondtrust_password_safe.functionalaccounts.list_managedsystemsGet Managed Systems by Functional Accountread
Aliases4
beyondtrust_password_safe.aliases.create_requestsCreate release request using an aliaswritebeyondtrust_password_safe.aliases.getGet a requestable managed account aliasreadbeyondtrust_password_safe.aliases.get_credentialsGet Credentials by Alias and Request IDreadbeyondtrust_password_safe.aliases.listGet requestable managed account aliasesread
Customplatforms4
beyondtrust_password_safe.customplatforms.getGet custom platform configuration by IDreadbeyondtrust_password_safe.customplatforms.get_exportExport custom platform configurationreadbeyondtrust_password_safe.customplatforms.importImport custom platform configurationwritebeyondtrust_password_safe.customplatforms.listGet all custom platform configurationsread
Oracleinternetdirectories4
beyondtrust_password_safe.oracleinternetdirectories.getGet an Oracle Internet Directory by IDreadbeyondtrust_password_safe.oracleinternetdirectories.listGet all Oracle Internet Directoriesreadbeyondtrust_password_safe.oracleinternetdirectories.services_queryQuery Oracle Internet Directory DB servicesreadbeyondtrust_password_safe.oracleinternetdirectories.testTest Oracle Internet Directory LDAP connectionread
PBSM4
beyondtrust_password_safe.pbsm.create_replayCreates a new replay session for a specified session token. The session token can be discovered using the `sessions` endpointswritebeyondtrust_password_safe.pbsm.delete_replayTerminates the replay sessiondestructivebeyondtrust_password_safe.pbsm.get_replayDisplays the replay session detailsreadbeyondtrust_password_safe.pbsm.update_replayControls the replay session statuswrite
Accesspolicies3
beyondtrust_password_safe.accesspolicies.listGet all access policiesreadbeyondtrust_password_safe.accesspolicies.list_assigneesGet assignees for access policyreadbeyondtrust_password_safe.accesspolicies.testTest access to managed accountread
Addresses3
beyondtrust_password_safe.addresses.deleteDelete address by IDdestructivebeyondtrust_password_safe.addresses.getGet address by IDreadbeyondtrust_password_safe.addresses.updateUpdate addresswrite
Keystrokes3
beyondtrust_password_safe.keystrokes.getGet keystroke by IDreadbeyondtrust_password_safe.keystrokes.searchSearch keystrokesreadbeyondtrust_password_safe.keystrokes.search_by_conditionSearches keystroke records by condition and type (deprecated endpoint)read
Applications2
beyondtrust_password_safe.applications.getGet application by IDreadbeyondtrust_password_safe.applications.listGet all applicationsread
Attributes2
beyondtrust_password_safe.attributes.deleteDelete attributedestructivebeyondtrust_password_safe.attributes.getGet attribute by IDread
Credentials2
beyondtrust_password_safe.credentials.getGet credentials by Request IDreadbeyondtrust_password_safe.credentials.update_allUpdate managed account credentials by Workgroup Name, Asset Name, and Account Namewrite
Dsskeyrules2
beyondtrust_password_safe.dsskeyrules.getGet DSS key rule by IDreadbeyondtrust_password_safe.dsskeyrules.listGet all DSS key rulesread
Entitytypes2
beyondtrust_password_safe.entitytypes.listGet all entity typesreadbeyondtrust_password_safe.entitytypes.list_platformsGet platforms by entity type IDread
Passwordrules2
beyondtrust_password_safe.passwordrules.getGet password rule by IDreadbeyondtrust_password_safe.passwordrules.listGet all password rules by productread
Platforms2
beyondtrust_password_safe.platforms.getGet platform by IDreadbeyondtrust_password_safe.platforms.listGet all platformsread
Propagationactions2
beyondtrust_password_safe.propagationactions.getGet propagation action by IDreadbeyondtrust_password_safe.propagationactions.listGet all propagation actionsread
Requestsets2
beyondtrust_password_safe.requestsets.createCreate release request setwritebeyondtrust_password_safe.requestsets.listGet request setsread
Useraudits2
beyondtrust_password_safe.useraudits.listGet user auditsreadbeyondtrust_password_safe.useraudits.list_userauditdetailsGet user audit by IDread
Accesslevels1
beyondtrust_password_safe.accesslevels.listGet all access levelsread
Auth1
beyondtrust_password_safe.auth.sign_app_inSign inread
Configuration1
beyondtrust_password_safe.configuration.get_versionGet current system versionread
Entitlements1
beyondtrust_password_safe.entitlements.listGet user entitlementsread
Epmpolicies1
beyondtrust_password_safe.epmpolicies.epmapplications_addAdd Application to EPM policy groupwrite
Isarequests1
beyondtrust_password_safe.isarequests.createCreate ISA requestwrite
Isasessions1
beyondtrust_password_safe.isasessions.createCreate ISA sessionwrite
Nodes1
beyondtrust_password_safe.nodes.listGet all Nodesread
Operatingsystems1
beyondtrust_password_safe.operatingsystems.listGet all operating systemsread
Permissions1
beyondtrust_password_safe.permissions.listGet all permissionsread
Propagationactiontypes1
beyondtrust_password_safe.propagationactiontypes.listGet all propagation action typesread
Roles1
beyondtrust_password_safe.roles.listGet all rolesread
Subscriptions1
beyondtrust_password_safe.subscriptions.list_deliveryGet subscription delivery identifiersread
Ticketsystems1
beyondtrust_password_safe.ticketsystems.listGet all configured ticket systemsread
Questions
The BeyondTrust Password Safe MCP server, answered.
Is there a BeyondTrust Password Safe MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 272 BeyondTrust Password Safe actions across secrets safe, managedaccounts, managedsystems and usergroups, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by BeyondTrust Password Safe.
What do I need to connect BeyondTrust Password Safe?
Client ID of a BeyondInsight Application user and Client secret of that Application user (it can be recycled with users.recycleclientsecret). Plus your host. The free call account { op: "connections.requirements", service: "beyondtrust_password_safe" } lists exactly what to paste.
Can an AI agent delete or change things in BeyondTrust Password Safe?
Only if its key allows it, and only with an explicit confirmation. 64 BeyondTrust Password Safe actions are destructive, including delete user, delete user group by ID and delete by ID. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my BeyondTrust Password Safe API limit?
actionlake paces every call to the limits in the BeyondTrust Password Safe service file: 300 calls a minute per connection. Repeated reads are answered from cache (91 BeyondTrust Password Safe actions can be), which never reaches BeyondTrust Password Safe.
What does a BeyondTrust Password Safe action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (272 BeyondTrust Password Safe actions page). Cache hits, searches, dry runs and calls BeyondTrust Password Safe refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which BeyondTrust Password Safe API does it cover?
The BeyondInsight and Password Safe public API v3 (OpenAPI 3.0 fragments per operation) at your BeyondTrust Password Safe instance's API base URL, which you enter when connecting (path /BeyondTrust/api/public/v3). It is built from BeyondTrust Password Safe's documentation as read on 23 October 2026. 272 actions in 49 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my BeyondTrust Password Safe data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your BeyondTrust Password Safe credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent BeyondTrust Password Safe today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
