Connectors · MSP & PSA

Kandji (Iru) MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Kandji (Iru) and the rest of your systems. It gives your agent 131 Kandji (Iru) actions (75 reads, 36 writes and 20 that wait for a confirmation) and holds the Kandji (Iru) credential itself, so the agent never does. It paces Kandji (Iru)'s limits and records every call.

Connect Kandji (Iru) free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

131actionsin one signed file
75readlook, never change
36writecreate and update
20wait for a yesdestructive, confirmed first

Set up

Connect Kandji (Iru) in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Kandji (Iru).
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- api_tokenIru (Kandji) API token
- hostWhere your Kandji (Iru) lives: your host
```
account { op: "connections.requirements", service: "kandji" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "kandji.devices.list" }# list devices · read · 1 upstream callcheck { action: "kandji.devices.update", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Kandji (Iru) at a glance

Sign-in: Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: api_token
Setup fields: host
Limits we pace to: 10,000 calls an hour, per connection
API covered: Iru Endpoint Management API v1/v2 (formerly Kandji API), at your Kandji (Iru) instance's API base URL, which you enter when connecting
Built from: Kandji (Iru)'s documentation, read 23 October 2026api-docs.kandji.io
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 66 of 75 reads, for up to 10 minutes; a write clears what it affects
Shared entities: 2, so ask can line Kandji (Iru) up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Kandji (Iru).

131 actions in 65 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

75readlook, never change
36writecreate and update
20destructivewait for a confirmation

Devices
27
2 read · 16 write · 9 destructive
List devices · Get device · Update device · Delete device
Blueprints
5
2 read · 2 write · 1 destructive
Create Blueprint · List Blueprints · Get Blueprint · Update Blueprint
Custom apps
5
2 read · 2 write · 1 destructive
List Custom Apps · Create Custom App · Get Custom App · Update Custom App
Custom scripts
5
2 read · 2 write · 1 destructive
List Custom Scripts · Create Custom Script · Get Custom Script · Update Custom Script
Device notes
5
2 read · 2 write · 1 destructive
Create device note · List device notes · Get device note · Update device note
In house apps
5
2 read · 2 write · 1 destructive
List In-House Apps · Create In-House App · Get In-House App · Update In-House App
Ade integrations
4
2 read · 1 write · 1 destructive
List ADE integrations · Get ADE integration · Update ADE integration · Delete ADE integration
Custom profiles
4
2 read · 1 write · 1 destructive
List Custom Profiles · Update Custom Profile · Get Custom Profile · Delete Custom Profile

57 more areas · 71 actions

Tags 4
Ade devices 3
Blueprint library items 3
Users 3
Blueprint routing 2
Device lost mode 2
In house app uploads 2
Prism exports 2
Vulnerabilities 2
Ade integration devices 1
Admins 1
Audit events 1
Behavioral detection events 1
Behavioral detections V1 1
Blueprint enrollment SSO URL 1
Blueprint routing activity 1
Blueprint templates 1
Custom app uploads 1
Device activation lock bypass code 1
Device activity 1
Device apps 1
Device commands 1
Device details 1
Device filevault key 1
Device laps password 1
Device laps users 1
Device library items 1
Device parameters 1
Device recovery password 1
Device status 1
Device unlock pin 1
Library item activity 1
Library item statuses 1
Licensing 1
Prism activation lock 1
Prism application firewall 1
Prism apps 1
Prism cellular 1
Prism certificates 1
Prism counts 1
Prism desktop and screensaver 1
Prism device information 1
Prism filevault 1
Prism gatekeeper and xprotect 1
Prism installed profiles 1
Prism kernel extensions 1
Prism launch agents and daemons 1
Prism local users 1
Prism startup settings 1
Prism system extensions 1
Prism transparency database 1
Self service categories 1
Threat details 1
Threat details V1 1
Vulnerability detections 1
Vulnerability devices 1
Vulnerability software 1

Top actions

The Kandji (Iru) API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 31 of Kandji (Iru)'s 36 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`kandji.devices.list`List devices	List devices.	read	`device.endpoint.list`65 connectors
`kandji.users.list`List users	List users.	read	`identity.user.list`474 connectors
`kandji.devices.get`Get device	Get device.	read	`device.endpoint.get`57 connectors
`kandji.users.get`Get user	Get user.	read	`identity.user.get`399 connectors
`kandji.devices.update`Update device	Update device.	write	`device.endpoint.update`23 connectors
`kandji.devices.delete`Delete device	Delete device.	destructive	`device.endpoint.delete`35 connectors
`kandji.audit_events.list`List audit events	List audit events.	read	`security.audit_log.list`69 connectors
`kandji.device_apps.list`List device apps	List device apps.	read	`device.software.list`11 connectors
`kandji.custom_apps.list`List Custom Apps	List Custom Apps.	read	`device.software_package.list`6 connectors
`kandji.in_house_apps.list`List In-House Apps	List In-House Apps.	read	`device.software_package.list`6 connectors
`kandji.custom_scripts.create`Create Custom Script	Create Custom Script.	write	`device.script.create`4 connectors
`kandji.custom_apps.create`Create Custom App	Create Custom App.	write	`device.software_package.create`3 connectors

Try it

Prompts to paste into Claude.

