Connectors · MSP & PSA
Cisco Umbrella MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Cisco Umbrella and the rest of your systems. It gives your agent 231 Cisco Umbrella actions (164 reads, 45 writes and 22 that wait for a confirmation) and holds the Cisco Umbrella credential itself, so the agent never does. It paces Cisco Umbrella's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "cisco_umbrella.users_and_roles.list_users", intent: "check which Cisco Umbrella account is connected"}# List Users · read · 1 upstream call- 231actionsin one signed file
- 164readlook, never change
- 45writecreate and update
- 22wait for a yesdestructive, confirmed first
Set up
Connect Cisco Umbrella in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Cisco Umbrella.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idUmbrella API key (Admin > API Keys > Add; choose the key scopes the actions you call need)client_secretUmbrella API key secret (shown once when the key is created)
account { op: "connections.requirements", service: "cisco_umbrella" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "cisco_umbrella.users_and_roles.list_users" }# list users · read · 1 upstream callcheck { action: "cisco_umbrella.users_and_roles.create_user", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Cisco Umbrella at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Limits we pace to
- 10 calls a second, per connection
- API covered
- Umbrella API v2 (OpenAPI 3 per API family)
api.umbrella.com - Built from
- Cisco Umbrella's documentation, read 23 October 2026developer.cisco.compubhub.devnetcloud.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 159 of 164 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line Cisco Umbrella up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Cisco Umbrella.
231 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 164readlook, never change
- 45writecreate and update
- 22destructivewait for a confirmation
Reports
6262 read · 0 write · 0 destructive
Get Activities (All) · Get Activity AMP Retrospective · Get Activity DNS · Get Activity Firewall
Investigate
2828 read · 0 write · 0 destructive
Get BGP Route Information for ASN · Get BGP Route Information for IP · Get Samples for Hash Artifacts · Get Samples for Hash Behaviors
Providers
168 read · 7 write · 1 destructive
Get Customer Addresses for Provider · Get Customer Packages for Provider · Get Customer Subscription Details · Get Customer Trial Strength
Provider console config
136 read · 4 write · 3 destructive
List Cnames · List Contacts · List Logos · Get Cname
App discovery
1210 read · 2 write · 0 destructive
List Application Attributes · List Application Categories · List Application Identities · Get Application Risk
Network tunnels
128 read · 3 write · 1 destructive
List Data Centers · List Tunnel State Information · Get Tunnel Error Events · List Policies for Tunnel
Destination lists
83 read · 3 write · 2 destructive
Get Destination Lists · Get Destinations in Destination List · Get Destination List · Create Destination List
Users and roles
74 read · 2 write · 1 destructive
List Users · List Roles · Get User · Create User
16 more areas · 73 actions
- API keys 6
- Application lists 6
- Internal networks 6
- Network devices 6
- Networks 6
- Internal domains 5
- Managed providers 5
- Roaming computers 5
- Sites 5
- Tags 5
- API usage 4
- Virtual appliances 4
- Policies 3
- Provider console reports 3
- SWG device settings 3
- S3 bucket keys 1
Top actions
The Cisco Umbrella API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 16 of Cisco Umbrella's 16 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
cisco_umbrella.users_and_roles.list_usersList Users | List the user accounts in the organization. | read | identity.user.list474 connectors |
cisco_umbrella.users_and_roles.list_rolesList Roles | List the roles in the organization. | read | identity.role.list184 connectors |
cisco_umbrella.users_and_roles.get_userGet User | Get a user account. | read | identity.user.get399 connectors |
cisco_umbrella.policies.list_policiesList Policies | List the Umbrella policies. | read | security.policy.list36 connectors |
cisco_umbrella.users_and_roles.create_userCreate User | Create an Umbrella user account with a designated role. | write | identity.user.create262 connectors |
cisco_umbrella.networks.list_networksList Networks | List the Networks. | read | security.network.list15 connectors |
cisco_umbrella.users_and_roles.delete_userDelete User | Delete a user account. | destructive | identity.user.delete253 connectors |
cisco_umbrella.api_keys.get_api_keysList API Keys | List the API keys created by your organization. | read | identity.api_key.list96 connectors |
cisco_umbrella.api_keys.get_api_keyGet API Key | Get an API key. | read | identity.api_key.get66 connectors |
cisco_umbrella.api_keys.create_api_keysCreate API Key | Create an API key with certain scopes, name, description, allowed IP addresses and CIDR blocks, and expiration. | write | identity.api_key.create100 connectors |
cisco_umbrella.networks.get_networkGet Network | Get a Network. | read | security.network.get10 connectors |
cisco_umbrella.networks.create_networkCreate Network | Create a network. | write | security.network.create8 connectors |
Try it
Prompts to paste into Claude.
