Connectors · Identity & security
Expel Workbench MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Expel Workbench and the rest of your systems. It gives your agent 656 Expel Workbench actions (428 reads, 154 writes and 74 that wait for a confirmation) and holds the Expel Workbench credential itself, so the agent never does. It paces Expel Workbench's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "expel_workbench.user_accounts.list", intent: "check which Expel Workbench account is connected"}# List user accounts · read · 1 upstream call- 656actionsin one signed file
- 428readlook, never change
- 154writecreate and update
- 74wait for a yesdestructive, confirmed first
Set up
Connect Expel Workbench in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Expel Workbench.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_keyExpel Workbench API key
account { op: "connections.requirements", service: "expel_workbench" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "expel_workbench.user_accounts.list" }# list user accounts · read · 1 upstream callcheck { action: "expel_workbench.user_accounts.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Expel Workbench at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_key- Limits we pace to
- 300 calls a minute, per connection
- API covered
- Workbench API v2 (Workbench API, OpenAPI 3.0.0, JSON:API)
workbench.expel.io/api/v2 - Built from
- Expel Workbench's documentation, read 23 October 2026workbench.expel.io
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 422 of 428 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line Expel Workbench up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Expel Workbench.
656 actions in 118 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 428readlook, never change
- 154writecreate and update
- 74destructivewait for a confirmation
Dashboards
3535 read · 0 write · 0 destructive
Dashboard: activity metrics · Dashboard: alert analysis / device rollup · Dashboard: alert analysis / device rollup / expel alerts by investigation type alert status · Dashboard: alert analysis / device rollup / expel alerts by severity
Context variables
126 read · 4 write · 2 destructive
Create a context variable · List context variables · List a context variable's notes · Create a context variable with categories and tags
Emerging threats
129 read · 2 write · 1 destructive
Create an emerging threat · List emerging threats · List an emerging threat's related detections · List an emerging threat's related hunting investigations
Expel alerts
107 read · 2 write · 1 destructive
List expel alerts · Get an expel alert · Create an expel alert · Update an expel alert
Files
95 read · 3 write · 1 destructive
Create a file · List files · Get a file · Update a file
Investigations
95 read · 2 write · 2 destructive
List investigations · Create an investigation · Get an investigation · Update an investigation
Phishing submissions
94 read · 4 write · 1 destructive
Bulk create phishing submissions · Create a phishing submission · List phishing submissions · Add phishing submissions to an alert
Assemblers
84 read · 3 write · 1 destructive
Create an assembler · List assemblers · Authorize an assembler · Get an assembler
110 more areas · 552 actions
- Context categories 8
- Context label tags 8
- Emerging threat scans 8
- Investigative actions 8
- Organizations 8
- Remediation actions 8
- Security devices 8
- Actors 7
- Comments 7
- Context label actions 7
- Context labels 7
- Engagement managers 7
- Expel alert thresholds 7
- Hunt leads 7
- Hunt techniques 7
- Indicators of compromise 7
- Investigation findings 7
- Label snapshots 7
- Lookbacks 7
- Nist categories 7
- Nist subcategories 7
- Nist subcategory scores 7
- Notes 7
- Organization resilience action groups 7
- Organization resilience actions 7
- Remediation action assets 7
- Remediation action setting list sources 7
- Remediation action settings 7
- Resilience action groups 7
- Suggestions 7
- Timeline entries 7
- User accounts 7
- Vendor alert evidences 7
- Vendor alerts 7
- Vendors 7
- Activity metrics 6
- Actor brandings 6
- Analyst activity timeline 6
- API keys 6
- Assembler images 6
- Configurations 6
