---
title: "Expel Workbench MCP server for AI agents - actionlake"
description: "Give Claude 656 Expel Workbench actions through one MCP server: dashboards. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/expel-workbench
updated: 2026-10-23
---

Connectors · Identity & security

# Expel Workbench MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Expel Workbench and the rest of your systems. It gives your agent 656 Expel Workbench actions (428 reads, 154 writes and 74 that wait for a confirmation) and holds the Expel Workbench credential itself, so the agent never does. It paces Expel Workbench's limits and records every call.

[Connect Expel Workbench free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "expel_workbench.user_accounts.list",
  intent: "check which Expel Workbench account is connected"
}
# List user accounts · read · 1 upstream call
```

- 656 actions in one signed file
- 428 read look, never change
- 154 write create and update
- 74 wait for a yes destructive, confirmed first

Set up

## Connect Expel Workbench in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Expel Workbench.
   Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `api_key` Expel Workbench API key
   ```
   account { op: "connections.requirements", service: "expel_workbench" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "expel_workbench.user_accounts.list" }
   # list user accounts · read · 1 upstream call
   check { action: "expel_workbench.user_accounts.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Expel Workbench at a glance

**Sign-in**

Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`api_key`

**Limits we pace to**

300 calls a minute, per connection

**API covered**

Workbench API v2 (Workbench API, OpenAPI 3.0.0, JSON:API)`workbench.expel.io/api/v2`

**Built from**

Expel Workbench's documentation, read 23 October 2026[workbench.expel.io](https://workbench.expel.io/api/v2/docs/)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

422 of 428 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

2, so ask can line Expel Workbench up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Expel Workbench.

656 actions in 118 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **428** read look, never change
- **154** write create and update
- **74** destructive wait for a confirmation

1. ### Dashboards
   35
   35 read · 0 write · 0 destructive
   Dashboard: activity metrics · Dashboard: alert analysis / device rollup · Dashboard: alert analysis / device rollup / expel alerts by investigation type alert status · Dashboard: alert analysis / device rollup / expel alerts by severity
2. ### Context variables
   12
   6 read · 4 write · 2 destructive
   Create a context variable · List context variables · List a context variable's notes · Create a context variable with categories and tags
3. ### Emerging threats
   12
   9 read · 2 write · 1 destructive
   Create an emerging threat · List emerging threats · List an emerging threat's related detections · List an emerging threat's related hunting investigations
4. ### Expel alerts
   10
   7 read · 2 write · 1 destructive
   List expel alerts · Get an expel alert · Create an expel alert · Update an expel alert
5. ### Files
   9
   5 read · 3 write · 1 destructive
   Create a file · List files · Get a file · Update a file
6. ### Investigations
   9
   5 read · 2 write · 2 destructive
   List investigations · Create an investigation · Get an investigation · Update an investigation
7. ### Phishing submissions
   9
   4 read · 4 write · 1 destructive
   Bulk create phishing submissions · Create a phishing submission · List phishing submissions · Add phishing submissions to an alert
8. ### Assemblers
   8
   4 read · 3 write · 1 destructive
   Create an assembler · List assemblers · Authorize an assembler · Get an assembler

