--- title: "Cisco Umbrella MCP server for AI agents - actionlake" description: "Give Claude 231 Cisco Umbrella actions through one MCP server: reports, investigate. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/cisco-umbrella updated: 2026-10-23 --- Connectors · MSP & PSA # Cisco Umbrella MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Cisco Umbrella and the rest of your systems. It gives your agent 231 Cisco Umbrella actions (164 reads, 45 writes and 22 that wait for a confirmation) and holds the Cisco Umbrella credential itself, so the agent never does. It paces Cisco Umbrella's limits and records every call. [Connect Cisco Umbrella free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "cisco_umbrella.users_and_roles.list_users", intent: "check which Cisco Umbrella account is connected" } # List Users · read · 1 upstream call ``` - 231 actions in one signed file - 164 read look, never change - 45 write create and update - 22 wait for a yes destructive, confirmed first Set up ## Connect Cisco Umbrella in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Cisco Umbrella. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Umbrella API key (Admin > API Keys > Add; choose the key scopes the actions you call need) - `client_secret` Umbrella API key secret (shown once when the key is created) ``` account { op: "connections.requirements", service: "cisco_umbrella" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "cisco_umbrella.users_and_roles.list_users" } # list users · read · 1 upstream call check { action: "cisco_umbrella.users_and_roles.create_user", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Cisco Umbrella at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Limits we pace to** 10 calls a second, per connection **API covered** Umbrella API v2 (OpenAPI 3 per API family)`api.umbrella.com` **Built from** Cisco Umbrella's documentation, read 23 October 2026[developer.cisco.com](https://developer.cisco.com/docs/cloud-security/) [pubhub.devnetcloud.com](https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 159 of 164 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 4, so ask can line Cisco Umbrella up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Cisco Umbrella. 231 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **164** read look, never change - **45** write create and update - **22** destructive wait for a confirmation 1. ### Reports 62 62 read · 0 write · 0 destructive Get Activities (All) · Get Activity AMP Retrospective · Get Activity DNS · Get Activity Firewall 2. ### Investigate 28 28 read · 0 write · 0 destructive Get BGP Route Information for ASN · Get BGP Route Information for IP · Get Samples for Hash Artifacts · Get Samples for Hash Behaviors 3. ### Providers 16 8 read · 7 write · 1 destructive Get Customer Addresses for Provider · Get Customer Packages for Provider · Get Customer Subscription Details · Get Customer Trial Strength 4. ### Provider console config 13 6 read · 4 write · 3 destructive List Cnames · List Contacts · List Logos · Get Cname 5. ### App discovery 12 10 read · 2 write · 0 destructive List Application Attributes · List Application Categories · List Application Identities · Get Application Risk 6. ### Network tunnels 12 8 read · 3 write · 1 destructive List Data Centers · List Tunnel State Information · Get Tunnel Error Events · List Policies for Tunnel 7. ### Destination lists 8 3 read · 3 write · 2 destructive Get Destination Lists · Get Destinations in Destination List · Get Destination List · Create Destination List 8. ### Users and roles 7 4 read · 2 write · 1 destructive List Users · List Roles · Get User · Create User **16 more areas · 73 actions** - API keys **6** - Application lists **6** - Internal networks **6** - Network devices **6** - Networks **6** - Internal domains **5** - Managed providers **5** - Roaming computers **5** - Sites **5** - Tags **5** - API usage **4** - Virtual appliances **4** - Policies **3** - Provider console reports **3** - SWG device settings **3** - S3 