Connectors · Observability & analytics
Cribl MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Cribl and the rest of your systems. It gives your agent 836 Cribl actions (420 reads, 298 writes and 118 that wait for a confirmation) and holds the Cribl credential itself, so the agent never does. It paces Cribl's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "cribl.system_users.list", intent: "check which Cribl account is connected"}# List all users · read · 1 upstream call- 836actionsin one signed file
- 420readlook, never change
- 298writecreate and update
- 118wait for a yesdestructive, confirmed first
Set up
Connect Cribl in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Cribl.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idClient ID of a Cribl.Cloud API Credential (Cribl.Cloud > Organization > API Credentials > Add Credential; give it…client_secretClient Secret of that API Credential (shown when the credential is created)hostWhere your Cribl lives: your host
account { op: "connections.requirements", service: "cribl" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "cribl.system_users.list" }# list all users · read · 1 upstream callcheck { action: "cribl.system_users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Cribl at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
host- Limits we pace to
- 300 calls a minute, per connection
- API covered
- Cribl API v1 (4.20.3-ea354447) and Cribl.Cloud Public API 1.0, at your Cribl instance's API base URL, which you enter when connecting
- Built from
- Cribl's documentation, read 23 October 2026OpenAPI spec (GitHub)OpenAPI spec (GitHub)OpenAPI spec (GitHub)
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 375 of 420 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line Cribl up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Cribl.
836 actions in 398 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 420readlook, never change
- 298writecreate and update
- 118destructivewait for a confirmation
Pack system lookups
62 read · 3 write · 1 destructive
Create a Lookup within a Pack · List all Lookups within a Pack · Get a Lookup within a Pack · Upload a Lookup file within a Pack
Products lake lakes datasets
62 read · 3 write · 1 destructive
Create Lake Datasets (Cribl.Cloud only) · List all Lake Datasets (Cribl.Cloud only) · Get a Lake Dataset (Cribl.Cloud only) · Updates a list of Lake Datasets in a Lake (Cribl.Cloud only)
System lookups
62 read · 3 write · 1 destructive
Create a Lookup · List all Lookups · Get a Lookup · Upload a Lookup file
A backend schedules
52 read · 2 write · 1 destructive
Create a backend schedule for an App · List backend schedules for an App · Get a backend schedule for an App · Update a backend schedule for an App
Admin products mappings
52 read · 2 write · 1 destructive
Create a Mapping Ruleset · List all Mapping Rulesets · Get a Mapping Ruleset · Update a Mapping Ruleset
Alert monitors
52 read · 2 write · 1 destructive
Create an alert Monitor · List alert Monitors · Get an alert Monitor · Update an alert Monitor
Alert silences
52 read · 2 write · 1 destructive
Create an alert silence · List alert silences · Get an alert silence · Update an alert silence
Apps
52 read · 2 write · 1 destructive
Install an App · List all Apps · Get an App · Upgrade an installed App
112 more areas · 793 actions
- Cloud API credentials 5
- Cloud workspaces 5
- Lib breakers 5
- Lib database connections 5
- Lib grok 5
- Lib hmac functions 5
- Lib jobs 5
- Lib parquet schemas 5
- Lib parsers 5
- Lib regex 5
- Lib schemas 5
- Lib SDS rules 5
- Lib vars 5
- Notification targets 5
- Notifications 5
- Pack lib breakers 5
- Pack lib database connections 5
- Pack lib grok 5
- Pack lib hmac functions 5
- Pack lib jobs 5
- Pack lib parsers 5
- Pack lib regex 5
- Pack lib schemas 5
- Pack lib SDS rules 5
- Pack lib vars 5
- Pack notifications 5
- Pack pipelines 5
- Pack search dashboards 5
- Pack search datatypes 5
- Pack search macros 5
- Pack search saved 5
- Pack system inputs 5
- Pack system outputs 5
- Pack system samples 5
- Packs 5
- Pipelines 5
- Products groups 5
- Products lake lakes buckets 5
- Products lake lakes sources 5
- Products lake lakes storage locations 5
- Search dashboard categories 5
- Search dashboards 5
- Search dataset providers 5
- Search datasets 5
- Search datatypes 5
- Search jobs 5
- Search local search dataset rulesets 5
- Search local search datatype rulesets 5
- Search local search engines 5