**110 more areas · 552 actions**

- Context categories **8**
- Context label tags **8**
- Emerging threat scans **8**
- Investigative actions **8**
- Organizations **8**
- Remediation actions **8**
- Security devices **8**
- Actors **7**
- Comments **7**
- Context label actions **7**
- Context labels **7**
- Engagement managers **7**
- Expel alert thresholds **7**
- Hunt leads **7**
- Hunt techniques **7**
- Indicators of compromise **7**
- Investigation findings **7**
- Label snapshots **7**
- Lookbacks **7**
- Nist categories **7**
- Nist subcategories **7**
- Nist subcategory scores **7**
- Notes **7**
- Organization resilience action groups **7**
- Organization resilience actions **7**
- Remediation action assets **7**
- Remediation action setting list sources **7**
- Remediation action settings **7**
- Resilience action groups **7**
- Suggestions **7**
- Timeline entries **7**
- User accounts **7**
- Vendor alert evidences **7**
- Vendor alerts **7**
- Vendors **7**
- Activity metrics **6**
- Actor brandings **6**
- Analyst activity timeline **6**
- API keys **6**
- Assembler images **6**
- Configurations **6**
- Context category defaults **6**
- Digests **6**
- Emerging threat recommendations **6**
- Event search logs **6**
- Findings **6**
- Generated content **6**
- Integrations **6**
- Investigation resilience actions **6**
- Notification rules **6**
- Organization contacts **6**
- Phishing submission attachments **6**
- Phishing submission domains **6**
- Phishing submission headers **6**
- Phishing submission urls **6**
- Remediation action setting pref devices **6**
- Resilience actions **6**
- Saml identity providers **6**
- Secrets **6**
- User account roles **6**
- Workflow actions **6**
- Workflow definitions **6**
- Plugins **5**
- Rule definitions **5**
- Detections **4**
- Emerging threat scan results **4**
- Expel alert grid group **4**
- Expel alert histories **4**
- Investigation histories **4**
- Ip addresses **4**
- Metrics **4**
- Relationships **4**
- Remediation action setting histories **4**
- Security device histories **4**
- Comment histories **3**
- Context label action histories **3**
- Context label histories **3**
- Context variable histories **3**
- Entitlements **3**
- Exempt orgs from sku expiration **3**
- Expel alert grid view **3**
- Expel alert threshold histories **3**
- Health **3**
- Investigation finding histories **3**
- Investigative action histories **3**
- Lookback results **3**
- Nist subcategory score histories **3**
- Note histories **3**
- Organization statuses **3**
- Remediation action asset histories **3**
- Remediation action histories **3**
- Remediation action setting list source histories **3**
- Security device counts **3**
- Suggestion histories **3**
- User account statuses **3**
- Workflow executions **3**
- Action types **2**
- Context label suppressions **2**
- Event definitions **2**
- Expel detection categories **2**
- Investigation resilience action hints **2**
- Mitre atlas tactics **2**
- Mitre tactics **2**
- Skus **2**
- Cases **1**
- Events **1**
- Info **1**
- Json schema **1**
- Swagger docs **1**
- Vendor options **1**

Top actions

## The Expel Workbench API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 20 of Expel Workbench's 20 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `expel_workbench.user_accounts.list` List user accounts | List or query user accounts records. | read | `identity.user.list` 474 connectors |
| `expel_workbench.user_accounts.create` Create a user account | Create a new user account record. | write | `identity.user.create` 262 connectors |
| `expel_workbench.user_accounts.delete` Delete a user account | Delete a user account record. | destructive | `identity.user.delete` 253 connectors |
| `expel_workbench.api_keys.create` Create an api key | Create a new api key record. | write | `identity.api_key.create` 100 connectors |
| `expel_workbench.api_keys.list` List api keys | List or query api keys records. | read | `identity.api_key.list` 96 connectors |
| `expel_workbench.expel_alerts.list` List expel alerts | List or query expel alerts records. | read | `security.alert.list` 22 connectors |
| `expel_workbench.investigations.list` List investigations | List or query investigations records. | read | `security.incident.list` 17 connectors |
| `expel_workbench.expel_alerts.get` Get an expel alert | Retrieve one expel alert record by id. | read | `security.alert.get` 21 connectors |
| `expel_workbench.investigations.create` Create an investigation | Create a new investigation record. | write | `security.incident.create` 8 connectors |
| `expel_workbench.organizations.list` List organizations | List or query organizations records. | read | this connector |
| `expel_workbench.skus.list` List skus | List or query skus records. | read | this connector |
| `expel_workbench.cases.list` List cases | List cases. | read | this connector |

Try it

## Prompts to paste into Claude.

Each one names the Expel Workbench actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   List the companies in Expel Workbench and flag likely duplicates by name or domain.
   calls `expel_workbench.organizations.list`
2. Write write
   Create a user account in Expel Workbench. Show me exactly what you will send before you save it.
   calls `expel_workbench.user_accounts.create`
3. Across systems read
   Which Expel Workbench companies have invoices in ConnectWise PSA, and how many each?
   calls `expel_workbench.organizations.list` `connectwise_manage.invoices.list`

Across your systems

## Expel Workbench, joined to the rest of your business.

One `ask` fetches from Expel Workbench and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

- Which Expel Workbench companies have invoices in ConnectWise PSA, and how many each?
  `expel_workbench.organizations.list` + `connectwise_manage.invoices.list`, on `crm.company` · [ConnectWise PSA](https://actionlake.com/connectors/connectwise-psa)
- Which Expel Workbench companies have invoices in NetSuite, and how many each?
  `expel_workbench.organizations.list` + `netsuite.views.invoices`, on `crm.company` · [NetSuite](https://actionlake.com/connectors/netsuite)