bucket keys **1** Top actions ## The Cisco Umbrella API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 16 of Cisco Umbrella's 16 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `cisco_umbrella.users_and_roles.list_users` List Users | List the user accounts in the organization. | read | `identity.user.list` 474 connectors | | `cisco_umbrella.users_and_roles.list_roles` List Roles | List the roles in the organization. | read | `identity.role.list` 184 connectors | | `cisco_umbrella.users_and_roles.get_user` Get User | Get a user account. | read | `identity.user.get` 399 connectors | | `cisco_umbrella.policies.list_policies` List Policies | List the Umbrella policies. | read | `security.policy.list` 36 connectors | | `cisco_umbrella.users_and_roles.create_user` Create User | Create an Umbrella user account with a designated role. | write | `identity.user.create` 262 connectors | | `cisco_umbrella.networks.list_networks` List Networks | List the Networks. | read | `security.network.list` 15 connectors | | `cisco_umbrella.users_and_roles.delete_user` Delete User | Delete a user account. | destructive | `identity.user.delete` 253 connectors | | `cisco_umbrella.api_keys.get_api_keys` List API Keys | List the API keys created by your organization. | read | `identity.api_key.list` 96 connectors | | `cisco_umbrella.api_keys.get_api_key` Get API Key | Get an API key. | read | `identity.api_key.get` 66 connectors | | `cisco_umbrella.api_keys.create_api_keys` Create API Key | Create an API key with certain scopes, name, description, allowed IP addresses and CIDR blocks, and expiration. | write | `identity.api_key.create` 100 connectors | | `cisco_umbrella.networks.get_network` Get Network | Get a Network. | read | `security.network.get` 10 connectors | | `cisco_umbrella.networks.create_network` Create Network | Create a network. | write | `security.network.create` 8 connectors | Try it ## Prompts to paste into Claude. Each one names the Cisco Umbrella actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Cisco Umbrella? List every user and their role. calls `cisco_umbrella.users_and_roles.list_users` 2. Write write Create User in Cisco Umbrella. Show me exactly what you will send before you save it. calls `cisco_umbrella.users_and_roles.create_user` Governance for Cisco Umbrella ## Destructive actions wait for a yes. 22 Cisco Umbrella actions are destructive. These are all of them: - Delete User `cisco_umbrella.users_and_roles.delete_user` - Delete API Key `cisco_umbrella.api_keys.delete_api_key` - Delete Network `cisco_umbrella.networks.delete_network` - Delete Site `cisco_umbrella.sites.delete_site` - Delete Tag on Devices `cisco_umbrella.tags.delete_tag_on_devices` - Delete Tunnel `cisco_umbrella.network_tunnels.delete_tunnel` - Delete Identity From Policy `cisco_umbrella.policies.delete_policy_identities` - Delete Customer for Provider `cisco_umbrella.providers.delete_provider_customer` - Delete Logo `cisco_umbrella.provider_console_config.delete_logo` - Refresh S3 Bucket Key `cisco_umbrella.s3_bucket_keys.create_s3_bucket_key` - Delete Cname `cisco_umbrella.provider_console_config.delete_cname` - Delete Destinations from Destination List `cisco_umbrella.destination_lists.delete_destinations` - Delete Network Device `cisco_umbrella.network_devices.delete_network_device` - Delete Contact `cisco_umbrella.provider_console_config.delete_contact` - Delete Internal Domain `cisco_umbrella.internal_domains.delete_internal_domain` - Delete Application List `cisco_umbrella.application_lists.delete_application_list` - Delete Destination List `cisco_umbrella.destination_lists.delete_destination_list` - Delete Internal Network `cisco_umbrella.internal_networks.delete_internal_network` - Delete Roaming Computer `cisco_umbrella.roaming_computers.delete_roaming_computer` - Delete Virtual Appliance `cisco_umbrella.virtual_appliances.delete_virtual_appliance` - Delete Customer for Managed Provider `cisco_umbrella.managed_providers.delete_manged_provider_customer` - Delete SWG Override Device Settings `cisco_umbrella.swg_device_settings.delete_secure_web_gateway_device_settings` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do cisco_umbrella.users_and_roles.delete_user confirm_policy: **human** Delete User? **intent:** the user asked me to delete User run suspended · waiting for a named person · key _cisco-umbrella-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "cisco-umbrella-agent", allowed_actions: ["cisco_umbrella.