--- title: "Cribl MCP server for AI agents - actionlake" description: "Give Claude 836 Cribl actions through one MCP server: pack system lookups. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/cribl updated: 2026-10-23 --- Connectors · Observability & analytics # Cribl MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Cribl and the rest of your systems. It gives your agent 836 Cribl actions (420 reads, 298 writes and 118 that wait for a confirmation) and holds the Cribl credential itself, so the agent never does. It paces Cribl's limits and records every call. [Connect Cribl free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "cribl.system_users.list", intent: "check which Cribl account is connected" } # List all users · read · 1 upstream call ``` - 836 actions in one signed file - 420 read look, never change - 298 write create and update - 118 wait for a yes destructive, confirmed first Set up ## Connect Cribl in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Cribl. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Client ID of a Cribl.Cloud API Credential (Cribl.Cloud > Organization > API Credentials > Add Credential; give it… - `client_secret` Client Secret of that API Credential (shown when the credential is created) - `host` Where your Cribl lives: your host ``` account { op: "connections.requirements", service: "cribl" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "cribl.system_users.list" } # list all users · read · 1 upstream call check { action: "cribl.system_users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Cribl at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `host` **Limits we pace to** 300 calls a minute, per connection **API covered** Cribl API v1 (4.20.3-ea354447) and Cribl.Cloud Public API 1.0, at your Cribl instance's API base URL, which you enter when connecting **Built from** Cribl's documentation, read 23 October 2026[OpenAPI spec (GitHub)](https://github.com/criblio/cribl-openapi-spec/blob/main/specs/control-plane.yml) [OpenAPI spec (GitHub)](https://github.com/criblio/cribl-openapi-spec/blob/main/specs/control-plane-v2-full.yml) [OpenAPI spec (GitHub)](https://github.com/criblio/cribl-openapi-spec/blob/main/specs/mgmt-plane.yml) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 375 of 420 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Cribl up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Cribl. 836 actions in 398 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **420** read look, never change - **298** write create and update - **118** destructive wait for a confirmation 1. ### Pack system lookups 6 2 read · 3 write · 1 destructive Create a Lookup within a Pack · List all Lookups within a Pack · Get a Lookup within a Pack · Upload a Lookup file within a Pack 2. ### Products lake lakes datasets 6 2 read · 3 write · 1 destructive Create Lake Datasets (Cribl.Cloud only) · List all Lake Datasets (Cribl.Cloud only) · Get a Lake Dataset (Cribl.Cloud only) · Updates a list of Lake Datasets in a Lake (Cribl.Cloud only) 3. ### System lookups 6 2 read · 3 write · 1 destructive Create a Lookup · List all Lookups · Get a Lookup · Upload a Lookup file 4. ### A backend schedules 5 2 read · 2 write · 1 destructive Create a backend schedule for an App · List backend schedules for an App · Get a backend schedule for an App · Update a backend schedule for an App 5. ### Admin products mappings 5 2 read · 2 write · 1 destructive Create a Mapping Ruleset · List all Mapping Rulesets · Get a Mapping Ruleset · Update a Mapping Ruleset 6. ### Alert monitors 5 2 read · 2 write · 1 destructive Create an alert Monitor · List alert Monitors · Get an alert Monitor · Update an alert Monitor 7. ### Alert silences 5 2 read · 2 write · 1 destructive Create an alert silence · List alert silences · Get an alert silence · Update an alert silence 8. ### Apps 5 2 read · 2 write · 1 destructive Install an App · List all Apps · Get an App · Upgrade an installed App **112 more areas · 793 actions** - Cloud API credentials **5** - Cloud workspaces **5** - Lib breakers **5** - Lib database connections **5** - Lib grok **5** - Lib hmac functions **5** - Lib jobs **5** - Lib parquet schemas **5** - Lib parsers **5** - Lib