Also mapped by other connectors `identity.user` **517** `crm.company` **227**

ask

```
ask {
  intent: "which Expel Workbench companies have invoices in ConnectWise PSA, and how many each",
  steps: [
    { action: "expel_workbench.organizations.list", as: "co", input: {}, limit: 100, max_pages: 5 },
    { action: "connectwise_manage.invoices.list", as: "inv", input: {}, limit: 100, max_pages: 5 },
    { join: {
        left: "co",
        right: "inv",
        on: "crm.company",
        group_by: "co.name",
        select: ["co.name", "count(inv.id) as invoices"]
    } }
  ]
}
```

Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for Expel Workbench

## Destructive actions wait for a yes.

74 Expel Workbench actions are destructive. The first 10:

- Delete a user account `expel_workbench.user_accounts.delete`
- Delete an api key `expel_workbench.api_keys.delete`
- Delete an investigation `expel_workbench.investigations.delete`
- Delete an expel alert `expel_workbench.expel_alerts.delete`
- Delete a file `expel_workbench.files.delete`
- Delete a note `expel_workbench.notes.delete`
- Delete an actor `expel_workbench.actors.delete`
- Delete a digest `expel_workbench.digests.delete`
- Delete a plugin `expel_workbench.plugins.delete`
- Delete a secret `expel_workbench.secrets.delete`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do expel_workbench.user_accounts.delete confirm_policy: **human**

Delete a user account?

**intent:** the user asked me to delete a user account

run suspended · waiting for a named person · key _expel-workbench-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "expel-workbench-agent",
  allowed_actions: ["expel_workbench.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "expel_workbench.user_accounts.delete", approver: "lead@example.com" },
    { match: "expel_workbench.api_keys.delete", approver: "lead@example.com" },
    { match: "expel_workbench.investigations.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Expel Workbench only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Expel Workbench costs on actionlake.

Every Expel Workbench action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Expel Workbench refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 656 Expel Workbench actions
- 656 actions page each page of a long list is one call
- 422 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Expel Workbench action.

656 actions by area: the id your agent calls, what it does, and its effect.

**Dashboards 35**

- `expel_workbench.dashboards.activity_metrics` Dashboard: activity metrics read
- `expel_workbench.dashboards.alert_analysis_device_rollup` Dashboard: alert analysis / device rollup read
- `expel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_investigation_type_alert_status` Dashboard: alert analysis / device rollup / expel alerts by investigation type alert status read
- `expel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_severity` Dashboard: alert analysis / device rollup / expel alerts by severity read
- `expel_workbench.dashboards.alert_analysis_device_rollup_expel_alerts_by_signature` Dashboard: alert analysis / device rollup / expel alerts by signature read
- `expel_workbench.dashboards.alert_analysis_device_rollup_suppressed_alerts` Dashboard: alert analysis / device rollup / suppressed alerts read
- and 29 more in this area

**Context variables 12**

- `expel_workbench.context_variables.create` Create a context variable write
- `expel_workbench.context_variables.list` List context variables read
- `expel_workbench.context_variables.notes` List a context variable's notes read
- `expel_workbench.context_variables.upload` Create a context variable with categories and tags write
- `expel_workbench.context_variables.delete` Delete a context variable destructive
- `expel_workbench.context_variables.delete_with_labels` Delete a context variable and its labels destructive
- and 6 more in this area

**Emerging threats 12**

- `expel_workbench.emerging_threats.create` Create an emerging threat write
- `expel_workbench.emerging_threats.list` List emerging threats read
- `expel_workbench.emerging_threats.related_detections` List an emerging threat's related detections read
- `expel_workbench.emerging_threats.related_hunting_investigations` List an emerging threat's related hunting investigations read
- `expel_workbench.emerging_threats.delete` Delete an emerging threat destructive
- `expel_workbench.emerging_threats.get` Get an emerging threat read
- and 6 more in this area

**Expel alerts 10**

- `expel_workbench.expel_alerts.create` Create an expel alert write
- `expel_workbench.expel_alerts.get` Get an expel alert read
- `expel_workbench.expel_alerts.list` List expel alerts read
- `expel_workbench.expel_alerts.update` Update an expel alert write
- `expel_workbench.expel_alerts.count_by_severity` Count alerts by severity read
- `expel_workbench.expel_alerts.delete` Delete an expel alert destructive
- and 4 more in this area