Each one names the Kandji (Iru) actions it will call, so you know what it reads and what it changes before you send it.

Readread
Which Kandji (Iru) devices have not checked in for a week?
callskandji.devices.list
Writewrite
Update device in Kandji (Iru). Show me exactly what you will send before you save it.
callskandji.devices.update

Governance for Kandji (Iru)

Destructive actions wait for a yes.

20 Kandji (Iru) actions are destructive. These are all of them:

Delete devicekandji.devices.delete
Delete userkandji.users.delete
Delete Custom Appkandji.custom_apps.delete
Delete In-House Appkandji.in_house_apps.delete
Delete Custom Scriptkandji.custom_scripts.delete
Delete Custom Profilekandji.custom_profiles.delete
Delete device notekandji.device_notes.delete
Delete tagkandji.tags.delete
Delete Blueprintkandji.blueprints.delete
Delete ADE integrationkandji.ade_integrations.delete
Remove Library Item from Blueprintkandji.blueprint_library_items.delete
Cancel Lost Modekandji.device_lost_mode.cancel
Lock devicekandji.devices.lock
Erase devicekandji.devices.erase
Restart devicekandji.devices.restart
Shut down devicekandji.devices.shutdown
Clear device passcodekandji.devices.clear_passcode
Delete local user accountkandji.devices.delete_local_user
Reset Android work profile passcodekandji.devices.reset_work_profile_passcode
Disable Lost Modekandji.devices.disable_lost_mode

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dokandji.devices.deleteconfirm_policy: human

Delete device?

intent: the user asked me to delete device

run suspended · waiting for a named person · key kandji-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "kandji-agent",  allowed_actions: ["kandji.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "kandji.devices.delete", approver: "[email protected]" },    { match: "kandji.users.delete", approver: "[email protected]" },    { match: "kandji.custom_apps.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Kandji (Iru) only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Kandji (Iru) costs on actionlake.

Every Kandji (Iru) action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Kandji (Iru) refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 131 Kandji (Iru) actions
131actions pageeach page of a long list is one call
66reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Kandji (Iru) action.

131 actions by area: the id your agent calls, what it does, and its effect.

Devices27

kandji.devices.blank_pushSend blank pushwrite
kandji.devices.clear_passcodeClear device passcodedestructive
kandji.devices.daily_check_inPerform daily check-inwrite
kandji.devices.deleteDelete devicedestructive
kandji.devices.delete_local_userDelete local user accountdestructive
kandji.devices.disable_lost_modeDisable Lost Modedestructive
kandji.devices.enable_lost_modeEnable Lost Modewrite
kandji.devices.eraseErase devicedestructive
kandji.devices.getGet deviceread
kandji.devices.listList devicesread
kandji.devices.lockLock devicedestructive
kandji.devices.play_lost_mode_soundPlay Lost Mode soundwrite
kandji.devices.refresh_cellular_plansRefresh eSIMwrite
kandji.devices.reinstall_agentReinstall Kandji agentwrite
kandji.devices.release_setup_assistantRelease device from Setup Assistantwrite
kandji.devices.renew_mdm_profileRenew MDM profilewrite
kandji.devices.reset_work_profile_passcodeReset Android work profile passcodedestructive
kandji.devices.restartRestart devicedestructive
kandji.devices.set_data_roamingSet data roamingwrite
kandji.devices.set_nameSet device namewrite
kandji.devices.set_personal_hotspotSet Personal Hotspotwrite
kandji.devices.set_remote_desktopSet Remote Desktopwrite
kandji.devices.shutdownShut down devicedestructive
kandji.devices.unlock_accountUnlock local user accountwrite
kandji.devices.updateUpdate devicewrite
kandji.devices.update_inventoryUpdate inventorywrite
kandji.devices.update_locationUpdate device locationwrite

Blueprints5

kandji.blueprints.createCreate Blueprintwrite
kandji.blueprints.deleteDelete Blueprintdestructive
kandji.blueprints.getGet Blueprintread
kandji.blueprints.listList Blueprintsread
kandji.blueprints.updateUpdate Blueprintwrite

Custom apps5

kandji.custom_apps.createCreate Custom Appwrite
kandji.custom_apps.deleteDelete Custom Appdestructive
kandji.custom_apps.getGet Custom Appread
kandji.custom_apps.listList Custom Appsread