- Search local search sources 5
- Search macros 5
- Search notebook templates 5
- Search notebooks 5
- Search saved 5
- Search usage groups 5
- System banners 5
- System certificates 5
- System DSD connections 5
- System inputs 5
- System keys 5
- System outputs 5
- System private keys 5
- System profiler 5
- System provisioning tokens 5
- System roles 5
- System samples 5
- System scripts 5
- System secret folders secrets 5
- System secret stores 5
- System secrets 5
- System subscriptions 5
- System teams 5
- System users 5
- AI settings features 4
- AI settings MCP servers 4
- Jobs 4
- Products lake lakes direct access 4
- System licenses 4
- System messages 4
- System secret folders 4
- AI settings providers 3
- Alert history 3
- Lib SDS rulesets 3
- Pack routes 3
- Routes 3
- Search datasets favorites 3
- Search federated search engines 3
- Search local search group size override 3
- Search saved notifications 3
- System distributed upgrade 3
- System logger 3
- System processes 3
- AI consent 2
- AI settings agents MD 2
- Apps kvstore settings 2
- Apps proxies 2
- Changelog viewed 2
- Collectors 2
- Conditions 2
- Edge containers 2
- Edge processes 2
- Executors 2
- Functions 2
- Lake erasure requests 2
- Lib MDT devices 2
- Lib protobuf libraries 2
- Lib protobuf libraries encodings 2
- Pack collectors 2
- Pack executors 2
- Pack functions 2
- Pack jobs 2
- 279 smaller areas 326
Top actions
The Cribl API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 20 of Cribl's 20 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
cribl.system_users.listList all users | List all users. | read | identity.user.list474 connectors |
cribl.system_teams.listList all Teams | List all Teams. | read | identity.group.list262 connectors |
cribl.system_users.createCreate a user | Create a user. | write | identity.user.create262 connectors |
cribl.system_teams.createCreate a Team | Create a Team. | write | identity.group.create205 connectors |
cribl.system_users.deleteDelete a user | Delete a user. | destructive | identity.user.delete253 connectors |
cribl.system_roles.listList all Roles (on-prem only) | List all Roles (on-prem only). | read | identity.role.list184 connectors |
cribl.system_roles.createCreate a Role (on-prem only) | Create a Role (on-prem only). | write | identity.role.create105 connectors |
cribl.cloud_api_credentials.createCreate an API Credential | Create an API Credential. | write | identity.api_key.create100 connectors |
cribl.cloud_api_credentials.listList API Credentials for an Organization | List API Credentials for an Organization. | read | identity.api_key.list96 connectors |
cribl.apps.listList all Apps | List all Apps. | read | this connector |
cribl.clui.listSearch the CLI | Search the CLI. | read | this connector |
cribl.jobs.listList all jobs | List all jobs. | read | this connector |
Try it
Prompts to paste into Claude.
Each one names the Cribl actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in Cribl? List every user and their role.
calls
cribl.system_users.list - Writewrite
Create a user in Cribl. Show me exactly what you will send before you save it.
calls
cribl.system_users.create
Governance for Cribl
Destructive actions wait for a yes.
118 Cribl actions are destructive. The first 10:
- Delete a user
cribl.system_users.delete - Delete a Team
cribl.system_teams.delete - Delete a Role (on-prem only)
cribl.system_roles.delete - Delete an API Credential
cribl.cloud_api_credentials.delete - Uninstall an App
cribl.apps.delete - Delete a job
cribl.jobs.delete - Uninstall a Pack
cribl.packs.delete - Delete a Grok file
cribl.lib_grok.delete - Delete a Collector
cribl.lib_jobs.delete - Delete a Global Variable
cribl.lib_vars.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete a user?
intent: the user asked me to delete a user
account { op: "keys.create", name: "cribl-agent", allowed_actions: ["cribl.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "cribl.system_users.delete", approver: "[email protected]" }, { match: "cribl.system_teams.delete", approver: "[email protected]" }, { match: "cribl.system_roles.delete", approver: "[email protected]" } ]}Cost
What Cribl costs on actionlake.
Every Cribl action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Cribl refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 836 Cribl actions
- 836actions pageeach page of a long list is one call
- 375reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Cribl action.