**Files 9**

- `expel_workbench.files.create` Create a file write
- `expel_workbench.files.get` Get a file read
- `expel_workbench.files.list` List files read
- `expel_workbench.files.update` Update a file write
- `expel_workbench.files.annotations.get` Get a file's annotations read
- `expel_workbench.files.annotations.save` Save a file's annotations write
- and 3 more in this area

**Investigations 9**

- `expel_workbench.investigations.create` Create an investigation write
- `expel_workbench.investigations.get` Get an investigation read
- `expel_workbench.investigations.list` List investigations read
- `expel_workbench.investigations.update` Update an investigation write
- `expel_workbench.investigations.delete` Delete an investigation destructive
- `expel_workbench.investigations.history_timeline` Get an investigation's history timeline read
- and 3 more in this area

**Phishing submissions 9**

- `expel_workbench.phishing_submissions.add_to_expel_alert` Add phishing submissions to an alert write
- `expel_workbench.phishing_submissions.bulk_create` Bulk create phishing submissions write
- `expel_workbench.phishing_submissions.create` Create a phishing submission write
- `expel_workbench.phishing_submissions.list` List phishing submissions read
- `expel_workbench.phishing_submissions.delete` Delete a phishing submission destructive
- `expel_workbench.phishing_submissions.get` Get a phishing submission read
- and 3 more in this area

**Assemblers 8**

- `expel_workbench.assemblers.authorize` Authorize an assembler write
- `expel_workbench.assemblers.create` Create an assembler write
- `expel_workbench.assemblers.get` Get an assembler read
- `expel_workbench.assemblers.list` List assemblers read
- `expel_workbench.assemblers.delete` Delete an assembler destructive
- `expel_workbench.assemblers.related.get` Get the record related to an assembler read
- and 2 more in this area

**Context categories 8**

- `expel_workbench.context_categories.create` Create a context category write
- `expel_workbench.context_categories.get` Get a context category read
- `expel_workbench.context_categories.info` Get context category display info read
- `expel_workbench.context_categories.list` List context categories read
- `expel_workbench.context_categories.delete` Delete a context category destructive
- `expel_workbench.context_categories.related.get` Get the record related to a context category read
- and 2 more in this area

**Context label tags 8**

- `expel_workbench.context_label_tags.create` Create a context label tag write
- `expel_workbench.context_label_tags.get` Get a context label tag read
- `expel_workbench.context_label_tags.list` List context label tags read
- `expel_workbench.context_label_tags.stats` Get context label tag stats read
- `expel_workbench.context_label_tags.delete` Delete a context label tag destructive
- `expel_workbench.context_label_tags.related.get` Get the record related to a context label tag read
- and 2 more in this area

**Emerging threat scans 8**

- `expel_workbench.emerging_threat_scans.create` Create an emerging threat scan write
- `expel_workbench.emerging_threat_scans.get` Get an emerging threat scan read
- `expel_workbench.emerging_threat_scans.list` List emerging threat scans read
- `expel_workbench.emerging_threat_scans.search` Search emerging threat scans read
- `expel_workbench.emerging_threat_scans.delete` Delete an emerging threat scan destructive
- `expel_workbench.emerging_threat_scans.related.get` Get the record related to an emerging threat scan read
- and 2 more in this area

**Investigative actions 8**

- `expel_workbench.investigative_actions.create` Create an investigative action write
- `expel_workbench.investigative_actions.get` Get an investigative action read
- `expel_workbench.investigative_actions.list` List investigative actions read
- `expel_workbench.investigative_actions.update` Update an investigative action write
- `expel_workbench.investigative_actions.delete` Delete an investigative action destructive
- `expel_workbench.investigative_actions.related.get` Get the record related to an investigative action read
- and 2 more in this area

**Organizations 8**

- `expel_workbench.organizations.clone` Clone a demo organization write
- `expel_workbench.organizations.create` Create an organization write
- `expel_workbench.organizations.get` Get an organization read
- `expel_workbench.organizations.list` List organizations read
- `expel_workbench.organizations.delete` Delete an organization destructive
- `expel_workbench.organizations.related.get` Get the record related to an organization read
- and 2 more in this area