- Context category defaults 6
- Digests 6
- Emerging threat recommendations 6
- Event search logs 6
- Findings 6
- Generated content 6
- Integrations 6
- Investigation resilience actions 6
- Notification rules 6
- Organization contacts 6
- Phishing submission attachments 6
- Phishing submission domains 6
- Phishing submission headers 6
- Phishing submission urls 6
- Remediation action setting pref devices 6
- Resilience actions 6
- Saml identity providers 6
- Secrets 6
- User account roles 6
- Workflow actions 6
- Workflow definitions 6
- Plugins 5
- Rule definitions 5
- Detections 4
- Emerging threat scan results 4
- Expel alert grid group 4
- Expel alert histories 4
- Investigation histories 4
- Ip addresses 4
- Metrics 4
- Relationships 4
- Remediation action setting histories 4
- Security device histories 4
- Comment histories 3
- Context label action histories 3
- Context label histories 3
- Context variable histories 3
- Entitlements 3
- Exempt orgs from sku expiration 3
- Expel alert grid view 3
- Expel alert threshold histories 3
- Health 3
- Investigation finding histories 3
- Investigative action histories 3
- Lookback results 3
- Nist subcategory score histories 3
- Note histories 3
- Organization statuses 3
- Remediation action asset histories 3
- Remediation action histories 3
- Remediation action setting list source histories 3
- Security device counts 3
- Suggestion histories 3
- User account statuses 3
- Workflow executions 3
- Action types 2
- Context label suppressions 2
- Event definitions 2
- Expel detection categories 2
- Investigation resilience action hints 2
- Mitre atlas tactics 2
- Mitre tactics 2
- Skus 2
- Cases 1
- Events 1
- Info 1
- Json schema 1
- Swagger docs 1
- Vendor options 1
Top actions
The Expel Workbench API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 20 of Expel Workbench's 20 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
expel_workbench.user_accounts.listList user accounts | List or query user accounts records. | read | identity.user.list474 connectors |
expel_workbench.user_accounts.createCreate a user account | Create a new user account record. | write | identity.user.create262 connectors |
expel_workbench.user_accounts.deleteDelete a user account | Delete a user account record. | destructive | identity.user.delete253 connectors |
expel_workbench.api_keys.createCreate an api key | Create a new api key record. | write | identity.api_key.create100 connectors |
expel_workbench.api_keys.listList api keys | List or query api keys records. | read | identity.api_key.list96 connectors |
expel_workbench.expel_alerts.listList expel alerts | List or query expel alerts records. | read | security.alert.list22 connectors |
expel_workbench.investigations.listList investigations | List or query investigations records. | read | security.incident.list17 connectors |
expel_workbench.expel_alerts.getGet an expel alert | Retrieve one expel alert record by id. | read | security.alert.get21 connectors |
expel_workbench.investigations.createCreate an investigation | Create a new investigation record. | write | security.incident.create8 connectors |
expel_workbench.organizations.listList organizations | List or query organizations records. | read | this connector |
expel_workbench.skus.listList skus | List or query skus records. | read | this connector |
expel_workbench.cases.listList cases | List cases. | read | this connector |
Try it
Prompts to paste into Claude.
Each one names the Expel Workbench actions it will call, so you know what it reads and what it changes before you send it.
- Readread
List the companies in Expel Workbench and flag likely duplicates by name or domain.
calls
expel_workbench.organizations.list - Writewrite
Create a user account in Expel Workbench. Show me exactly what you will send before you save it.
calls
expel_workbench.user_accounts.create - Across systemsread
Which Expel Workbench companies have invoices in ConnectWise PSA, and how many each?
calls
expel_workbench.organizations.listconnectwise_manage.invoices.list
Across your systems
Expel Workbench, joined to the rest of your business.
One ask fetches from Expel Workbench and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.