regex **5** - Lib schemas **5** - Lib SDS rules **5** - Lib vars **5** - Notification targets **5** - Notifications **5** - Pack lib breakers **5** - Pack lib database connections **5** - Pack lib grok **5** - Pack lib hmac functions **5** - Pack lib jobs **5** - Pack lib parsers **5** - Pack lib regex **5** - Pack lib schemas **5** - Pack lib SDS rules **5** - Pack lib vars **5** - Pack notifications **5** - Pack pipelines **5** - Pack search dashboards **5** - Pack search datatypes **5** - Pack search macros **5** - Pack search saved **5** - Pack system inputs **5** - Pack system outputs **5** - Pack system samples **5** - Packs **5** - Pipelines **5** - Products groups **5** - Products lake lakes buckets **5** - Products lake lakes sources **5** - Products lake lakes storage locations **5** - Search dashboard categories **5** - Search dashboards **5** - Search dataset providers **5** - Search datasets **5** - Search datatypes **5** - Search jobs **5** - Search local search dataset rulesets **5** - Search local search datatype rulesets **5** - Search local search engines **5** - Search local search sources **5** - Search macros **5** - Search notebook templates **5** - Search notebooks **5** - Search saved **5** - Search usage groups **5** - System banners **5** - System certificates **5** - System DSD connections **5** - System inputs **5** - System keys **5** - System outputs **5** - System private keys **5** - System profiler **5** - System provisioning tokens **5** - System roles **5** - System samples **5** - System scripts **5** - System secret folders secrets **5** - System secret stores **5** - System secrets **5** - System subscriptions **5** - System teams **5** - System users **5** - AI settings features **4** - AI settings MCP servers **4** - Jobs **4** - Products lake lakes direct access **4** - System licenses **4** - System messages **4** - System secret folders **4** - AI settings providers **3** - Alert history **3** - Lib SDS rulesets **3** - Pack routes **3** - Routes **3** - Search datasets favorites **3** - Search federated search engines **3** - Search local search group size override **3** - Search saved notifications **3** - System distributed upgrade **3** - System logger **3** - System processes **3** - AI consent **2** - AI settings agents MD **2** - Apps kvstore settings **2** - Apps proxies **2** - Changelog viewed **2** - Collectors **2** - Conditions **2** - Edge containers **2** - Edge processes **2** - Executors **2** - Functions **2** - Lake erasure requests **2** - Lib MDT devices **2** - Lib protobuf libraries **2** - Lib protobuf libraries encodings **2** - Pack collectors **2** - Pack executors **2** - Pack functions **2** - Pack jobs **2** - 279 smaller areas **326** Top actions ## The Cribl API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 20 of Cribl's 20 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `cribl.system_users.list` List all users | List all users. | read | `identity.user.list` 474 connectors | | `cribl.system_teams.list` List all Teams | List all Teams. | read | `identity.group.list` 262 connectors | | `cribl.system_users.create` Create a user | Create a user. | write | `identity.user.create` 262 connectors | | `cribl.system_teams.create` Create a Team | Create a Team. | write | `identity.group.create` 205 connectors | | `cribl.system_users.delete` Delete a user | Delete a user. | destructive | `identity.user.delete` 253 connectors | | `cribl.system_roles.list` List all Roles (on-prem only) | List all Roles (on-prem only). | read | `identity.role.list` 184 connectors | | `cribl.system_roles.create` Create a Role (on-prem only) | Create a Role (on-prem only). | write | `identity.role.create` 105 connectors | | `cribl.cloud_api_credentials.create` Create an API Credential | Create an API Credential. | write | `identity.api_key.create` 100 connectors | | `cribl.cloud_api_credentials.list` List API Credentials for an Organization | List API Credentials for an Organization. | read | `identity.api_key.list` 96 connectors | | `cribl.apps.list` List all Apps | List all Apps. | read | this connector | | `cribl.clui.list` Search the CLI | Search the CLI. | read | this connector | | `cribl.jobs.list` List