836 actions by area: the id your agent calls, what it does, and its effect.
Pack system lookups6
cribl.pack_system_lookups.createCreate a Lookup within a Packwritecribl.pack_system_lookups.getGet a Lookup within a Packread- and 4 more in this area
Products lake lakes datasets6
cribl.products_lake_lakes_datasets.createCreate Lake Datasets (Cribl.Cloud only)writecribl.products_lake_lakes_datasets.getGet a Lake Dataset (Cribl.Cloud only)read- and 4 more in this area
System lookups6
cribl.system_lookups.createCreate a Lookupwritecribl.system_lookups.getGet a Lookupread- and 4 more in this area
A backend schedules5
cribl.a_backend_schedules.createCreate a backend schedule for an Appwritecribl.a_backend_schedules.getGet a backend schedule for an Appread- and 3 more in this area
Admin products mappings5
cribl.admin_products_mappings.createCreate a Mapping Rulesetwritecribl.admin_products_mappings.getGet a Mapping Rulesetread- and 3 more in this area
Alert monitors5
cribl.alert_monitors.createCreate an alert Monitorwritecribl.alert_monitors.getGet an alert Monitorread- and 3 more in this area
Alert silences5
cribl.alert_silences.createCreate an alert silencewritecribl.alert_silences.getGet an alert silenceread- and 3 more in this area
Apps5
cribl.apps.createInstall an Appwritecribl.apps.getGet an Appread- and 3 more in this area
Cloud API credentials5
cribl.cloud_api_credentials.createCreate an API Credentialwritecribl.cloud_api_credentials.deleteDelete an API Credentialdestructive- and 3 more in this area
Cloud workspaces5
cribl.cloud_workspaces.createCreate a Workspace in the specified Organizationwritecribl.cloud_workspaces.getGet a Workspaceread- and 3 more in this area
Lib breakers5
cribl.lib_breakers.createCreate an Event Breaker Rulesetwritecribl.lib_breakers.getGet an Event Breaker Rulesetread- and 3 more in this area
Lib database connections5
cribl.lib_database_connections.createCreate a Database Connectionwritecribl.lib_database_connections.getGet a Database Connectionread- and 3 more in this area
Lib grok5
cribl.lib_grok.createCreate a Grok filewritecribl.lib_grok.getGet a Grok fileread- and 3 more in this area
Lib hmac functions5
cribl.lib_hmac_functions.createCreate an HMAC Functionwritecribl.lib_hmac_functions.getGet an HMAC Functionread- and 3 more in this area
Lib jobs5
cribl.lib_jobs.createCreate a Collectorwritecribl.lib_jobs.getGet a Collectorread- and 3 more in this area
Lib parquet schemas5
cribl.lib_parquet_schemas.createCreate a Parquet schemawritecribl.lib_parquet_schemas.getGet a Parquet schemaread- and 3 more in this area
Lib parsers5
cribl.lib_parsers.createCreate a Parserwritecribl.lib_parsers.getGet a Parserread- and 3 more in this area
Lib regex5
cribl.lib_regex.createCreate a Regex Library entrywritecribl.lib_regex.getGet a Regex Library entryread- and 3 more in this area
Lib schemas5
cribl.lib_schemas.createCreate a JSON schemawritecribl.lib_schemas.getGet a JSON schemaread- and 3 more in this area
Lib SDS rules5
cribl.lib_sds_rules.createCreate a sensitive data scanning (SDS) rulewritecribl.lib_sds_rules.getGet a sensitive data scanning (SDS) ruleread- and 3 more in this area
Lib vars5
cribl.lib_vars.createCreate a Global Variablewritecribl.lib_vars.getGet a Global Variableread- and 3 more in this area
Notification targets5
cribl.notification_targets.createCreate a Notification targetwritecribl.notification_targets.getGet a Notification targetread- and 3 more in this area
Notifications5
cribl.notifications.createCreate a Notificationwritecribl.notifications.getGet a Notificationread- and 3 more in this area
Pack lib breakers5
cribl.pack_lib_breakers.createCreate an Event Breaker Ruleset within a Packwritecribl.pack_lib_breakers.getGet an Event Breaker Ruleset within a Packread- and 3 more in this area
Pack lib database connections5
cribl.pack_lib_database_connections.createCreate a Database Connection within a Packwritecribl.pack_lib_database_connections.getGet a Database Connection within a Packread- and 3 more in this area
Pack lib grok5
cribl.pack_lib_grok.createCreate a Grok file within a Packwritecribl.pack_lib_grok.getGet a Grok file within a Packread- and 3 more in this area
Pack lib hmac functions5
cribl.pack_lib_hmac_functions.createCreate an HMAC Function within a Packwritecribl.pack_lib_hmac_functions.getGet an HMAC Function within a Packread- and 3 more in this area