Each one names the Cisco Umbrella actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in Cisco Umbrella? List every user and their role.
calls
cisco_umbrella.users_and_roles.list_users - Writewrite
Create User in Cisco Umbrella. Show me exactly what you will send before you save it.
calls
cisco_umbrella.users_and_roles.create_user
Governance for Cisco Umbrella
Destructive actions wait for a yes.
22 Cisco Umbrella actions are destructive. These are all of them:
- Delete User
cisco_umbrella.users_and_roles.delete_user - Delete API Key
cisco_umbrella.api_keys.delete_api_key - Delete Network
cisco_umbrella.networks.delete_network - Delete Site
cisco_umbrella.sites.delete_site - Delete Tag on Devices
cisco_umbrella.tags.delete_tag_on_devices - Delete Tunnel
cisco_umbrella.network_tunnels.delete_tunnel - Delete Identity From Policy
cisco_umbrella.policies.delete_policy_identities - Delete Customer for Provider
cisco_umbrella.providers.delete_provider_customer - Delete Logo
cisco_umbrella.provider_console_config.delete_logo - Refresh S3 Bucket Key
cisco_umbrella.s3_bucket_keys.create_s3_bucket_key - Delete Cname
cisco_umbrella.provider_console_config.delete_cname - Delete Destinations from Destination List
cisco_umbrella.destination_lists.delete_destinations - Delete Network Device
cisco_umbrella.network_devices.delete_network_device - Delete Contact
cisco_umbrella.provider_console_config.delete_contact - Delete Internal Domain
cisco_umbrella.internal_domains.delete_internal_domain - Delete Application List
cisco_umbrella.application_lists.delete_application_list - Delete Destination List
cisco_umbrella.destination_lists.delete_destination_list - Delete Internal Network
cisco_umbrella.internal_networks.delete_internal_network - Delete Roaming Computer
cisco_umbrella.roaming_computers.delete_roaming_computer - Delete Virtual Appliance
cisco_umbrella.virtual_appliances.delete_virtual_appliance - Delete Customer for Managed Provider
cisco_umbrella.managed_providers.delete_manged_provider_customer - Delete SWG Override Device Settings
cisco_umbrella.swg_device_settings.delete_secure_web_gateway_device_settings
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete User?
intent: the user asked me to delete User
account { op: "keys.create", name: "cisco-umbrella-agent", allowed_actions: ["cisco_umbrella.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "cisco_umbrella.users_and_roles.delete_user", approver: "[email protected]" }, { match: "cisco_umbrella.api_keys.delete_api_key", approver: "[email protected]" }, { match: "cisco_umbrella.networks.delete_network", approver: "[email protected]" } ]}Cost
What Cisco Umbrella costs on actionlake.
Every Cisco Umbrella action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Cisco Umbrella refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 231 Cisco Umbrella actions
- 231actions pageeach page of a long list is one call
- 159reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Cisco Umbrella action.
231 actions by area: the id your agent calls, what it does, and its effect.