kandji.custom_apps.updateUpdate Custom Appwrite

Custom scripts5

kandji.custom_scripts.createCreate Custom Scriptwrite
kandji.custom_scripts.deleteDelete Custom Scriptdestructive
kandji.custom_scripts.getGet Custom Scriptread
kandji.custom_scripts.listList Custom Scriptsread
kandji.custom_scripts.updateUpdate Custom Scriptwrite

Device notes5

kandji.device_notes.createCreate device notewrite
kandji.device_notes.deleteDelete device notedestructive
kandji.device_notes.getGet device noteread
kandji.device_notes.listList device notesread
kandji.device_notes.updateUpdate device notewrite

In house apps5

kandji.in_house_apps.createCreate In-House Appwrite
kandji.in_house_apps.deleteDelete In-House Appdestructive
kandji.in_house_apps.getGet In-House Appread
kandji.in_house_apps.listList In-House Appsread
kandji.in_house_apps.updateUpdate In-House Appwrite

Ade integrations4

kandji.ade_integrations.deleteDelete ADE integrationdestructive
kandji.ade_integrations.getGet ADE integrationread
kandji.ade_integrations.listList ADE integrationsread
kandji.ade_integrations.updateUpdate ADE integrationwrite

Custom profiles4

kandji.custom_profiles.deleteDelete Custom Profiledestructive
kandji.custom_profiles.getGet Custom Profileread
kandji.custom_profiles.listList Custom Profilesread
kandji.custom_profiles.updateUpdate Custom Profilewrite

Tags4

kandji.tags.createCreate tagwrite
kandji.tags.deleteDelete tagdestructive
kandji.tags.listList tagsread
kandji.tags.updateRename tagwrite

Ade devices3

kandji.ade_devices.getGet ADE deviceread
kandji.ade_devices.listList ADE devicesread
kandji.ade_devices.updateUpdate ADE devicewrite

Blueprint library items3

kandji.blueprint_library_items.createAssign Library Item to Blueprintwrite
kandji.blueprint_library_items.deleteRemove Library Item from Blueprintdestructive
kandji.blueprint_library_items.listList Blueprint Library Itemsread

Users3

kandji.users.deleteDelete userdestructive
kandji.users.getGet userread
kandji.users.listList usersread

Blueprint routing2

kandji.blueprint_routing.getGet Blueprint Routingread
kandji.blueprint_routing.updateUpdate Blueprint Routingwrite

Device lost mode2

kandji.device_lost_mode.cancelCancel Lost Modedestructive
kandji.device_lost_mode.getGet device Lost Mode detailsread

In house app uploads2

kandji.in_house_app_uploads.createStart In-House App uploadwrite
kandji.in_house_app_uploads.getGet In-House App upload statusread

Prism exports2

kandji.prism_exports.createRequest Prism category exportwrite
kandji.prism_exports.getGet Prism exportread

Vulnerabilities2

kandji.vulnerabilities.getGet vulnerabilityread
kandji.vulnerabilities.listList vulnerabilitiesread

Ade integration devices1

kandji.ade_integration_devices.listList devices associated with an ADE tokenread

Admins1

kandji.admins.listList tenant adminsread

Audit events1

kandji.audit_events.listList audit eventsread

Behavioral detection events1

kandji.behavioral_detection_events.listList behavioral detection eventsread

Behavioral detections V11

kandji.behavioral_detections_v1.listList behavioral detections (v1, deprecated)read

Blueprint enrollment SSO URL1

kandji.blueprint_enrollment_sso_url.getGet manual enrollment SSO URLread

Blueprint routing activity1

kandji.blueprint_routing_activity.listList Blueprint Routing activityread

Blueprint templates1

kandji.blueprint_templates.listList Blueprint templatesread

Custom app uploads1

kandji.custom_app_uploads.createStart Custom App uploadwrite

Device activation lock bypass code1

kandji.device_activation_lock_bypass_code.getGet Activation Lock bypass coderead

Device activity1

kandji.device_activity.listList device activityread

Device apps1

kandji.device_apps.listList device appsread

Device commands1

kandji.device_commands.listList device MDM commandsread

Device details1

kandji.device_details.getGet device detailsread

Device filevault key1

kandji.device_filevault_key.getGet FileVault recovery keyread

Device laps password1

kandji.device_laps_password.getGet LAPS user passwordread

Device laps users1

kandji.device_laps_users.listList LAPS usersread

Device library items1

kandji.device_library_items.listList device Library Itemsread

Device parameters1

kandji.device_parameters.listList device parametersread

Device recovery password1

kandji.device_recovery_password.getGet Recovery Lock passwordread