**Remediation actions 8**

- `expel_workbench.remediation_actions.create` Create a remediation action write
- `expel_workbench.remediation_actions.create_with_assets` Create a remediation action with assets write
- `expel_workbench.remediation_actions.get` Get a remediation action read
- `expel_workbench.remediation_actions.list` List remediation actions read
- `expel_workbench.remediation_actions.delete` Delete a remediation action destructive
- `expel_workbench.remediation_actions.related.get` Get the record related to a remediation action read
- and 2 more in this area

**Security devices 8**

- `expel_workbench.security_devices.create` Create a security device write
- `expel_workbench.security_devices.get` Get a security device read
- `expel_workbench.security_devices.list` List security devices read
- `expel_workbench.security_devices.polling_details` Get a security device's polling details read
- `expel_workbench.security_devices.delete` Delete a security device destructive
- `expel_workbench.security_devices.related.get` Get the record related to a security device read
- and 2 more in this area

**Actors 7**

- `expel_workbench.actors.create` Create an actor write
- `expel_workbench.actors.get` Get an actor read
- `expel_workbench.actors.list` List actors read
- `expel_workbench.actors.update` Update an actor write
- `expel_workbench.actors.delete` Delete an actor destructive
- `expel_workbench.actors.related.get` Get the record related to an actor read
- and 1 more in this area

**Comments 7**

- `expel_workbench.comments.create` Create a comment write
- `expel_workbench.comments.get` Get a comment read
- `expel_workbench.comments.list` List comments read
- `expel_workbench.comments.update` Update a comment write
- `expel_workbench.comments.delete` Delete a comment destructive
- `expel_workbench.comments.related.get` Get the record related to a comment read
- and 1 more in this area

**Context label actions 7**

- `expel_workbench.context_label_actions.create` Create a context label action write
- `expel_workbench.context_label_actions.get` Get a context label action read
- `expel_workbench.context_label_actions.list` List context label actions read
- `expel_workbench.context_label_actions.update` Update a context label action write
- `expel_workbench.context_label_actions.delete` Delete a context label action destructive
- `expel_workbench.context_label_actions.related.get` Get the record related to a context label action read
- and 1 more in this area

**Context labels 7**

- `expel_workbench.context_labels.create` Create a context label write
- `expel_workbench.context_labels.get` Get a context label read
- `expel_workbench.context_labels.list` List context labels read
- `expel_workbench.context_labels.update` Update a context label write
- `expel_workbench.context_labels.delete` Delete a context label destructive
- `expel_workbench.context_labels.related.get` Get the record related to a context label read
- and 1 more in this area

**Engagement managers 7**

- `expel_workbench.engagement_managers.create` Create an engagement manager write
- `expel_workbench.engagement_managers.get` Get an engagement manager read
- `expel_workbench.engagement_managers.list` List engagement managers read
- `expel_workbench.engagement_managers.update` Update an engagement manager write
- `expel_workbench.engagement_managers.delete` Delete an engagement manager destructive
- `expel_workbench.engagement_managers.related.get` Get the record related to an engagement manager read
- and 1 more in this area

**Expel alert thresholds 7**

- `expel_workbench.expel_alert_thresholds.create` Create an expel alert threshold write
- `expel_workbench.expel_alert_thresholds.get` Get an expel alert threshold read
- `expel_workbench.expel_alert_thresholds.list` List expel alert thresholds read
- `expel_workbench.expel_alert_thresholds.update` Update an expel alert threshold write
- `expel_workbench.expel_alert_thresholds.delete` Delete an expel alert threshold destructive
- `expel_workbench.expel_alert_thresholds.related.get` Get the record related to an expel alert threshold read
- and 1 more in this area

**Hunt leads 7**

- `expel_workbench.hunt_leads.create` Create a hunt lead write
- `expel_workbench.hunt_leads.get` Get a hunt lead read
- `expel_workbench.hunt_leads.list` List hunt leads read
- `expel_workbench.hunt_leads.update` Update a hunt lead write
- `expel_workbench.hunt_leads.delete` Delete a hunt lead destructive
- `expel_workbench.hunt_leads.related.get` Get the record related to a hunt lead read
- and 1 more in this area