Reports62
cisco_umbrella.reports.get_activitiesGet Activities (All)readcisco_umbrella.reports.get_activity_amp_retrospectiveGet Activity AMP Retrospectivereadcisco_umbrella.reports.get_activity_dnsGet Activity DNSreadcisco_umbrella.reports.get_activity_firewallGet Activity Firewallreadcisco_umbrella.reports.get_activity_intrusionGet Activity Intrusionreadcisco_umbrella.reports.get_activity_ipGet Activity IPreadcisco_umbrella.reports.get_activity_proxyGet Activity Proxyreadcisco_umbrella.reports.get_applicationsGet Applicationsreadcisco_umbrella.reports.get_bandwidth_by_hourGet Bandwidth by Hour (All)readcisco_umbrella.reports.get_bandwidth_by_timerangeGet Bandwidth by Timerange (All)readcisco_umbrella.reports.get_categoriesGet Categoriesreadcisco_umbrella.reports.get_deployment_statusGet Deployment Statusreadcisco_umbrella.reports.get_deployment_status_by_organizationGet Deployment Status by Organizationreadcisco_umbrella.reports.get_identitiesGet Identitiesreadcisco_umbrella.reports.get_identityGet Identityreadcisco_umbrella.reports.get_identity_distributionGet Identity Distribution (All)readcisco_umbrella.reports.get_identity_distribution_typeGet Identity Distribution By Typereadcisco_umbrella.reports.get_organization_requests_by_hourGet Requests by Hourreadcisco_umbrella.reports.get_provider_categoriesGet Provider Categoriesreadcisco_umbrella.reports.get_provider_category_requests_by_organizationGet Provider Category Requests by Organizationreadcisco_umbrella.reports.get_provider_requests_by_categoryGet Provider Requests by Categoryreadcisco_umbrella.reports.get_provider_requests_by_destinationGet Provider Requests by Destinationreadcisco_umbrella.reports.get_provider_requests_by_hourGet Provider Requests by Hour (All)readcisco_umbrella.reports.get_provider_requests_by_organizationGet Provider Requests by Organizationreadcisco_umbrella.reports.get_provider_requests_by_timerangeGet Provider Requests by Timerange (All)readcisco_umbrella.reports.get_requests_by_hourGet Requests by Hour (All)readcisco_umbrella.reports.get_requests_by_hour_and_categoryGet Requests by Hour and Category (All)readcisco_umbrella.reports.get_requests_by_hour_and_category_and_typeGet Requests by Hour and Categoryreadcisco_umbrella.reports.get_requests_by_timerangeGet Requests by Timerange (All)readcisco_umbrella.reports.get_requests_by_timerange_and_categoryGet Requests by Timerange and Category (All)readcisco_umbrella.reports.get_requests_by_timerange_and_category_typeGet Requests by Timerange and Categoryreadcisco_umbrella.reports.get_requests_by_timerange_typeGet Requests by Timerangereadcisco_umbrella.reports.get_summaries_by_categoryGet Summaries by Category (All)readcisco_umbrella.reports.get_summaries_by_category_typeGet Summaries by Category For Typereadcisco_umbrella.reports.get_summaries_by_destinationGet Summaries by Destination (All)readcisco_umbrella.reports.get_summaries_by_destination_typeGet Summaries by Destination For Typereadcisco_umbrella.reports.get_summaries_by_rule_intrusionGet Summaries by Rulereadcisco_umbrella.reports.get_summaryGet Summary (All)readcisco_umbrella.reports.get_summary_by_typeGet Summary By Typereadcisco_umbrella.reports.get_threat_nameGet Threat Name By Threat IDreadcisco_umbrella.reports.get_threat_namesGet Threat Namesreadcisco_umbrella.reports.get_threat_typeGet Threat Type By Threat IDreadcisco_umbrella.reports.get_threat_typesGet Threat Typesreadcisco_umbrella.reports.get_top_categoriesGet Top Categories (All)readcisco_umbrella.reports.get_top_categories_typeGet Top Categories By Typereadcisco_umbrella.reports.get_top_destinationsGet Top Destinationsreadcisco_umbrella.reports.get_top_destinations_typeGet Top Destinations By Typereadcisco_umbrella.reports.get_top_dns_query_typesGet Top DNS Query Typesreadcisco_umbrella.reports.get_top_event_typesGet Top Event Types (All)readcisco_umbrella.reports.get_top_files_proxyGet Top Files (Proxy)readcisco_umbrella.reports.get_top_identitiesGet Top Identities (All)readcisco_umbrella.reports.get_top_identities_typeGet Top Identitiesreadcisco_umbrella.reports.get_top_ipsGet Top IPsreadcisco_umbrella.reports.get_top_ips_internalGet Top IPs Internalreadcisco_umbrella.reports.get_top_threat_typesGet Top Threat Types (All)readcisco_umbrella.reports.get_top_threat_types_by_typeGet Top Threat Types By Typereadcisco_umbrella.reports.get_top_threatsGet Top Threats (All)readcisco_umbrella.reports.get_top_threats_by_typeGet Top Threats (By Type)readcisco_umbrella.reports.get_top_urlsGet Top URLsreadcisco_umbrella.reports.get_total_requestsGet Total Requests (All)readcisco_umbrella.reports.get_total_requests_by_typeGet Total Requests (By Type)readcisco_umbrella.reports.post_identitiesGet Identities By IDsread
Investigate28
cisco_umbrella.investigate.get_bgp_routes_asnGet BGP Route Information for ASNreadcisco_umbrella.investigate.get_bgp_routes_ipGet BGP Route Information for IPreadcisco_umbrella.investigate.get_domain_volumeGet Domain Volumereadcisco_umbrella.investigate.get_domains_categorizationGet Domain Status and Categorizationreadcisco_umbrella.investigate.get_domains_risk_scoreGet Risk Score for Domainreadcisco_umbrella.investigate.get_links_nameGet Related Domains for Domainreadcisco_umbrella.investigate.get_passive_dns_domainGet Resource Records for Domainreadcisco_umbrella.investigate.get_passive_dns_ipGet Resource Records for IPreadcisco_umbrella.investigate.get_passive_dns_nameGet Resource Records for Namereadcisco_umbrella.investigate.get_passive_dns_rawGet Resource Records for Raw Datareadcisco_umbrella.investigate.get_recommendations_nameGet Recommendations by Namereadcisco_umbrella.investigate.get_sample_hashGet Samples for Hashreadcisco_umbrella.investigate.get_sample_hash_artifactsGet Samples for Hash Artifactsreadcisco_umbrella.investigate.get_sample_hash_behaviorsGet Samples for Hash Behaviorsreadcisco_umbrella.investigate.get_sample_hash_connectionsGet Samples for Hash Connectionsreadcisco_umbrella.investigate.get_samples_destinationGet Samples for Domain, IP, or URLreadcisco_umbrella.investigate.get_searchGet Domains by Searchreadcisco_umbrella.investigate.get_security_nameGet Security Score Information for Domainreadcisco_umbrella.investigate.get_sub_domainsGet Subdomains for Domainreadcisco_umbrella.investigate.get_timelineGet Tagging Timeline for Destinationreadcisco_umbrella.investigate.get_topmillionGet Top Most Seen Domainsreadcisco_umbrella.investigate.get_whoisGet WHOIS Information for Domainreadcisco_umbrella.investigate.get_whois_emailGet WHOIS Email Informationreadcisco_umbrella.investigate.get_whois_historyGet WHOIS History for Domainreadcisco_umbrella.investigate.get_whois_nameserverGet WHOIS Information for Nameserverreadcisco_umbrella.investigate.get_whois_nameserversGet WHOIS Information for Nameserversreadcisco_umbrella.investigate.get_whois_searchGet WHOIS Information Searchreadcisco_umbrella.investigate.post_domains_categorizationCheck Status and Categorization of Domainsread
Providers16
cisco_umbrella.providers.create_customer_access_requestCreate Customer Access Requestwritecisco_umbrella.providers.create_customer_trial_extensionsCreate Customer Trial Extensionswritecisco_umbrella.providers.create_provider_customerCreate Customer for Providerwritecisco_umbrella.providers.delete_provider_customerDelete Customer for Providerdestructivecisco_umbrella.providers.get_customer_access_requestGet Customer Access Requestreadcisco_umbrella.providers.get_customer_addressesGet Customer Addresses for Providerreadcisco_umbrella.providers.get_customer_dealsGet Customer Deals by IDreadcisco_umbrella.providers.get_customer_packagesGet Customer Packages for Providerreadcisco_umbrella.providers.get_customer_subscription_detailsGet Customer Subscription Detailsreadcisco_umbrella.providers.get_customer_trial_strengthGet Customer Trial Strengthreadcisco_umbrella.providers.get_provider_customerGet Customer for Providerreadcisco_umbrella.providers.list_provider_customersList Customers for Providerreadcisco_umbrella.providers.put_trial_conversionsUpdate Trial to Customerwritecisco_umbrella.providers.update_customer_access_requestUpdate Customer Access Requestwritecisco_umbrella.providers.update_customer_dealsUpdate Customer Deals by IDwritecisco_umbrella.providers.update_provider_customerUpdate Customer for Providerwrite