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "cisco_umbrella.users_and_roles.delete_user", approver: "lead@example.com" }, { match: "cisco_umbrella.api_keys.delete_api_key", approver: "lead@example.com" }, { match: "cisco_umbrella.networks.delete_network", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Cisco Umbrella only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Cisco Umbrella costs on actionlake. Every Cisco Umbrella action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Cisco Umbrella refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 231 Cisco Umbrella actions - 231 actions page each page of a long list is one call - 159 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Cisco Umbrella action. 231 actions by area: the id your agent calls, what it does, and its effect. **Reports 62** - `cisco_umbrella.reports.get_activities` Get Activities (All) read - `cisco_umbrella.reports.get_activity_amp_retrospective` Get Activity AMP Retrospective read - `cisco_umbrella.reports.get_activity_dns` Get Activity DNS read - `cisco_umbrella.reports.get_activity_firewall` Get Activity Firewall read - `cisco_umbrella.reports.get_activity_intrusion` Get Activity Intrusion read - `cisco_umbrella.reports.get_activity_ip` Get Activity IP read - `cisco_umbrella.reports.get_activity_proxy` Get Activity Proxy read - `cisco_umbrella.reports.get_applications` Get Applications read - `cisco_umbrella.reports.get_bandwidth_by_hour` Get Bandwidth by Hour (All) read - `cisco_umbrella.reports.get_bandwidth_by_timerange` Get Bandwidth by Timerange (All) read - `cisco_umbrella.reports.get_categories` Get Categories read - `cisco_umbrella.reports.get_deployment_status` Get Deployment Status read - `cisco_umbrella.reports.get_deployment_status_by_organization` Get Deployment Status by Organization read - `cisco_umbrella.reports.get_identities` Get Identities read - `cisco_umbrella.reports.get_identity` Get Identity read - `cisco_umbrella.reports.get_identity_distribution` Get Identity Distribution (All) read - `cisco_umbrella.reports.get_identity_distribution_type` Get Identity Distribution By Type read - `cisco_umbrella.reports.get_organization_requests_by_hour` Get Requests by Hour read - `cisco_umbrella.reports.get_provider_categories` Get Provider Categories read - `cisco_umbrella.reports.get_provider_category_requests_by_organization` Get Provider Category Requests by Organization read - `cisco_umbrella.reports.get_provider_requests_by_category` Get Provider Requests by Category read - `cisco_umbrella.reports.get_provider_requests_by_destination` Get Provider Requests by Destination read - `cisco_umbrella.reports.get_provider_requests_by_hour` Get Provider Requests by Hour (All) read - `cisco_umbrella.reports.get_provider_requests_by_organization` Get Provider Requests by Organization read - `cisco_umbrella.reports.get_provider_requests_by_timerange` Get Provider Requests by Timerange (All) read - `cisco_umbrella.reports.get_requests_by_hour` Get Requests by Hour (All) read - `cisco_umbrella.reports.get_requests_by_hour_and_category` Get Requests by Hour and Category (All) read - `cisco_umbrella.reports.get_requests_by_hour_and_category_and_type` Get Requests by Hour and Category read - `cisco_umbrella.reports.get_requests_by_timerange` Get Requests by Timerange (All) read - `cisco_umbrella.reports.get_requests_by_timerange_and_category` Get Requests by Timerange and Category (All) read - `cisco_umbrella.reports.get_requests_by_timerange_and_category_type` Get Requests by Timerange and Category read - `cisco_umbrella.reports.get_requests_by_timerange_type` Get Requests by Timerange read - `cisco_umbrella.reports.get_summaries_by_category` Get Summaries by Category (All) read - `cisco_umbrella.reports.get_summaries_by_category_type` Get Summaries by Category For Type read - `cisco_umbrella.reports.get_summaries_by_destination` Get Summaries by Destination (All) read - `cisco_umbrella.reports.get_summaries_by_destination_type` Get Summaries by Destination For Type read - `cisco_umbrella.reports.get_summaries_by_rule_intrusion` Get Summaries by Rule read - `cisco_umbrella.reports.get_summary` Get Summary (All) read - `cisco_umbrella.reports.get_summary_by_type` Get Summary By Type read - `cisco_umbrella.reports.get_threat_name` Get Threat Name By Threat ID read - `cisco_umbrella.reports.get_threat_names` Get Threat Names read - `cisco_umbrella.reports.get_threat_type` Get Threat Type By Threat ID read - `cisco_umbrella.reports.get_threat_types` Get Threat Types read - `cisco_umbrella.reports.get_top_categories` Get Top Categories (All) read - `cisco_umbrella.reports.get_top_categories_type` Get Top Categories By Type read - `cisco_umbrella.reports.get_top_destinations` Get Top Destinations read - `cisco_umbrella.reports.get_top_destinations_type` Get Top Destinations By Type read - `cisco_umbrella.reports.get_top_dns_query_types` Get Top DNS Query Types read - `cisco_umbrella.reports.get_top_event_types` Get Top Event Types (All) read - `cisco_umbrella.reports.get_top_files_proxy` Get Top Files (Proxy) read - `cisco_umbrella.reports.get_top_identities` Get Top Identities (All) read - `cisco_umbrella.reports.get_top_identities_type` Get Top Identities read - `cisco_umbrella.reports.get_top_ips` Get Top IPs read - `cisco_umbrella.reports.get_top_ips_internal` Get Top IPs Internal read - `cisco_umbrella.reports.get_top_threat_types` Get Top Threat Types (All) read - `cisco_umbrella.reports.get_top_threat_types_by_type` Get Top Threat Types By Type read - `cisco_umbrella.reports.get_top_threats` Get Top Threats (All) read - `cisco_umbrella.reports.get_top_threats_by_type` Get Top Threats (By Type) read - `cisco_umbrella.reports.get_top_urls` Get Top URLs read - `cisco_umbrella.reports.get_total_requests` Get Total Requests (All) read - `cisco_umbrella.reports.get_total_requests_by_type` Get Total Requests (By Type) read - `cisco_umbrella.reports.post_identities` Get Identities By IDs read **Investigate 28** - `cisco_umbrella.investigate.get_bgp_routes_asn` Get BGP Route Information for ASN read - `cisco_umbrella.investigate.get_bgp_routes_ip` Get BGP Route Information for IP read - `cisco_umbrella.investigate.get_domain_volume` Get Domain Volume read - `cisco_umbrella.investigate.get_domains_categorization` Get Domain Status and Categorization read - `cisco_umbrella.investigate.get_domains_risk_score` Get Risk Score for Domain read - `cisco_umbrella.investigate.get_links_name` Get Related Domains for Domain read - `cisco_umbrella.investigate.get_passive_dns_domain` Get Resource Records for Domain read - `cisco_umbrella.investigate.get_passive_dns_ip` Get Resource Records for IP read - `cisco_umbrella.investigate.get_passive_dns_name` Get Resource Records for Name read - `cisco_umbrella.investigate.get_passive_dns_raw` Get Resource Records for Raw Data read - `cisco_umbrella.investigate.get_recommendations_name` Get Recommendations by Name read - `cisco_umbrella.investigate.get_sample_hash` Get Samples for Hash read - `cisco_umbrella.investigate.get_sample_hash_artifacts` Get Samples for Hash Artifacts read - `cisco_umbrella.investigate.get_sample_hash_behaviors` Get Samples for Hash Behaviors read - `cisco_umbrella.investigate.get_sample_hash_connections` Get Samples for Hash Connections read - `cisco_umbrella.investigate.get_samples_destination` Get Samples for Domain, IP, or URL read - `cisco_umbrella.investigate.get_search` Get Domains by Search read - `cisco_umbrella.investigate.get_security_name` Get Security Score Information for Domain read - `cisco_umbrella.investigate.get_sub_domains` Get Subdomains for Domain read - `cisco_umbrella.investigate.get_timeline` Get Tagging Timeline for Destination read - `cisco_umbrella.investigate.get_topmillion` Get Top Most Seen Domains read - `cisco_umbrella.investigate.get_whois` Get WHOIS Information for Domain read - `cisco_umbrella.investigate.get_whois_email` Get WHOIS Email Information read - `cisco_umbrella.investigate.get_whois_history` Get WHOIS History for Domain read - `cisco_umbrella.investigate.get_whois_nameserver` Get WHOIS Information for Nameserver read - `cisco_umbrella.investigate.get_whois_nameservers` Get WHOIS Information for Nameservers read - `cisco_umbrella.investigate.get_whois_search` Get WHOIS Information Search read - `cisco_umbrella.investigate.post_domains_categorization` Check Status and Categorization of Domains read **Providers 16** - `cisco_umbrella.providers.create_customer_access_request` Create Customer Access Request write - `cisco_umbrella.providers.create_customer_trial_extensions` Create Customer Trial Extensions write - `cisco_umbrella.providers.create_provider_customer` Create Customer for Provider write - `cisco_umbrella.providers.delete_provider_customer` Delete Customer for Provider destructive - `cisco_umbrella.providers.get_customer_access_request` Get Customer Access Request read - `cisco_umbrella.providers.get_customer_addresses` Get Customer Addresses for Provider read - `cisco_umbrella.providers.get_customer_deals` Get Customer Deals by ID read - `cisco_umbrella.providers.get_customer_packages` Get Customer Packages for Provider read - `cisco_umbrella.providers.get_customer_subscription_details` Get Customer Subscription Details read - `cisco_umbrella.providers.get_customer_trial_strength` Get Customer Trial Strength read - `cisco_umbrella.providers.get_provider_customer` Get Customer for Provider read - `cisco_umbrella.providers.list_provider_customers` List Customers for Provider read - `cisco_umbrella.providers.put_trial_conversions` Update Trial to Customer write - `cisco_umbrella.providers.update_customer_access_request` Update Customer Access Request write - `cisco_umbrella.providers.update_customer_deals` Update Customer Deals by ID write - `cisco_umbrella.providers.update_provider_customer` Update Customer for Provider write **Provider console config 13** - `cisco_umbrella.provider_console_config.create_cname` Create Cname write - `cisco_umbrella.provider_console_config.create_contact` Create Contact write - `cisco_umbrella.provider_console_config.delete_cname` Delete Cname destructive - `cisco_umbrella.provider_console_config.delete_contact` Delete Contact destructive - `cisco_umbrella.provider_console_config.delete_logo` Delete Logo destructive - `cisco_umbrella.provider_console_config.get_cname` Get Cname read - `cisco_umbrella.provider_console_config.get_cnames` List Cnames read - `cisco_umbrella.provider_console_config.get_contact` Get Contact read - `cisco_umbrella.provider_console_config.get_contacts` List Contacts read - `cisco_umbrella.provider_console_config.get_logo` Get Logo read - `cisco_umbrella.provider_console_config.get_logos` List Logos read - `cisco_umbrella.provider_console_config.update_cname` Update Cname write - `cisco_umbrella.provider_console_config.update_contact` Update Contact write **App discovery 12** - `cisco_umbrella.app_discovery.get_application` Get Application read - `cisco_umbrella.app_discovery.get_application_attributes` List Application Attributes read - `cisco_umbrella.app_discovery.get_application_categories` List Application Categories read - `cisco_umbrella.app_discovery.get_application_identities` List Application Identities read - `cisco_umbrella.app_discovery.get_application_risk` Get Application Risk read - `cisco_umbrella.app_discovery.get_applications_app_discovery` List Applications read - `cisco_umbrella.app_discovery.get_applications_info` List Information for Applications read - `cisco_umbrella.app_discovery.get_protocol` Get Protocol read - `cisco_umbrella.app_discovery.get_protocol_identities` List