Which Expel Workbench companies have invoices in ConnectWise PSA, and how many each?
expel_workbench.organizations.list+connectwise_manage.invoices.list, oncrm.company· ConnectWise PSAWhich Expel Workbench companies have invoices in NetSuite, and how many each?
expel_workbench.organizations.list+netsuite.views.invoices, oncrm.company· NetSuite
identity.user 517crm.company 227ask { intent: "which Expel Workbench companies have invoices in ConnectWise PSA, and how many each", steps: [ { action: "expel_workbench.organizations.list", as: "co", input: {}, limit: 100, max_pages: 5 }, { action: "connectwise_manage.invoices.list", as: "inv", input: {}, limit: 100, max_pages: 5 }, { join: { left: "co", right: "inv", on: "crm.company", group_by: "co.name", select: ["co.name", "count(inv.id) as invoices"] } } ]}Governance for Expel Workbench
Destructive actions wait for a yes.
74 Expel Workbench actions are destructive. The first 10:
- Delete a user account
expel_workbench.user_accounts.delete - Delete an api key
expel_workbench.api_keys.delete - Delete an investigation
expel_workbench.investigations.delete - Delete an expel alert
expel_workbench.expel_alerts.delete - Delete a file
expel_workbench.files.delete - Delete a note
expel_workbench.notes.delete - Delete an actor
expel_workbench.actors.delete - Delete a digest
expel_workbench.digests.delete - Delete a plugin
expel_workbench.plugins.delete - Delete a secret
expel_workbench.secrets.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete a user account?
intent: the user asked me to delete a user account
account { op: "keys.create", name: "expel-workbench-agent", allowed_actions: ["expel_workbench.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "expel_workbench.user_accounts.delete", approver: "[email protected]" }, { match: "expel_workbench.api_keys.delete", approver: "[email protected]" }, { match: "expel_workbench.investigations.delete", approver: "[email protected]" } ]}Cost
What Expel Workbench costs on actionlake.
Every Expel Workbench action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Expel Workbench refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 656 Expel Workbench actions
- 656actions pageeach page of a long list is one call
- 422reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Expel Workbench action.
656 actions by area: the id your agent calls, what it does, and its effect.
Dashboards35
expel_workbench.dashboards.activity_metricsDashboard: activity metricsreadexpel_workbench.dashboards.alert_analysis_device_rollupDashboard: alert analysis / device rollupreadexpel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_investigation_type_alert_statusDashboard: alert analysis / device rollup / expel alerts by investigation type alert statusreadexpel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_severityDashboard: alert analysis / device rollup / expel alerts by severityreadexpel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_signatureDashboard: alert analysis / device rollup / expel alerts by signaturereadexpel_workbench.dashboards.alert_analysis_device_rollup_suppressed_alertsDashboard: alert analysis / device rollup / suppressed alertsread- and 29 more in this area
Context variables12
expel_workbench.context_variables.createCreate a context variablewriteexpel_workbench.context_variables.listList context variablesreadexpel_workbench.context_variables.notesList a context variable's notesreadexpel_workbench.context_variables.uploadCreate a context variable with categories and tagswriteexpel_workbench.context_variables.deleteDelete a context variabledestructiveexpel_workbench.context_variables.delete_with_labelsDelete a context variable and its labelsdestructive- and 6 more in this area
Emerging threats12
expel_workbench.emerging_threats.createCreate an emerging threatwriteexpel_workbench.emerging_threats.listList emerging threatsreadexpel_workbench.emerging_threats.related_detectionsList an emerging threat's related detectionsreadexpel_workbench.emerging_threats.related_hunting_investigationsList an emerging threat's related hunting investigationsreadexpel_workbench.emerging_threats.deleteDelete an emerging threatdestructiveexpel_workbench.emerging_threats.getGet an emerging threatread- and 6 more in this area