Provider console config13
cisco_umbrella.provider_console_config.create_cnameCreate Cnamewritecisco_umbrella.provider_console_config.create_contactCreate Contactwritecisco_umbrella.provider_console_config.delete_cnameDelete Cnamedestructivecisco_umbrella.provider_console_config.delete_contactDelete Contactdestructivecisco_umbrella.provider_console_config.delete_logoDelete Logodestructivecisco_umbrella.provider_console_config.get_cnameGet Cnamereadcisco_umbrella.provider_console_config.get_cnamesList Cnamesreadcisco_umbrella.provider_console_config.get_contactGet Contactreadcisco_umbrella.provider_console_config.get_contactsList Contactsreadcisco_umbrella.provider_console_config.get_logoGet Logoreadcisco_umbrella.provider_console_config.get_logosList Logosreadcisco_umbrella.provider_console_config.update_cnameUpdate Cnamewritecisco_umbrella.provider_console_config.update_contactUpdate Contactwrite
App discovery12
cisco_umbrella.app_discovery.get_applicationGet Applicationreadcisco_umbrella.app_discovery.get_application_attributesList Application Attributesreadcisco_umbrella.app_discovery.get_application_categoriesList Application Categoriesreadcisco_umbrella.app_discovery.get_application_identitiesList Application Identitiesreadcisco_umbrella.app_discovery.get_application_riskGet Application Riskreadcisco_umbrella.app_discovery.get_applications_app_discoveryList Applicationsreadcisco_umbrella.app_discovery.get_applications_infoList Information for Applicationsreadcisco_umbrella.app_discovery.get_protocolGet Protocolreadcisco_umbrella.app_discovery.get_protocol_identitiesList Protocol Identitiesreadcisco_umbrella.app_discovery.get_protocolsList Protocolsreadcisco_umbrella.app_discovery.patch_applicationsUpdate Applicationswritecisco_umbrella.app_discovery.update_applicationUpdate Applicationwrite
Network tunnels12
cisco_umbrella.network_tunnels.add_tunnelCreate Tunnelwritecisco_umbrella.network_tunnels.delete_tunnelDelete Tunneldestructivecisco_umbrella.network_tunnels.get_datacentersList Data Centersreadcisco_umbrella.network_tunnels.get_org_tunnel_stateList Tunnel State Informationreadcisco_umbrella.network_tunnels.get_tunnelGet Tunnelreadcisco_umbrella.network_tunnels.get_tunnel_error_eventsGet Tunnel Error Eventsreadcisco_umbrella.network_tunnels.get_tunnel_global_error_eventsGet Tunnel Global Error Eventsreadcisco_umbrella.network_tunnels.get_tunnel_policiesList Policies for Tunnelreadcisco_umbrella.network_tunnels.get_tunnel_stateGet Tunnel Statereadcisco_umbrella.network_tunnels.list_tunnelsList Tunnelsreadcisco_umbrella.network_tunnels.update_tunnelUpdate Tunnelwritecisco_umbrella.network_tunnels.update_tunnel_credentialsUpdate and Rotate Tunnel Credentialswrite
Destination lists8
cisco_umbrella.destination_lists.create_destination_listCreate Destination Listwritecisco_umbrella.destination_lists.create_destinationsAdd Destinations to Destination Listwritecisco_umbrella.destination_lists.delete_destination_listDelete Destination Listdestructivecisco_umbrella.destination_lists.delete_destinationsDelete Destinations from Destination Listdestructivecisco_umbrella.destination_lists.get_destination_listGet Destination Listreadcisco_umbrella.destination_lists.get_destination_listsGet Destination Listsreadcisco_umbrella.destination_lists.get_destinationsGet Destinations in Destination Listreadcisco_umbrella.destination_lists.update_destination_listsUpdate Destination Listwrite
Users and roles7