Protocol Identities read - `cisco_umbrella.app_discovery.get_protocols` List Protocols read - `cisco_umbrella.app_discovery.patch_applications` Update Applications write - `cisco_umbrella.app_discovery.update_application` Update Application write **Network tunnels 12** - `cisco_umbrella.network_tunnels.add_tunnel` Create Tunnel write - `cisco_umbrella.network_tunnels.delete_tunnel` Delete Tunnel destructive - `cisco_umbrella.network_tunnels.get_datacenters` List Data Centers read - `cisco_umbrella.network_tunnels.get_org_tunnel_state` List Tunnel State Information read - `cisco_umbrella.network_tunnels.get_tunnel` Get Tunnel read - `cisco_umbrella.network_tunnels.get_tunnel_error_events` Get Tunnel Error Events read - `cisco_umbrella.network_tunnels.get_tunnel_global_error_events` Get Tunnel Global Error Events read - `cisco_umbrella.network_tunnels.get_tunnel_policies` List Policies for Tunnel read - `cisco_umbrella.network_tunnels.get_tunnel_state` Get Tunnel State read - `cisco_umbrella.network_tunnels.list_tunnels` List Tunnels read - `cisco_umbrella.network_tunnels.update_tunnel` Update Tunnel write - `cisco_umbrella.network_tunnels.update_tunnel_credentials` Update and Rotate Tunnel Credentials write **Destination lists 8** - `cisco_umbrella.destination_lists.create_destination_list` Create Destination List write - `cisco_umbrella.destination_lists.create_destinations` Add Destinations to Destination List write - `cisco_umbrella.destination_lists.delete_destination_list` Delete Destination List destructive - `cisco_umbrella.destination_lists.delete_destinations` Delete Destinations from Destination List destructive - `cisco_umbrella.destination_lists.get_destination_list` Get Destination List read - `cisco_umbrella.destination_lists.get_destination_lists` Get Destination Lists read - `cisco_umbrella.destination_lists.get_destinations` Get Destinations in Destination List read - `cisco_umbrella.destination_lists.update_destination_lists` Update Destination List write **Users and roles 7** - `cisco_umbrella.users_and_roles.create_password_resets` Create Password Resets write - `cisco_umbrella.users_and_roles.create_user` Create User write - `cisco_umbrella.users_and_roles.delete_user` Delete User destructive - `cisco_umbrella.users_and_roles.get_organization_information` Get Information About Organizations read - `cisco_umbrella.users_and_roles.get_user` Get User read - `cisco_umbrella.users_and_roles.list_roles` List Roles read - `cisco_umbrella.users_and_roles.list_users` List Users read **API keys 6** - `cisco_umbrella.api_keys.create_api_keys` Create API Key write - `cisco_umbrella.api_keys.delete_api_key` Delete API Key destructive - `cisco_umbrella.api_keys.get_api_key` Get API Key read - `cisco_umbrella.api_keys.get_api_keys` List API Keys read - `cisco_umbrella.api_keys.patch_api_key` Update API Key write - `cisco_umbrella.api_keys.refresh_api_key` Refresh API Key write **Application lists 6** - `cisco_umbrella.application_lists.create_application_list` Create Application List write - `cisco_umbrella.application_lists.delete_application_list` Delete Application List destructive - `cisco_umbrella.application_lists.get_application_list` Get Application List read - `cisco_umbrella.application_lists.get_application_lists` Get Application Lists read - `cisco_umbrella.application_lists.put_application_list` Update Application List write - `cisco_umbrella.application_lists.update_usage_applications` Get Usage of Applications read **Internal networks 6** - `cisco_umbrella.internal_networks.create_internal_network` Create Internal Network write - `cisco_umbrella.internal_networks.delete_internal_network` Delete Internal Network destructive - `cisco_umbrella.internal_networks.get_internal_network` Get Internal Network read - `cisco_umbrella.internal_networks.list_internal_network_policies` List Policies for Internal Network read - `cisco_umbrella.internal_networks.list_internal_networks` List Internal Networks read - `cisco_umbrella.internal_networks.update_internal_network` Update Internal Network write **Network devices 6** - `cisco_umbrella.network_devices.create_network_device` Create Network Device write - `cisco_umbrella.network_devices.delete_network_device` Delete Network Device destructive - `cisco_umbrella.network_devices.get_all_network_devices` List Network Devices read - `cisco_umbrella.network_devices.get_network_device` Get Network Device read - `cisco_umbrella.network_devices.list_network_device_policies` List Policies for Network Device read - `cisco_umbrella.network_devices.update_network_device` Update Network Device write **Networks 6** - `cisco_umbrella.networks.create_network` Create Network write - `cisco_umbrella.networks.delete_network` Delete Network destructive - `cisco_umbrella.networks.get_network` Get Network read - `cisco_umbrella.networks.list_network_policies` List Policies for Network read - `cisco_umbrella.networks.list_networks` List Networks read - `cisco_umbrella.networks.update_network` Update Network write **Internal domains 5** - `cisco_umbrella.internal_domains.create_internal_domain` Create Internal Domain write - `cisco_umbrella.internal_domains.delete_internal_domain` Delete Internal Domain destructive - `cisco_umbrella.internal_domains.get_internal_domain` Get Internal Domain read - `cisco_umbrella.internal_domains.list_internal_domains` List Internal Domains read - `cisco_umbrella.internal_domains.update_internal_domain` Update Internal Domain write **Managed providers 5** - `cisco_umbrella.managed_providers.create_managed_provider_customer` Create Customer for Managed Provider write - `cisco_umbrella.managed_providers.delete_manged_provider_customer` Delete Customer for Managed Provider destructive - `cisco_umbrella.managed_providers.get_managed_provider_customer` Get Customer for Managed Provider read - `cisco_umbrella.managed_providers.list_managed_provider_customers` List Customers for Managed Provider read - `cisco_umbrella.managed_providers.update_managed_provider_customer` Update Customer for Managed Provider write **Roaming computers 5** - `cisco_umbrella.roaming_computers.delete_roaming_computer` Delete Roaming Computer destructive - `cisco_umbrella.roaming_computers.get_organization_info` Get OrgInfo Properties read - `cisco_umbrella.roaming_computers.get_roaming_computer` Get Roaming Computer read - `cisco_umbrella.roaming_computers.list_roaming_computers` List Roaming Computers read - `cisco_umbrella.roaming_computers.update_roaming_computer` Update Roaming Computer write **Sites 5** - `cisco_umbrella.sites.create_site` Create Site write - `cisco_umbrella.sites.delete_site` Delete Site destructive - `cisco_umbrella.sites.get_site` Get Site read - `cisco_umbrella.sites.list_sites` List Sites read - `cisco_umbrella.sites.update_site` Update Site write **Tags 5** - `cisco_umbrella.tags.add_tag_to_devices` Add Tag to Devices write - `cisco_umbrella.tags.create_tag` Add Tag write - `cisco_umbrella.tags.delete_tag_on_devices` Delete Tag on Devices destructive - `cisco_umbrella.tags.get_devices_with_tag` Get Devices With Tag read - `cisco_umbrella.tags.get_tags` Get Tags read **API usage 4** - `cisco_umbrella.api_usage.get_api_usage_keys` Get Keys read - `cisco_umbrella.api_usage.get_api_usage_requests` Get Requests read - `cisco_umbrella.api_usage.get_api_usage_responses` Get Responses read - `cisco_umbrella.api_usage.get_api_usage_summary` Get Summary read **Virtual appliances 4** - `cisco_umbrella.virtual_appliances.delete_virtual_appliance` Delete Virtual Appliance destructive - `cisco_umbrella.virtual_appliances.get_virtual_appliance` Get Virtual Appliance read - `cisco_umbrella.virtual_appliances.list_virtual_appliances` List Virtual Appliances read - `cisco_umbrella.virtual_appliances.update_virtual_appliance` Update Virtual Appliance write **Policies 3** - `cisco_umbrella.policies.delete_policy_identities` Delete Identity From Policy destructive - `cisco_umbrella.policies.list_policies` List Policies read - `cisco_umbrella.policies.update_policy_identities` Add Identity to Policy write **Provider console reports 3** - `cisco_umbrella.provider_console_reports.create_customer_security_report_request` Create Customer Security Report Request write - `cisco_umbrella.provider_console_reports.get_providers_console_data` Get Providers Console Data read - `cisco_umbrella.provider_console_reports.get_service_provider_customer_security_report` Get Customer Security Report read **SWG device settings 3** - `cisco_umbrella.swg_device_settings.create_secure_web_gateway_device_settings` Set SWG Override Device Settings write - `cisco_umbrella.swg_device_settings.delete_secure_web_gateway_device_settings` Delete SWG Override Device Settings destructive - `cisco_umbrella.swg_device_settings.list_secure_web_gateway_device_settings` List SWG Override Device Settings read **S3 bucket keys 1** - `cisco_umbrella.s3_bucket_keys.create_s3_bucket_key` Refresh S3 Bucket Key destructive Questions ## The Cisco Umbrella MCP server, answered. **Is there a Cisco Umbrella MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 231 Cisco Umbrella actions across reports, investigate, providers and provider console config, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Cisco Umbrella. **What do I need to connect Cisco Umbrella?** Umbrella API key (Admin > API Keys > Add; choose the key scopes the actions you call need) and Umbrella API key secret (shown once when the key is created). The free call account { op: "connections.requirements", service: "cisco_umbrella" } lists exactly what to paste. **Can an AI agent delete or change things in Cisco Umbrella?** Only if its key allows it, and only with an explicit confirmation. 22 Cisco Umbrella actions are destructive, including delete User, delete API Key and delete Network. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Cisco Umbrella API limit?** actionlake paces every call to the limits in the Cisco Umbrella service file: 10 calls a second per connection. Repeated reads are answered from cache (159 Cisco Umbrella actions can be), which never reaches Cisco Umbrella. **What does a Cisco Umbrella action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (231 Cisco Umbrella actions page). Cache hits, searches, dry runs and calls Cisco Umbrella refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Cisco Umbrella API does it cover?** The Umbrella API v2 (OpenAPI 3 per API family) at api.umbrella.com. It is built from Cisco Umbrella's documentation as read on 23 October 2026. 231 actions in 24 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Cisco Umbrella data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Cisco Umbrella credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Cisco Umbrella Shares the most action names with - [Imperva Cloud Application Security 10](https://actionlake.com/connectors/imperva-cloud-application-security) - [SUSE Rancher Manager 10](https://actionlake.com/connectors/suse-rancher-manager) - [Tactical RMM 9](https://actionlake.com/connectors/tactical-rmm) - [Automox 8](https://actionlake.com/connectors/automox) - [Tailscale 8](https://actionlake.com/connectors/tailscale) - [Fortinet FortiGate 4](https://actionlake.com/connectors/fortinet-fortigate) Joins with, on shared entities - [Cloudflare 4](https://actionlake.com/connectors/cloudflare) - [Tenable Vulnerability Management 4](https://actionlake.com/connectors/tenable-vulnerability-management) - [Panther 3](https://actionlake.com/connectors/panther) - [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users) - [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx) - [Rubrik Security Cloud 2](https://actionlake.com/connectors/rubrik-security-cloud) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Cisco Umbrella; the name is the vendor's own. Counts are from the Cisco Umbrella service file, version 1.0.0. ## Give your agent Cisco Umbrella today. [Connect Cisco Umbrella free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/cisco-umbrella More: https://actionlake.com/llms.txt