Expel alerts10
expel_workbench.expel_alerts.createCreate an expel alertwriteexpel_workbench.expel_alerts.getGet an expel alertreadexpel_workbench.expel_alerts.listList expel alertsreadexpel_workbench.expel_alerts.updateUpdate an expel alertwriteexpel_workbench.expel_alerts.count_by_severityCount alerts by severityreadexpel_workbench.expel_alerts.deleteDelete an expel alertdestructive- and 4 more in this area
Files9
expel_workbench.files.createCreate a filewriteexpel_workbench.files.getGet a filereadexpel_workbench.files.listList filesreadexpel_workbench.files.updateUpdate a filewriteexpel_workbench.files.annotations.getGet a file's annotationsreadexpel_workbench.files.annotations.saveSave a file's annotationswrite- and 3 more in this area
Investigations9
expel_workbench.investigations.createCreate an investigationwriteexpel_workbench.investigations.getGet an investigationreadexpel_workbench.investigations.listList investigationsreadexpel_workbench.investigations.updateUpdate an investigationwriteexpel_workbench.investigations.deleteDelete an investigationdestructiveexpel_workbench.investigations.history_timelineGet an investigation's history timelineread- and 3 more in this area
Phishing submissions9
expel_workbench.phishing_submissions.add_to_expel_alertAdd phishing submissions to an alertwriteexpel_workbench.phishing_submissions.bulk_createBulk create phishing submissionswriteexpel_workbench.phishing_submissions.createCreate a phishing submissionwriteexpel_workbench.phishing_submissions.listList phishing submissionsreadexpel_workbench.phishing_submissions.deleteDelete a phishing submissiondestructiveexpel_workbench.phishing_submissions.getGet a phishing submissionread- and 3 more in this area
Assemblers8
expel_workbench.assemblers.authorizeAuthorize an assemblerwriteexpel_workbench.assemblers.createCreate an assemblerwriteexpel_workbench.assemblers.getGet an assemblerreadexpel_workbench.assemblers.listList assemblersreadexpel_workbench.assemblers.deleteDelete an assemblerdestructiveexpel_workbench.assemblers.related.getGet the record related to an assemblerread- and 2 more in this area
Context categories8
expel_workbench.context_categories.createCreate a context categorywriteexpel_workbench.context_categories.getGet a context categoryreadexpel_workbench.context_categories.infoGet context category display inforeadexpel_workbench.context_categories.listList context categoriesreadexpel_workbench.context_categories.deleteDelete a context categorydestructiveexpel_workbench.context_categories.related.getGet the record related to a context categoryread- and 2 more in this area
Context label tags8
expel_workbench.context_label_tags.createCreate a context label tagwriteexpel_workbench.context_label_tags.getGet a context label tagreadexpel_workbench.context_label_tags.listList context label tagsreadexpel_workbench.context_label_tags.statsGet context label tag statsreadexpel_workbench.context_label_tags.deleteDelete a context label tagdestructiveexpel_workbench.context_label_tags.related.getGet the record related to a context label tagread- and 2 more in this area
Emerging threat scans8
expel_workbench.emerging_threat_scans.createCreate an emerging threat scanwriteexpel_workbench.emerging_threat_scans.getGet an emerging threat scanreadexpel_workbench.emerging_threat_scans.listList emerging threat scansreadexpel_workbench.emerging_threat_scans.searchSearch emerging threat scansreadexpel_workbench.emerging_threat_scans.deleteDelete an emerging threat scandestructiveexpel_workbench.emerging_threat_scans.related.getGet the record related to an emerging threat scanread- and 2 more in this area
Investigative actions8
expel_workbench.investigative_actions.createCreate an investigative actionwriteexpel_workbench.investigative_actions.getGet an investigative actionreadexpel_workbench.investigative_actions.listList investigative actionsreadexpel_workbench.investigative_actions.updateUpdate an investigative actionwriteexpel_workbench.investigative_actions.deleteDelete an investigative actiondestructiveexpel_workbench.investigative_actions.related.getGet the record related to an investigative actionread- and 2 more in this area