all jobs | List all jobs. | read | this connector | Try it ## Prompts to paste into Claude. Each one names the Cribl actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Cribl? List every user and their role. calls `cribl.system_users.list` 2. Write write Create a user in Cribl. Show me exactly what you will send before you save it. calls `cribl.system_users.create` Governance for Cribl ## Destructive actions wait for a yes. 118 Cribl actions are destructive. The first 10: - Delete a user `cribl.system_users.delete` - Delete a Team `cribl.system_teams.delete` - Delete a Role (on-prem only) `cribl.system_roles.delete` - Delete an API Credential `cribl.cloud_api_credentials.delete` - Uninstall an App `cribl.apps.delete` - Delete a job `cribl.jobs.delete` - Uninstall a Pack `cribl.packs.delete` - Delete a Grok file `cribl.lib_grok.delete` - Delete a Collector `cribl.lib_jobs.delete` - Delete a Global Variable `cribl.lib_vars.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do cribl.system_users.delete confirm_policy: **human** Delete a user? **intent:** the user asked me to delete a user run suspended · waiting for a named person · key _cribl-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "cribl-agent", allowed_actions: ["cribl.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "cribl.system_users.delete", approver: "lead@example.com" }, { match: "cribl.system_teams.delete", approver: "lead@example.com" }, { match: "cribl.system_roles.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Cribl only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Cribl costs on actionlake. Every Cribl action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Cribl refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 836 Cribl actions - 836 actions page each page of a long list is one call - 375 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Cribl action. 836 actions by area: the id your agent calls, what it does, and its effect. **Pack system lookups 6** - `cribl.pack_system_lookups.create` Create a Lookup within a Pack write - `cribl.pack_system_lookups.get` Get a Lookup within a Pack read - and 4 more in this area **Products lake lakes datasets 6** - `cribl.products_lake_lakes_datasets.create` Create Lake Datasets (Cribl.Cloud only) write - `cribl.products_lake_lakes_datasets.get` Get a Lake Dataset (Cribl.Cloud only) read - and 4 more in this area **System lookups 6** - `cribl.system_lookups.create` Create a Lookup write - `cribl.system_lookups.get` Get a Lookup read - and 4 more in this area **A backend schedules 5** - `cribl.a_backend_schedules.create` Create a backend schedule for an App write - `cribl.a_backend_schedules.get` Get a backend schedule for an App read - and 3 more in this area **Admin products mappings 5** - `cribl.admin_products_mappings.create` Create a Mapping Ruleset write - `cribl.admin_products_mappings.get` Get a Mapping Ruleset read - and 3 more in this area **Alert monitors 5** - `cribl.alert_monitors.create` Create an alert Monitor write - `cribl.alert_monitors.get` Get an alert Monitor read - and 3 more in this area **Alert silences 5** - `cribl.alert_silences.create` Create an alert silence write - `cribl.alert_silences.get` Get an alert silence read - and 3 more in this area **Apps 5** - `cribl.apps.create` Install an App write - `cribl.apps.get` Get an App read - and 3 more in this area **Cloud API credentials 5** - `cribl.cloud_api_credentials.create` Create an API Credential write - `cribl.cloud_api_credentials.delete` Delete an API Credential destructive - and 3 more in this area **Cloud workspaces 5** - `cribl.cloud_workspaces.create` Create a Workspace in the specified Organization write - `cribl.cloud_workspaces.get` Get a Workspace read - and 3 more in this area **Lib breakers 5** - `cribl.lib_breakers.create` Create an Event Breaker Ruleset write - `cribl.lib_breakers.get` Get an Event Breaker Ruleset read - and 3 more in this area **Lib database connections 5** - `cribl.lib_database_connections.create` Create a Database Connection write - `cribl.lib_database_connections.get` Get a Database Connection read - and 3 more in this area **Lib grok 5** - `cribl.lib_grok.create` Create a Grok file write - `cribl.lib_grok.get` Get a Grok file read - and 3 more in this area **Lib hmac functions 5** - `cribl.lib_hmac_functions.create` Create an HMAC Function write - `cribl.lib_hmac_functions.get` Get an HMAC Function read - and 3 more in this area **Lib jobs 5** - `cribl.lib_jobs.create` Create a Collector write - `cribl.lib_jobs.get` Get a Collector read - and 3 more in this area **Lib parquet schemas 5** - `cribl.lib_parquet_schemas.create` Create a Parquet schema write - `cribl.lib_parquet_schemas.get` Get a Parquet schema read - and 3 more in this area **Lib parsers 5** - `cribl.lib_parsers.create` Create a Parser write - `cribl.lib_parsers.get` Get a Parser read - and 3 more in this area **Lib regex 5** - `cribl.lib_regex.create` Create a Regex Library entry write - `cribl.lib_regex.get` Get a Regex Library entry read - and 3 more in this area **Lib schemas 5** - `cribl.lib_schemas.create` Create a JSON schema write - `cribl.lib_schemas.get` Get a JSON schema read - and 3 more in this area **Lib SDS rules 5** - `cribl.lib_sds_rules.create` Create a sensitive data scanning (SDS) rule write - `cribl.lib_sds_rules.get` Get a sensitive data scanning (SDS) rule read - and 3 more in this area **Lib vars 5** - `cribl.lib_vars.create` Create a Global Variable write - `cribl.lib_vars.get` Get a Global Variable read - and 3 more in this area **Notification targets 5** - `cribl.notification_targets.create` Create a Notification target write - `cribl.notification_targets.get` Get a Notification target read - and 3 more in this area **Notifications 5** - `cribl.notifications.create` Create a Notification write - `cribl.notifications.get` Get a Notification read - and 3 more in this area **Pack lib breakers 5** - `cribl.pack_lib_breakers.create` Create an Event Breaker Ruleset within a Pack write - `cribl.pack_lib_breakers.get` Get an Event Breaker Ruleset within a Pack read - and 3 more in this area **Pack lib database connections 5** - `cribl.pack_lib_database_connections.create` Create a Database Connection within a Pack write - `cribl.pack_lib_database_connections.get` Get a Database Connection within a Pack read - and 3 more in this area **Pack lib grok 5** - `cribl.pack_lib_grok.create` Create a Grok file within a Pack write - `cribl.pack_lib_grok.get` Get a Grok file within a Pack read - and 3 more in this area **Pack lib hmac functions 5** - `cribl.pack_lib_hmac_functions.create` Create an HMAC Function within a Pack write - `cribl.pack_lib_hmac_functions.get` Get an HMAC Function within a Pack read - and 3 more in this area **Pack lib jobs 5** - `cribl.pack_lib_jobs.create` Create a Collector within a Pack write - `cribl.pack_lib_jobs.get` Get a Collector within a Pack read - and 3 more in this area **Pack lib parsers 5** - `cribl.pack_lib_parsers.create` Create a Parser within a Pack write - `cribl.pack_lib_parsers.get` Get a Parser within a Pack read - and 3 more in this area **Pack lib regex 5** - `cribl.pack_lib_regex.create` Create a Regex Library entry within a Pack write - `cribl.pack_lib_regex.get` Get a Regex Library entry within a Pack read - and 3 more in this area Pack lib schemas **5** Pack lib SDS rules **5** Pack lib vars **5** Pack notifications **5** Pack pipelines **5** Pack search dashboards **5** Pack search datatypes **5** Pack search macros **5** Pack search saved **5** Pack system inputs **5** Pack system outputs **5** Pack system samples **5** Packs **5** Pipelines **5** Products groups **5** Products lake lakes buckets **5** Products lake lakes sources **5** Products lake lakes storage locations **5** Search dashboard categories **5** Search dashboards **5** Search dataset providers **5** Search datasets **5** Search datatypes **5** Search jobs **5** Search local search dataset rulesets **5** Search local search datatype rulesets **5** Search local search engines **5** Search local search sources **5** Search macros **5** Search notebook templates **5** Search notebooks **5** Search saved **5** Search usage groups **5** System banners **5** System certificates **5** System DSD connections **5** System inputs **5** System keys **5** System outputs **5** System private keys **5** System profiler **5** System provisioning tokens **5** System roles **5** System samples **5** System scripts **5** System secret folders secrets **5** System secret stores **5** System secrets **5** System subscriptions **5** System teams **5** System users **5** AI settings features **4** AI settings MCP servers **4** Jobs **4** Products lake lakes direct access **4** System licenses **4** System messages **4** System secret folders **4** AI settings providers **3** Alert history **3** Lib SDS rulesets **3** Pack routes **3** Routes **3** Search datasets favorites **3** Search federated search engines **3** Search local search group size override **3** Search saved notifications **3** System distributed upgrade **3** System logger **3** System processes **3** AI consent **2** AI settings agents MD **2** Apps kvstore settings **2** Apps proxies **2** Changelog viewed **2** Collectors **2** Conditions **2** Edge containers **2** Edge processes **2** Executors **2** Functions **2** Lake erasure requests **2** Lib MDT devices **2** Lib protobuf libraries **2** Lib protobuf libraries encodings **2** Pack collectors **2** Pack executors **2** Pack functions **2** Pack jobs **2** 279 smaller areas **326** This index shows a sample of each area. All 836 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Cribl MCP server, answered. **Is there a Cribl MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 836 Cribl actions across pack system lookups, products lake lakes datasets, system lookups and a backend schedules, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Cribl. **What do I need to connect Cribl?** Client ID of a Cribl.Cloud API Credential (Cribl.Cloud > Organization > API Credentials > Add Credential; give it… and Client Secret of that API Credential (shown when the credential is created). Plus your host. The free call account { op: "connections.requirements", service: "cribl" } lists exactly what to paste. **Can an AI agent delete or change things in Cribl?** Only if its key allows it, and only with an explicit confirmation. 118 Cribl actions are destructive, including delete a user, delete a Team and delete a Role (on-prem only). Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Cribl API limit?** actionlake paces every call to the limits in the Cribl service file: 300 calls a minute per connection. Repeated reads are answered from cache (375 Cribl actions can be), which never reaches Cribl. **What does a Cribl action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (836 Cribl actions page). Cache hits, searches, dry runs and calls Cribl refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Cribl API does it cover?** The Cribl API v1 (4.20.3-ea354447) and Cribl.Cloud Public API 1.0 at your Cribl instance's API base URL, which you enter when connecting. It is built from Cribl's documentation as read on 23 October 2026. 836 actions in 398 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Cribl data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Cribl credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Cribl Shares the most action names with - [Looker 15](https://actionlake.com/connectors/looker) - [Qlik Cloud 12](https://actionlake.com/connectors/qlik-cloud) - [Zoho Analytics 12](https://actionlake.com/connectors/zoho-analytics) - [Databricks 10](https://actionlake.com/connectors/databricks) - [MuleSoft Anypoint Platform 10](https://actionlake.com/connectors/mulesoft-anypoint-platform) - [ThoughtSpot 9](https://actionlake.com/connectors/thoughtspot) Joins with, on shared entities - [HaloPSA 2](https://actionlake.com/connectors/halopsa) - [Slack 2](https://actionlake.com/connectors/slack) - [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users) - [ServiceNow 2](https://actionlake.com/connectors/servicenow) - [Fortinet FortiGate 2](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx) Browse - [All Observability & analytics connectors](https://actionlake.com/connectors/category/observability-and-analytics) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Cribl; the name is the vendor's own. Counts are from the Cribl service file, version 1.0.0. ## Give your agent Cribl today. [Connect Cribl free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/cribl More: https://actionlake.com/llms.txt