--- title: "ESET Connect MCP server for AI agents - actionlake" description: "Give Claude 118 ESET Connect actions through one MCP server: devices, incidents. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/eset-connect updated: 2026-10-23 --- Connectors · MSP & PSA # ESET Connect MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ESET Connect and the rest of your systems. It gives your agent 118 ESET Connect actions (60 reads, 44 writes and 14 that wait for a confirmation) and holds the ESET Connect credential itself, so the agent never does. It paces ESET Connect's limits and records every call. [Connect ESET Connect free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "eset_connect.policies.list", intent: "check which ESET Connect account is connected" } # List policies · read · 1 upstream call ``` - 118 actions in one signed file - 60 read look, never change - 44 write create and update - 14 wait for a yes destructive, confirmed first Set up ## Connect ESET Connect in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect ESET Connect. Session login. actionlake opens the session and renews it when it expires. actionlake stores what you paste write-only, sealed under your tenant's key. - `username` ESET API user email: in ESET PROTECT Hub or ESET Business Account create a dedicated user with Integrations (API)… - `password` Password of that ESET API user ``` account { op: "connections.requirements", service: "eset_connect" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "eset_connect.policies.list" } # list policies · read · 1 upstream call check { action: "eset_connect.policies.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` ESET Connect at a glance **Sign-in** Session login. actionlake opens the session and renews it when it expires. **You provide** `username` `password` **Limits we pace to** 10 calls a second, per connection **API covered** ESET Connect (ESET PROTECT Cloud and ESET Inspect: devices, detections, incidents, policies, tasks, quarantine, vulnerabilities) API ESET Connect public APIs (16 OpenAPI 3.0.1 documents, fetched 2026-10-23)`eu.device-management.eset.systems` **Built from** ESET Connect's documentation, read 23 October 2026[eu.esetconnect.eset.systems](https://eu.esetconnect.eset.systems/swagger/api/application-management.json) [eu.esetconnect.eset.systems](https://eu.esetconnect.eset.systems/swagger/api/asset-management.json) [eu.esetconnect.eset.systems](https://eu.esetconnect.eset.systems/swagger/api/automation.json) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 60 of 60 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 4, so ask can line ESET Connect up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in ESET Connect. 118 actions in 32 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **60** read look, never change - **44** write create and update - **14** destructive wait for a confirmation 1. ### Devices 10 4 read · 6 write · 0 destructive List managed devices · Get device details · List installed applications · Import device batch 2. ### Incidents 8 4 read · 4 write · 0 destructive List incidents · Get incident · Update incident · Close incident 3. ### Device tasks 7 3 read · 3 write · 1 destructive Create task · List tasks · List task runs · Get task 4. ### Edr rules 7 2 read · 4 write · 1 destructive List EDR rules · Create EDR rule · Get EDR rule · Update EDR rule definition 5. ### Quarantined objects 7 3 read · 2 write · 2 destructive List quarantined objects · Batch restore quarantined objects · Get quarantined object · Batch delete quarantined objects 6. ### Device groups 6 2 read · 3 write · 1 destructive List all device groups · Create group · List devices in device group · Delete group 7. ### Edr rule exclusions 5 2 read · 2 write · 1 destructive Create EDR rule exclusion · List EDR rule exclusions · Get EDR rule exclusion · Update EDR rule exclusion definition 8. ### Incident comments 5 2 read · 2 write · 1 destructive List incident comments · Create incident comment · Get incident comment · Update incident comment text **24 more areas · 63 actions** - Incident comments V2 **5** - Incidents V2 **5** - Policy assignments **5** - Detection groups **4** - Detections **4** - Executables **4** - Installers **4** - Policies **4** - Ip sets **3** - Role assignments **3** - Users **3** - Detections V1 **2** - Indicators **2** - Mobile devices **2** - Patching **2** - Roles **2** - Web address rules **2** - Device OS vulnerabilities **1** - Device patches **1** - Device vulnerabilities **1** - Gpo SCCM files **1** - Permissions **1** - Vulnerability scans **1** - Vulnerable devices **1** Top actions ## The ESET Connect API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 42 of ESET Connect's 45 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `eset_connect.policies.list` List policies | List policies. | read | `security.policy.list` 36 connectors | | `eset_connect.users.list` List users | List users. | read | `identity.user.list` 474 connectors | | `eset_connect.devices.list` List managed devices | List managed devices. | read | `device.endpoint.list` 65 connectors | | `eset_connect.policies.create` Create policy | Create policy. | write | `security.policy.create` 25 connectors | | `eset_connect.incidents.list` List incidents | List incidents. | read | `security.incident.list` 17 connectors | | `eset_connect.users.get` Get user | Get user. | read | `identity.user.get` 399 connectors | | `eset_connect.devices.get` Get device details | Get device details. | read | `device.endpoint.get` 57 connectors | | `eset_connect.policies.delete` Delete policy | Delete policy. | destructive | `security.policy.delete` 21 connectors | | `eset_connect.detections.list` List detections | List detections. | read | `security.alert.list` 22 connectors | | `eset_connect.device_vulnerabilities.list` List device vulnerabilities | List device vulnerabilities. | read | `security.vulnerability.list` 14 connectors | | `eset_connect.incident_comments.create` Create incident comment | Create incident comment. | write | `security.incident_note.create` 8 connectors | | `eset_connect.incidents.update` Update incident | Update incident. | write | `security.incident.update` 13 connectors | Try it ## Prompts to paste into Claude. Each one names the ESET Connect actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which ESET Connect incidents are open, and how long has each been open? calls `eset_connect.incidents.list` 2. Write write Create policy in ESET Connect. Show me exactly what you will send before you save it. calls `eset_connect.policies.create` Governance for ESET Connect ## Destructive actions wait for a yes. 14 ESET Connect actions are destructive. These are all of them: - Delete policy `eset_connect.policies.delete` - Delete incident comment `eset_connect.incident_comments.delete` - Delete EDR rule `eset_connect.edr_rules.delete` - Revoke role `eset_connect.role_assignments.revoke` - Unassign policy `eset_connect.policy_assignments.unassign` - Assign role `eset_connect.role_assignments.assign` - Delete role `eset_connect.roles.delete` - Delete group `eset_connect.device_groups.delete` - Delete installer `eset_connect.installers.delete` - Delete task `eset_connect.device_tasks.delete` - Batch delete quarantined objects `eset_connect.quarantined_objects.batch_delete` - Purge quarantined objects `eset_connect.quarantined_objects.purge` - Delete EDR rule exclusion `eset_connect.edr_rule_exclusions.delete` - Delete incident comment `eset_connect.incident_comments_v2.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do eset_connect.policies.delete confirm_policy: **human** Delete policy? **intent:** the user asked me to delete policy run suspended · waiting for a named person · key _eset-connect-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "eset-connect-agent", allowed_actions: ["eset_connect.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "eset_connect.policies.delete", approver: "lead@example.com" }, { match: "eset_connect.incident_comments.delete", approver: "lead@example.com" }, { match: "eset_connect.edr_rules.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to ESET Connect only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What ESET Connect costs on actionlake. Every ESET Connect action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call ESET Connect refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 118 ESET Connect actions - 118 actions page each page of a long list is one call - 60 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every ESET Connect action. 118 actions by area: the id your agent calls, what it does, and its effect. **Devices 10** - `eset_connect.devices.batch_get` Batch get devices read - `eset_connect.devices.batch_import` Import device batch write - `eset_connect.devices.get` Get device details read - `eset_connect.devices.list` List managed devices read - `eset_connect.devices.list_applications` List installed applications read - `eset_connect.devices.move` Move device write - `eset_connect.devices.rename` Rename device write - `eset_connect.devices.set_master` Set master device write - `eset_connect.devices.unset_master` Unset master device write - `eset_connect.devices.update_description` Update device description write **Incidents 8** - `eset_connect.incidents.close` Close incident write - `eset_connect.incidents.get` Get incident read - `eset_connect.incidents.get_indicator` Get incident indicator read - `eset_connect.incidents.list` List incidents read - `eset_connect.incidents.list_indicators` List incident indicators read - `eset_connect.incidents.reopen` Reopen incident write - `eset_connect.incidents.start_progress` Start progress write - `eset_connect.incidents.update` Update incident write **Device tasks 7** - `eset_connect.device_tasks.create` Create task write - `eset_connect.device_tasks.delete` Delete task destructive - `eset_connect.device_tasks.get` Get task read - `eset_connect.device_tasks.list` List tasks read - `eset_connect.device_tasks.list_runs` List task runs read - `eset_connect.device_tasks.update_targets` Update