**Hunt techniques 7**

- `expel_workbench.hunt_techniques.create` Create a hunt technique write
- `expel_workbench.hunt_techniques.get` Get a hunt technique read
- `expel_workbench.hunt_techniques.list` List hunt techniques read
- `expel_workbench.hunt_techniques.update` Update a hunt technique write
- `expel_workbench.hunt_techniques.delete` Delete a hunt technique destructive
- `expel_workbench.hunt_techniques.related.get` Get the record related to a hunt technique read
- and 1 more in this area

**Indicators of compromise 7**

- `expel_workbench.indicators_of_compromise.create` Create an indicator of compromise write
- `expel_workbench.indicators_of_compromise.get` Get an indicator of compromise read
- `expel_workbench.indicators_of_compromise.list` List indicators of compromise read
- `expel_workbench.indicators_of_compromise.update` Update an indicator of compromise write
- `expel_workbench.indicators_of_compromise.delete` Delete an indicator of compromise destructive
- `expel_workbench.indicators_of_compromise.related.get` Get the record related to an indicator of compromise read
- and 1 more in this area

**Investigation findings 7**

- `expel_workbench.investigation_findings.create` Create an investigation finding write
- `expel_workbench.investigation_findings.get` Get an investigation finding read
- `expel_workbench.investigation_findings.list` List investigation findings read
- `expel_workbench.investigation_findings.update` Update an investigation finding write
- `expel_workbench.investigation_findings.delete` Delete an investigation finding destructive
- `expel_workbench.investigation_findings.related.get` Get the record related to an investigation finding read
- and 1 more in this area

**Label snapshots 7**

- `expel_workbench.label_snapshots.create` Create a label snapshot write
- `expel_workbench.label_snapshots.get` Get a label snapshot read
- `expel_workbench.label_snapshots.list` List label snapshots read
- `expel_workbench.label_snapshots.update` Update a label snapshot write
- `expel_workbench.label_snapshots.delete` Delete a label snapshot destructive
- `expel_workbench.label_snapshots.related.get` Get the record related to a label snapshot read
- and 1 more in this area

**Lookbacks 7**

- `expel_workbench.lookbacks.create` Create a lookback write
- `expel_workbench.lookbacks.get` Get a lookback read
- `expel_workbench.lookbacks.list` List lookbacks read
- `expel_workbench.lookbacks.update` Update a lookback write
- `expel_workbench.lookbacks.delete` Delete a lookback destructive
- `expel_workbench.lookbacks.related.get` Get the record related to a lookback read
- and 1 more in this area

**Nist categories 7**

- `expel_workbench.nist_categories.create` Create a nist category write
- `expel_workbench.nist_categories.get` Get a nist category read
- `expel_workbench.nist_categories.list` List nist categories read
- `expel_workbench.nist_categories.update` Update a nist category write
- `expel_workbench.nist_categories.delete` Delete a nist category destructive
- `expel_workbench.nist_categories.related.get` Get the record related to a nist category read
- and 1 more in this area

**Nist subcategories 7**

- `expel_workbench.nist_subcategories.create` Create a nist subcategory write
- `expel_workbench.nist_subcategories.get` Get a nist subcategory read
- `expel_workbench.nist_subcategories.list` List nist subcategories read
- `expel_workbench.nist_subcategories.update` Update a nist subcategory write
- `expel_workbench.nist_subcategories.delete` Delete a nist subcategory destructive
- `expel_workbench.nist_subcategories.related.get` Get the record related to a nist subcategory read
- and 1 more in this area

**Nist subcategory scores 7**

- `expel_workbench.nist_subcategory_scores.create` Create a nist subcategory score write
- `expel_workbench.nist_subcategory_scores.get` Get a nist subcategory score read
- `expel_workbench.nist_subcategory_scores.list` List nist subcategory scores read
- `expel_workbench.nist_subcategory_scores.update` Update a nist subcategory score write
- `expel_workbench.nist_subcategory_scores.delete` Delete a nist subcategory score destructive
- `expel_workbench.nist_subcategory_scores.related.get` Get the record related to a nist subcategory score read
- and 1 more in this area