cisco_umbrella.users_and_roles.create_password_resetsCreate Password Resetswritecisco_umbrella.users_and_roles.create_userCreate Userwritecisco_umbrella.users_and_roles.delete_userDelete Userdestructivecisco_umbrella.users_and_roles.get_organization_informationGet Information About Organizationsreadcisco_umbrella.users_and_roles.get_userGet Userreadcisco_umbrella.users_and_roles.list_rolesList Rolesreadcisco_umbrella.users_and_roles.list_usersList Usersread
API keys6
cisco_umbrella.api_keys.create_api_keysCreate API Keywritecisco_umbrella.api_keys.delete_api_keyDelete API Keydestructivecisco_umbrella.api_keys.get_api_keyGet API Keyreadcisco_umbrella.api_keys.get_api_keysList API Keysreadcisco_umbrella.api_keys.patch_api_keyUpdate API Keywritecisco_umbrella.api_keys.refresh_api_keyRefresh API Keywrite
Application lists6
cisco_umbrella.application_lists.create_application_listCreate Application Listwritecisco_umbrella.application_lists.delete_application_listDelete Application Listdestructivecisco_umbrella.application_lists.get_application_listGet Application Listreadcisco_umbrella.application_lists.get_application_listsGet Application Listsreadcisco_umbrella.application_lists.put_application_listUpdate Application Listwritecisco_umbrella.application_lists.update_usage_applicationsGet Usage of Applicationsread
Internal networks6
cisco_umbrella.internal_networks.create_internal_networkCreate Internal Networkwritecisco_umbrella.internal_networks.delete_internal_networkDelete Internal Networkdestructivecisco_umbrella.internal_networks.get_internal_networkGet Internal Networkreadcisco_umbrella.internal_networks.list_internal_network_policiesList Policies for Internal Networkreadcisco_umbrella.internal_networks.list_internal_networksList Internal Networksreadcisco_umbrella.internal_networks.update_internal_networkUpdate Internal Networkwrite
Network devices6
cisco_umbrella.network_devices.create_network_deviceCreate Network Devicewritecisco_umbrella.network_devices.delete_network_deviceDelete Network Devicedestructivecisco_umbrella.network_devices.get_all_network_devicesList Network Devicesreadcisco_umbrella.network_devices.get_network_deviceGet Network Devicereadcisco_umbrella.network_devices.list_network_device_policiesList Policies for Network Devicereadcisco_umbrella.network_devices.update_network_deviceUpdate Network Devicewrite
Networks6
cisco_umbrella.networks.create_networkCreate Networkwritecisco_umbrella.networks.delete_networkDelete Networkdestructivecisco_umbrella.networks.get_networkGet Networkreadcisco_umbrella.networks.list_network_policiesList Policies for Networkreadcisco_umbrella.networks.list_networksList Networksreadcisco_umbrella.networks.update_networkUpdate Networkwrite
Internal domains5
cisco_umbrella.internal_domains.create_internal_domainCreate Internal Domainwritecisco_umbrella.internal_domains.delete_internal_domainDelete Internal Domaindestructivecisco_umbrella.internal_domains.get_internal_domainGet Internal Domainreadcisco_umbrella.internal_domains.list_internal_domainsList Internal Domainsreadcisco_umbrella.internal_domains.update_internal_domainUpdate Internal Domainwrite
Managed providers5
cisco_umbrella.managed_providers.create_managed_provider_customerCreate Customer for Managed Providerwritecisco_umbrella.managed_providers.delete_manged_provider_customerDelete Customer for Managed Providerdestructivecisco_umbrella.managed_providers.get_managed_provider_customerGet Customer for Managed Providerreadcisco_umbrella.managed_providers.list_managed_provider_customersList Customers for Managed Providerreadcisco_umbrella.managed_providers.update_managed_provider_customerUpdate Customer for Managed Providerwrite
Roaming computers5
cisco_umbrella.roaming_computers.delete_roaming_computerDelete Roaming Computerdestructivecisco_umbrella.roaming_computers.get_organization_infoGet OrgInfo Propertiesreadcisco_umbrella.roaming_computers.get_roaming_computerGet Roaming Computerreadcisco_umbrella.roaming_computers.list_roaming_computersList Roaming Computersreadcisco_umbrella.roaming_computers.update_roaming_computerUpdate Roaming Computerwrite
Sites5