Organizations8
expel_workbench.organizations.cloneClone a demo organizationwriteexpel_workbench.organizations.createCreate an organizationwriteexpel_workbench.organizations.getGet an organizationreadexpel_workbench.organizations.listList organizationsreadexpel_workbench.organizations.deleteDelete an organizationdestructiveexpel_workbench.organizations.related.getGet the record related to an organizationread- and 2 more in this area
Remediation actions8
expel_workbench.remediation_actions.createCreate a remediation actionwriteexpel_workbench.remediation_actions.create_with_assetsCreate a remediation action with assetswriteexpel_workbench.remediation_actions.getGet a remediation actionreadexpel_workbench.remediation_actions.listList remediation actionsreadexpel_workbench.remediation_actions.deleteDelete a remediation actiondestructiveexpel_workbench.remediation_actions.related.getGet the record related to a remediation actionread- and 2 more in this area
Security devices8
expel_workbench.security_devices.createCreate a security devicewriteexpel_workbench.security_devices.getGet a security devicereadexpel_workbench.security_devices.listList security devicesreadexpel_workbench.security_devices.polling_detailsGet a security device's polling detailsreadexpel_workbench.security_devices.deleteDelete a security devicedestructiveexpel_workbench.security_devices.related.getGet the record related to a security deviceread- and 2 more in this area
Actors7
expel_workbench.actors.createCreate an actorwriteexpel_workbench.actors.getGet an actorreadexpel_workbench.actors.listList actorsreadexpel_workbench.actors.updateUpdate an actorwriteexpel_workbench.actors.deleteDelete an actordestructiveexpel_workbench.actors.related.getGet the record related to an actorread- and 1 more in this area
Comments7
expel_workbench.comments.createCreate a commentwriteexpel_workbench.comments.getGet a commentreadexpel_workbench.comments.listList commentsreadexpel_workbench.comments.updateUpdate a commentwriteexpel_workbench.comments.deleteDelete a commentdestructiveexpel_workbench.comments.related.getGet the record related to a commentread- and 1 more in this area
Context label actions7
expel_workbench.context_label_actions.createCreate a context label actionwriteexpel_workbench.context_label_actions.getGet a context label actionreadexpel_workbench.context_label_actions.listList context label actionsreadexpel_workbench.context_label_actions.updateUpdate a context label actionwriteexpel_workbench.context_label_actions.deleteDelete a context label actiondestructiveexpel_workbench.context_label_actions.related.getGet the record related to a context label actionread- and 1 more in this area
Context labels7
expel_workbench.context_labels.createCreate a context labelwriteexpel_workbench.context_labels.getGet a context labelreadexpel_workbench.context_labels.listList context labelsreadexpel_workbench.context_labels.updateUpdate a context labelwriteexpel_workbench.context_labels.deleteDelete a context labeldestructiveexpel_workbench.context_labels.related.getGet the record related to a context labelread- and 1 more in this area
Engagement managers7
expel_workbench.engagement_managers.createCreate an engagement managerwriteexpel_workbench.engagement_managers.getGet an engagement managerreadexpel_workbench.engagement_managers.listList engagement managersreadexpel_workbench.engagement_managers.updateUpdate an engagement managerwriteexpel_workbench.engagement_managers.deleteDelete an engagement managerdestructiveexpel_workbench.engagement_managers.related.getGet the record related to an engagement managerread- and 1 more in this area
Expel alert thresholds7
expel_workbench.expel_alert_thresholds.createCreate an expel alert thresholdwriteexpel_workbench.expel_alert_thresholds.getGet an expel alert thresholdreadexpel_workbench.expel_alert_thresholds.listList expel alert thresholdsreadexpel_workbench.expel_alert_thresholds.updateUpdate an expel alert thresholdwriteexpel_workbench.expel_alert_thresholds.deleteDelete an expel alert thresholddestructiveexpel_workbench.expel_alert_thresholds.related.getGet the record related to an expel alert thresholdread- and 1 more in this area