task targets write - `eset_connect.device_tasks.update_triggers` Update task triggers write **Edr rules 7** - `eset_connect.edr_rules.create` Create EDR rule write - `eset_connect.edr_rules.delete` Delete EDR rule destructive - `eset_connect.edr_rules.disable` Disable EDR rule write - `eset_connect.edr_rules.enable` Enable EDR rule write - `eset_connect.edr_rules.get` Get EDR rule read - `eset_connect.edr_rules.list` List EDR rules read - `eset_connect.edr_rules.update_definition` Update EDR rule definition write **Quarantined objects 7** - `eset_connect.quarantined_objects.batch_delete` Batch delete quarantined objects destructive - `eset_connect.quarantined_objects.batch_restore` Batch restore quarantined objects write - `eset_connect.quarantined_objects.count` Get quarantined objects count read - `eset_connect.quarantined_objects.get` Get quarantined object read - `eset_connect.quarantined_objects.list` List quarantined objects read - `eset_connect.quarantined_objects.purge` Purge quarantined objects destructive - `eset_connect.quarantined_objects.restore` Restore quarantined objects write **Device groups 6** - `eset_connect.device_groups.create` Create group write - `eset_connect.device_groups.delete` Delete group destructive - `eset_connect.device_groups.list` List all device groups read - `eset_connect.device_groups.list_devices` List devices in device group read - `eset_connect.device_groups.move` Move group write - `eset_connect.device_groups.rename` Rename group write **Edr rule exclusions 5** - `eset_connect.edr_rule_exclusions.create` Create EDR rule exclusion write - `eset_connect.edr_rule_exclusions.delete` Delete EDR rule exclusion destructive - `eset_connect.edr_rule_exclusions.get` Get EDR rule exclusion read - `eset_connect.edr_rule_exclusions.list` List EDR rule exclusions read - `eset_connect.edr_rule_exclusions.update_definition` Update EDR rule exclusion definition write **Incident comments 5** - `eset_connect.incident_comments.create` Create incident comment write - `eset_connect.incident_comments.delete` Delete incident comment destructive - `eset_connect.incident_comments.get` Get incident comment read - `eset_connect.incident_comments.list` List incident comments read - `eset_connect.incident_comments.update_text` Update incident comment text write **Incident comments V2 5** - `eset_connect.incident_comments_v2.create` Create incident comment write - `eset_connect.incident_comments_v2.delete` Delete incident comment destructive - `eset_connect.incident_comments_v2.get` Get incident comment read - `eset_connect.incident_comments_v2.list` List incident comments read - `eset_connect.incident_comments_v2.update_text` Update incident comment text write **Incidents V2 5** - `eset_connect.incidents_v2.close` Close incident write - `eset_connect.incidents_v2.get` Get incident read - `eset_connect.incidents_v2.list` List incidents read - `eset_connect.incidents_v2.reopen` Reopen incident write - `eset_connect.incidents_v2.update_basic_attributes` Update incident basic attributes write **Policy assignments 5** - `eset_connect.policy_assignments.assign` Assign policy write - `eset_connect.policy_assignments.get` Get policy assignment read - `eset_connect.policy_assignments.list` List policy assignments read - `eset_connect.policy_assignments.unassign` Unassign policy destructive - `eset_connect.policy_assignments.update_ranking` Update policy assignment ranking write **Detection groups 4** - `eset_connect.detection_groups.get` Get detection group read - `eset_connect.detection_groups.list` List detection groups read - `eset_connect.detection_groups.resolve` Resolve detection group write - `eset_connect.detection_groups.search` Search detection groups read **Detections 4** - `eset_connect.detections.batch_get` Batch get detections read - `eset_connect.detections.get` Get detection read - `eset_connect.detections.list` List detections read - `eset_connect.detections.resolve` Resolve detection write **Executables 4** - `eset_connect.executables.block` Block executable write - `eset_connect.executables.get` Get executable read - `eset_connect.executables.list` List executables read - `eset_connect.executables.unblock` Unblock executable write **Installers 4** - `eset_connect.installers.create` Create installer write - `eset_connect.installers.delete` Delete installer destructive - `eset_connect.installers.get` Get installer read - `eset_connect.installers.list` List installers read **Policies 4** - `eset_connect.policies.create` Create policy write - `eset_connect.policies.delete` Delete policy destructive - `eset_connect.policies.get` Get policy read - `eset_connect.policies.list` List policies read **Ip sets 3** - `eset_connect.ip_sets.get` Get IP set read - `eset_connect.ip_sets.list` List IP sets read - `eset_connect.ip_sets.update` Update IP set write **Role assignments 3** - `eset_connect.role_assignments.assign` Assign role destructive - `eset_connect.role_assignments.list` List roles read - `eset_connect.role_assignments.revoke` Revoke role destructive **Users 3** - `eset_connect.users.batch_get` Batch get users read - `eset_connect.users.get` Get user read - `eset_connect.users.list` List users read **Detections V1 2** - `eset_connect.detections_v1.get` Get detection read - `eset_connect.detections_v1.list` List detections read **Indicators 2** - `eset_connect.indicators.get` Get indicator read - `eset_connect.indicators.list` List indicators read **Mobile devices 2** - `eset_connect.mobile_devices.activate_product` Batch activate product write - `eset_connect.mobile_devices.get_enrollment_links` Batch get enrollment links read **Patching 2** - `eset_connect.patching.list_device_details` List patching details read - `eset_connect.patching.list_recent_application_details` List recent application patching details read **Roles 2** - `eset_connect.roles.create` Create role write - `eset_connect.roles.delete` Delete role destructive **Web address rules 2** - `eset_connect.web_address_rules.list` List all address rules containing given domain read - `eset_connect.web_address_rules.update_domains` Update web address rule domains write **Device OS vulnerabilities 1** - `eset_connect.device_os_vulnerabilities.list` List device operating system vulnerabilities read **Device patches 1** - `eset_connect.device_patches.list` List device patches read **Device vulnerabilities 1** - `eset_connect.device_vulnerabilities.list` List device vulnerabilities read **Gpo SCCM files 1** - `eset_connect.gpo_sccm_files.generate` Generate gpo sccm file write **Permissions 1** - `eset_connect.permissions.list` List permissions read **Vulnerability scans 1** - `eset_connect.vulnerability_scans.list_recent` List recent scan details read **Vulnerable devices 1** - `eset_connect.vulnerable_devices.list` List vulnerable devices read Questions ## The ESET Connect MCP server, answered. **Is there an ESET Connect MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 118 ESET Connect actions across devices, incidents, device tasks and edr rules, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ESET Connect. **What do I need to connect ESET Connect?** ESET API user email: in ESET PROTECT Hub or ESET Business Account create a dedicated user with Integrations (API)… and Password of that ESET API user. The free call account { op: "connections.requirements", service: "eset_connect" } lists exactly what to paste. **Can an AI agent delete or change things in ESET Connect?** Only if its key allows it, and only with an explicit confirmation. 14 ESET Connect actions are destructive, including delete policy, delete incident comment and delete EDR rule. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my ESET Connect API limit?** actionlake paces every call to the limits in the ESET Connect service file: 10 calls a second per connection. Repeated reads are answered from cache (60 ESET Connect actions can be), which never reaches ESET Connect. **What does an ESET Connect action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (118 ESET Connect actions page). Cache hits, searches, dry runs and calls ESET Connect refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which ESET Connect API does it cover?** The ESET Connect (ESET PROTECT Cloud and ESET Inspect: devices, detections, incidents, policies, tasks, quarantine, vulnerabilities) API ESET Connect public APIs (16 OpenAPI 3.0.1 documents, fetched 2026-10-23) at eu.device-management.eset.systems. It is built from ESET Connect's documentation as read on 23 October 2026. 118 actions in 32 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my ESET Connect data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ESET Connect credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like ESET Connect Shares the most action names with - [Sophos Central 18](https://actionlake.com/connectors/sophos-central) - [Bitdefender GravityZone 10](https://actionlake.com/connectors/bitdefender-gravityzone) - [Huntress 10](https://actionlake.com/connectors/huntress) - [SentinelOne Singularity 9](https://actionlake.com/connectors/sentinelone-singularity) - [Imperva Cloud Application Security 9](https://actionlake.com/connectors/imperva-cloud-application-security) - [Microsoft Sentinel 8](https://actionlake.com/connectors/microsoft-sentinel) Joins with, on shared entities - [Datadog 3](https://actionlake.com/connectors/datadog) - [VMware Carbon Black Cloud 3](https://actionlake.com/connectors/vmware-carbon-black-cloud) - [Rapid7 InsightIDR 3](https://actionlake.com/connectors/rapid7-insightidr) - [Palo Alto Networks Cortex XDR 3](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) - [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users) - [Cloudflare 2](https://actionlake.com/connectors/cloudflare) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by ESET Connect; the name is the vendor's own. Counts are from the ESET Connect service file, version 1.0.0. ## Give your agent ESET Connect today. [Connect ESET Connect free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/eset-connect More: https://actionlake.com/llms.txt