Notes **7** Organization resilience action groups **7** Organization resilience actions **7** Remediation action assets **7** Remediation action setting list sources **7** Remediation action settings **7** Resilience action groups **7** Suggestions **7** Timeline entries **7** User accounts **7** Vendor alert evidences **7** Vendor alerts **7** Vendors **7** Activity metrics **6** Actor brandings **6** Analyst activity timeline **6** API keys **6** Assembler images **6** Configurations **6** Context category defaults **6** Digests **6** Emerging threat recommendations **6** Event search logs **6** Findings **6** Generated content **6** Integrations **6** Investigation resilience actions **6** Notification rules **6** Organization contacts **6** Phishing submission attachments **6** Phishing submission domains **6** Phishing submission headers **6** Phishing submission urls **6** Remediation action setting pref devices **6** Resilience actions **6** Saml identity providers **6** Secrets **6** User account roles **6** Workflow actions **6** Workflow definitions **6** Plugins **5** Rule definitions **5** Detections **4** Emerging threat scan results **4** Expel alert grid group **4** Expel alert histories **4** Investigation histories **4** Ip addresses **4** Metrics **4** Relationships **4** Remediation action setting histories **4** Security device histories **4** Comment histories **3** Context label action histories **3** Context label histories **3** Context variable histories **3** Entitlements **3** Exempt orgs from sku expiration **3** Expel alert grid view **3** Expel alert threshold histories **3** Health **3** Investigation finding histories **3** Investigative action histories **3** Lookback results **3** Nist subcategory score histories **3** Note histories **3** Organization statuses **3** Remediation action asset histories **3** Remediation action histories **3** Remediation action setting list source histories **3** Security device counts **3** Suggestion histories **3** User account statuses **3** Workflow executions **3** Action types **2** Context label suppressions **2** Event definitions **2** Expel detection categories **2** Investigation resilience action hints **2** Mitre atlas tactics **2** Mitre tactics **2** Skus **2** Cases **1** Events **1** Info **1** Json schema **1** Swagger docs **1** Vendor options **1**

This index shows a sample of each area. All 656 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The Expel Workbench MCP server, answered.

**Is there an Expel Workbench MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 656 Expel Workbench actions across dashboards, context variables, emerging threats and expel alerts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Expel Workbench.

**What do I need to connect Expel Workbench?**

Expel Workbench API key. The free call account { op: "connections.requirements", service: "expel_workbench" } lists exactly what to paste.

**Can an AI agent delete or change things in Expel Workbench?**

Only if its key allows it, and only with an explicit confirmation. 74 Expel Workbench actions are destructive, including delete a user account, delete an api key and delete an investigation. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Expel Workbench API limit?**

actionlake paces every call to the limits in the Expel Workbench service file: 300 calls a minute per connection. Repeated reads are answered from cache (422 Expel Workbench actions can be), which never reaches Expel Workbench.

**What does an Expel Workbench action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (656 Expel Workbench actions page). Cache hits, searches, dry runs and calls Expel Workbench refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Expel Workbench API does it cover?**

The Workbench API v2 (Workbench API, OpenAPI 3.0.0, JSON:API) at workbench.expel.io/api/v2. It is built from Expel Workbench's documentation as read on 23 October 2026. 656 actions in 118 areas, each one in the signed service file (version 1.0.0).

**Can I combine Expel Workbench with my other systems?**

Yes. ask joins Expel Workbench to ConnectWise PSA or NetSuite on the same customer and returns the answer rather than every row. Expel Workbench maps crm.company, which 227 other connectors also map.

**Does actionlake keep my Expel Workbench data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Expel Workbench credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Expel Workbench

Shares the most action names with

- [Trend Vision One 16](https://actionlake.com/connectors/trend-vision-one)
- [StrangeBee TheHive 15](https://actionlake.com/connectors/strangebee-thehive)
- [Sekoia.io 15](https://actionlake.com/connectors/sekoia-io)
- [Panther 13](https://actionlake.com/connectors/panther)
- [GitGuardian 11](https://actionlake.com/connectors/gitguardian)
- [Splunk SOAR 10](https://actionlake.com/connectors/splunk-soar)

Joins with, on shared entities

- [HaloPSA 2](https://actionlake.com/connectors/halopsa)
- [NinjaOne 2](https://actionlake.com/connectors/ninjaone)
- [Salesforce Sales Cloud 2](https://actionlake.com/connectors/salesforce-sales-cloud)
- [Xero 2](https://actionlake.com/connectors/xero)
- [ServiceNow 2](https://actionlake.com/connectors/servicenow)
- [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Expel Workbench; the name is the vendor's own. Counts are from the Expel Workbench service file, version 1.0.0.

## Give your agent Expel Workbench today.

[Connect Expel Workbench free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/expel-workbench
More: https://actionlake.com/llms.txt