Hunt leads7
expel_workbench.hunt_leads.createCreate a hunt leadwriteexpel_workbench.hunt_leads.getGet a hunt leadreadexpel_workbench.hunt_leads.listList hunt leadsreadexpel_workbench.hunt_leads.updateUpdate a hunt leadwriteexpel_workbench.hunt_leads.deleteDelete a hunt leaddestructiveexpel_workbench.hunt_leads.related.getGet the record related to a hunt leadread- and 1 more in this area
Hunt techniques7
expel_workbench.hunt_techniques.createCreate a hunt techniquewriteexpel_workbench.hunt_techniques.getGet a hunt techniquereadexpel_workbench.hunt_techniques.listList hunt techniquesreadexpel_workbench.hunt_techniques.updateUpdate a hunt techniquewriteexpel_workbench.hunt_techniques.deleteDelete a hunt techniquedestructiveexpel_workbench.hunt_techniques.related.getGet the record related to a hunt techniqueread- and 1 more in this area
Indicators of compromise7
expel_workbench.indicators_of_compromise.createCreate an indicator of compromisewriteexpel_workbench.indicators_of_compromise.getGet an indicator of compromisereadexpel_workbench.indicators_of_compromise.listList indicators of compromisereadexpel_workbench.indicators_of_compromise.updateUpdate an indicator of compromisewriteexpel_workbench.indicators_of_compromise.deleteDelete an indicator of compromisedestructiveexpel_workbench.indicators_of_compromise.related.getGet the record related to an indicator of compromiseread- and 1 more in this area
Investigation findings7
expel_workbench.investigation_findings.createCreate an investigation findingwriteexpel_workbench.investigation_findings.getGet an investigation findingreadexpel_workbench.investigation_findings.listList investigation findingsreadexpel_workbench.investigation_findings.updateUpdate an investigation findingwriteexpel_workbench.investigation_findings.deleteDelete an investigation findingdestructiveexpel_workbench.investigation_findings.related.getGet the record related to an investigation findingread- and 1 more in this area
Label snapshots7
expel_workbench.label_snapshots.createCreate a label snapshotwriteexpel_workbench.label_snapshots.getGet a label snapshotreadexpel_workbench.label_snapshots.listList label snapshotsreadexpel_workbench.label_snapshots.updateUpdate a label snapshotwriteexpel_workbench.label_snapshots.deleteDelete a label snapshotdestructiveexpel_workbench.label_snapshots.related.getGet the record related to a label snapshotread- and 1 more in this area
Lookbacks7
expel_workbench.lookbacks.createCreate a lookbackwriteexpel_workbench.lookbacks.getGet a lookbackreadexpel_workbench.lookbacks.listList lookbacksreadexpel_workbench.lookbacks.updateUpdate a lookbackwriteexpel_workbench.lookbacks.deleteDelete a lookbackdestructiveexpel_workbench.lookbacks.related.getGet the record related to a lookbackread- and 1 more in this area
Nist categories7
expel_workbench.nist_categories.createCreate a nist categorywriteexpel_workbench.nist_categories.getGet a nist categoryreadexpel_workbench.nist_categories.listList nist categoriesreadexpel_workbench.nist_categories.updateUpdate a nist categorywriteexpel_workbench.nist_categories.deleteDelete a nist categorydestructiveexpel_workbench.nist_categories.related.getGet the record related to a nist categoryread- and 1 more in this area
Nist subcategories7
expel_workbench.nist_subcategories.createCreate a nist subcategorywriteexpel_workbench.nist_subcategories.getGet a nist subcategoryreadexpel_workbench.nist_subcategories.listList nist subcategoriesreadexpel_workbench.nist_subcategories.updateUpdate a nist subcategorywriteexpel_workbench.nist_subcategories.deleteDelete a nist subcategorydestructiveexpel_workbench.nist_subcategories.related.getGet the record related to a nist subcategoryread- and 1 more in this area
Nist subcategory scores7
expel_workbench.nist_subcategory_scores.createCreate a nist subcategory scorewriteexpel_workbench.nist_subcategory_scores.getGet a nist subcategory scorereadexpel_workbench.nist_subcategory_scores.listList nist subcategory scoresreadexpel_workbench.nist_subcategory_scores.updateUpdate a nist subcategory scorewriteexpel_workbench.nist_subcategory_scores.deleteDelete a nist subcategory scoredestructiveexpel_workbench.nist_subcategory_scores.related.getGet the record related to a nist subcategory scoreread- and 1 more in this area