cisco_umbrella.sites.create_siteCreate Sitewritecisco_umbrella.sites.delete_siteDelete Sitedestructivecisco_umbrella.sites.get_siteGet Sitereadcisco_umbrella.sites.list_sitesList Sitesreadcisco_umbrella.sites.update_siteUpdate Sitewrite
Tags5
cisco_umbrella.tags.add_tag_to_devicesAdd Tag to Deviceswritecisco_umbrella.tags.create_tagAdd Tagwritecisco_umbrella.tags.delete_tag_on_devicesDelete Tag on Devicesdestructivecisco_umbrella.tags.get_devices_with_tagGet Devices With Tagreadcisco_umbrella.tags.get_tagsGet Tagsread
API usage4
cisco_umbrella.api_usage.get_api_usage_keysGet Keysreadcisco_umbrella.api_usage.get_api_usage_requestsGet Requestsreadcisco_umbrella.api_usage.get_api_usage_responsesGet Responsesreadcisco_umbrella.api_usage.get_api_usage_summaryGet Summaryread
Virtual appliances4
cisco_umbrella.virtual_appliances.delete_virtual_applianceDelete Virtual Appliancedestructivecisco_umbrella.virtual_appliances.get_virtual_applianceGet Virtual Appliancereadcisco_umbrella.virtual_appliances.list_virtual_appliancesList Virtual Appliancesreadcisco_umbrella.virtual_appliances.update_virtual_applianceUpdate Virtual Appliancewrite
Policies3
cisco_umbrella.policies.delete_policy_identitiesDelete Identity From Policydestructivecisco_umbrella.policies.list_policiesList Policiesreadcisco_umbrella.policies.update_policy_identitiesAdd Identity to Policywrite
Provider console reports3
cisco_umbrella.provider_console_reports.create_customer_security_report_requestCreate Customer Security Report Requestwritecisco_umbrella.provider_console_reports.get_providers_console_dataGet Providers Console Datareadcisco_umbrella.provider_console_reports.get_service_provider_customer_security_reportGet Customer Security Reportread
SWG device settings3
cisco_umbrella.swg_device_settings.create_secure_web_gateway_device_settingsSet SWG Override Device Settingswritecisco_umbrella.swg_device_settings.delete_secure_web_gateway_device_settingsDelete SWG Override Device Settingsdestructivecisco_umbrella.swg_device_settings.list_secure_web_gateway_device_settingsList SWG Override Device Settingsread
S3 bucket keys1
cisco_umbrella.s3_bucket_keys.create_s3_bucket_keyRefresh S3 Bucket Keydestructive
Questions
The Cisco Umbrella MCP server, answered.
Is there a Cisco Umbrella MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 231 Cisco Umbrella actions across reports, investigate, providers and provider console config, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Cisco Umbrella.
What do I need to connect Cisco Umbrella?
Umbrella API key (Admin > API Keys > Add; choose the key scopes the actions you call need) and Umbrella API key secret (shown once when the key is created). The free call account { op: "connections.requirements", service: "cisco_umbrella" } lists exactly what to paste.
Can an AI agent delete or change things in Cisco Umbrella?
Only if its key allows it, and only with an explicit confirmation. 22 Cisco Umbrella actions are destructive, including delete User, delete API Key and delete Network. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Cisco Umbrella API limit?
actionlake paces every call to the limits in the Cisco Umbrella service file: 10 calls a second per connection. Repeated reads are answered from cache (159 Cisco Umbrella actions can be), which never reaches Cisco Umbrella.
What does a Cisco Umbrella action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (231 Cisco Umbrella actions page). Cache hits, searches, dry runs and calls Cisco Umbrella refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Cisco Umbrella API does it cover?
The Umbrella API v2 (OpenAPI 3 per API family) at api.umbrella.com. It is built from Cisco Umbrella's documentation as read on 23 October 2026. 231 actions in 24 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Cisco Umbrella data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Cisco Umbrella credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Cisco Umbrella today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