Pack lib jobs5
cribl.pack_lib_jobs.createCreate a Collector within a Packwritecribl.pack_lib_jobs.getGet a Collector within a Packread- and 3 more in this area
Pack lib parsers5
cribl.pack_lib_parsers.createCreate a Parser within a Packwritecribl.pack_lib_parsers.getGet a Parser within a Packread- and 3 more in this area
Pack lib regex5
cribl.pack_lib_regex.createCreate a Regex Library entry within a Packwritecribl.pack_lib_regex.getGet a Regex Library entry within a Packread- and 3 more in this area
Pack lib schemas 5Pack lib SDS rules 5Pack lib vars 5Pack notifications 5Pack pipelines 5Pack search dashboards 5Pack search datatypes 5Pack search macros 5Pack search saved 5Pack system inputs 5Pack system outputs 5Pack system samples 5Packs 5Pipelines 5Products groups 5Products lake lakes buckets 5Products lake lakes sources 5Products lake lakes storage locations 5Search dashboard categories 5Search dashboards 5Search dataset providers 5Search datasets 5Search datatypes 5Search jobs 5Search local search dataset rulesets 5Search local search datatype rulesets 5Search local search engines 5Search local search sources 5Search macros 5Search notebook templates 5Search notebooks 5Search saved 5Search usage groups 5System banners 5System certificates 5System DSD connections 5System inputs 5System keys 5System outputs 5System private keys 5System profiler 5System provisioning tokens 5System roles 5System samples 5System scripts 5System secret folders secrets 5System secret stores 5System secrets 5System subscriptions 5System teams 5System users 5AI settings features 4AI settings MCP servers 4Jobs 4Products lake lakes direct access 4System licenses 4System messages 4System secret folders 4AI settings providers 3Alert history 3Lib SDS rulesets 3Pack routes 3Routes 3Search datasets favorites 3Search federated search engines 3Search local search group size override 3Search saved notifications 3System distributed upgrade 3System logger 3System processes 3AI consent 2AI settings agents MD 2Apps kvstore settings 2Apps proxies 2Changelog viewed 2Collectors 2Conditions 2Edge containers 2Edge processes 2Executors 2Functions 2Lake erasure requests 2Lib MDT devices 2Lib protobuf libraries 2Lib protobuf libraries encodings 2Pack collectors 2Pack executors 2Pack functions 2Pack jobs 2279 smaller areas 326
This index shows a sample of each area. All 836 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Cribl MCP server, answered.
Is there a Cribl MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 836 Cribl actions across pack system lookups, products lake lakes datasets, system lookups and a backend schedules, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Cribl.
What do I need to connect Cribl?
Client ID of a Cribl.Cloud API Credential (Cribl.Cloud > Organization > API Credentials > Add Credential; give it… and Client Secret of that API Credential (shown when the credential is created). Plus your host. The free call account { op: "connections.requirements", service: "cribl" } lists exactly what to paste.
Can an AI agent delete or change things in Cribl?
Only if its key allows it, and only with an explicit confirmation. 118 Cribl actions are destructive, including delete a user, delete a Team and delete a Role (on-prem only). Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Cribl API limit?
actionlake paces every call to the limits in the Cribl service file: 300 calls a minute per connection. Repeated reads are answered from cache (375 Cribl actions can be), which never reaches Cribl.
What does a Cribl action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (836 Cribl actions page). Cache hits, searches, dry runs and calls Cribl refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Cribl API does it cover?
The Cribl API v1 (4.20.3-ea354447) and Cribl.Cloud Public API 1.0 at your Cribl instance's API base URL, which you enter when connecting. It is built from Cribl's documentation as read on 23 October 2026. 836 actions in 398 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Cribl data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Cribl credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Cribl today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