Notes 7Organization resilience action groups 7Organization resilience actions 7Remediation action assets 7Remediation action setting list sources 7Remediation action settings 7Resilience action groups 7Suggestions 7Timeline entries 7User accounts 7Vendor alert evidences 7Vendor alerts 7Vendors 7Activity metrics 6Actor brandings 6Analyst activity timeline 6API keys 6Assembler images 6Configurations 6Context category defaults 6Digests 6Emerging threat recommendations 6Event search logs 6Findings 6Generated content 6Integrations 6Investigation resilience actions 6Notification rules 6Organization contacts 6Phishing submission attachments 6Phishing submission domains 6Phishing submission headers 6Phishing submission urls 6Remediation action setting pref devices 6Resilience actions 6Saml identity providers 6Secrets 6User account roles 6Workflow actions 6Workflow definitions 6Plugins 5Rule definitions 5Detections 4Emerging threat scan results 4Expel alert grid group 4Expel alert histories 4Investigation histories 4Ip addresses 4Metrics 4Relationships 4Remediation action setting histories 4Security device histories 4Comment histories 3Context label action histories 3Context label histories 3Context variable histories 3Entitlements 3Exempt orgs from sku expiration 3Expel alert grid view 3Expel alert threshold histories 3Health 3Investigation finding histories 3Investigative action histories 3Lookback results 3Nist subcategory score histories 3Note histories 3Organization statuses 3Remediation action asset histories 3Remediation action histories 3Remediation action setting list source histories 3Security device counts 3Suggestion histories 3User account statuses 3Workflow executions 3Action types 2Context label suppressions 2Event definitions 2Expel detection categories 2Investigation resilience action hints 2Mitre atlas tactics 2Mitre tactics 2Skus 2Cases 1Events 1Info 1Json schema 1Swagger docs 1Vendor options 1
This index shows a sample of each area. All 656 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Expel Workbench MCP server, answered.
Is there an Expel Workbench MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 656 Expel Workbench actions across dashboards, context variables, emerging threats and expel alerts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Expel Workbench.
What do I need to connect Expel Workbench?
Expel Workbench API key. The free call account { op: "connections.requirements", service: "expel_workbench" } lists exactly what to paste.
Can an AI agent delete or change things in Expel Workbench?
Only if its key allows it, and only with an explicit confirmation. 74 Expel Workbench actions are destructive, including delete a user account, delete an api key and delete an investigation. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Expel Workbench API limit?
actionlake paces every call to the limits in the Expel Workbench service file: 300 calls a minute per connection. Repeated reads are answered from cache (422 Expel Workbench actions can be), which never reaches Expel Workbench.
What does an Expel Workbench action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (656 Expel Workbench actions page). Cache hits, searches, dry runs and calls Expel Workbench refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Expel Workbench API does it cover?
The Workbench API v2 (Workbench API, OpenAPI 3.0.0, JSON:API) at workbench.expel.io/api/v2. It is built from Expel Workbench's documentation as read on 23 October 2026. 656 actions in 118 areas, each one in the signed service file (version 1.0.0).
Can I combine Expel Workbench with my other systems?
Yes. ask joins Expel Workbench to ConnectWise PSA or NetSuite on the same customer and returns the answer rather than every row. Expel Workbench maps crm.company, which 227 other connectors also map.
Does actionlake keep my Expel Workbench data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Expel Workbench credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Expel Workbench today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