Device status1

kandji.device_status.getGet device statusread

Device unlock pin1

kandji.device_unlock_pin.getGet device unlock PINread

Library item activity1

kandji.library_item_activity.listList Library Item activityread

Library item statuses1

kandji.library_item_statuses.listList Library Item statusesread

Licensing1

kandji.licensing.getGet tenant licensingread

Prism activation lock1

kandji.prism_activation_lock.listPrism: Activation lockread

Prism application firewall1

kandji.prism_application_firewall.listPrism: Application firewallread

Prism apps1

kandji.prism_apps.listPrism: Applicationsread

Prism cellular1

kandji.prism_cellular.listPrism: Cellularread

Prism certificates1

kandji.prism_certificates.listPrism: Certificatesread

Prism counts1

kandji.prism_counts.getCount Prism category recordsread

Prism desktop and screensaver1

kandji.prism_desktop_and_screensaver.listPrism: Desktop and Screensaverread

Prism device information1

kandji.prism_device_information.listPrism: Device informationread

Prism filevault1

kandji.prism_filevault.listPrism: FileVaultread

Prism gatekeeper and xprotect1

kandji.prism_gatekeeper_and_xprotect.listPrism: Gatekeeper and XProtectread

Prism installed profiles1

kandji.prism_installed_profiles.listPrism: Installed profilesread

Prism kernel extensions1

kandji.prism_kernel_extensions.listPrism: Kernel Extensionsread

Prism launch agents and daemons1

kandji.prism_launch_agents_and_daemons.listPrism: Launch Agents and Daemonsread

Prism local users1

kandji.prism_local_users.listPrism: Local usersread

Prism startup settings1

kandji.prism_startup_settings.listPrism: Startup settingsread

Prism system extensions1

kandji.prism_system_extensions.listPrism: System Extensionsread

Prism transparency database1

kandji.prism_transparency_database.listPrism: Transparency databaseread

Self service categories1

kandji.self_service_categories.listList Self Service categoriesread

Threat details1

kandji.threat_details.listList threat detailsread

Threat details V11

kandji.threat_details_v1.listList threat details (v1, deprecated)read

Vulnerability detections1

kandji.vulnerability_detections.listList vulnerability detectionsread

Vulnerability devices1

kandji.vulnerability_devices.listList devices affected by a vulnerabilityread

Vulnerability software1

kandji.vulnerability_software.listList software affected by a vulnerabilityread

Questions

The Kandji (Iru) MCP server, answered.

Is there a Kandji (Iru) MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 131 Kandji (Iru) actions across devices, blueprints, custom apps and custom scripts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Kandji (Iru).

What do I need to connect Kandji (Iru)?

Iru (Kandji) API token. Plus your host. The free call account { op: "connections.requirements", service: "kandji" } lists exactly what to paste.

Can an AI agent delete or change things in Kandji (Iru)?

Only if its key allows it, and only with an explicit confirmation. 20 Kandji (Iru) actions are destructive, including delete device, delete user and delete Custom App. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Kandji (Iru) API limit?

actionlake paces every call to the limits in the Kandji (Iru) service file: 10,000 calls an hour per connection. Repeated reads are answered from cache (66 Kandji (Iru) actions can be), which never reaches Kandji (Iru).

What does a Kandji (Iru) action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (131 Kandji (Iru) actions page). Cache hits, searches, dry runs and calls Kandji (Iru) refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Kandji (Iru) API does it cover?

The Iru Endpoint Management API v1/v2 (formerly Kandji API) at your Kandji (Iru) instance's API base URL, which you enter when connecting. It is built from Kandji (Iru)'s documentation as read on 23 October 2026. 131 actions in 65 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Kandji (Iru) data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 10 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Kandji (Iru) credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Kandji (Iru) today.

Connect Kandji (Iru) free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Kandji (Iru) MCP server for AI agents.

Connect Kandji (Iru) in three steps.

Add actionlake to Claude.

Connect Kandji (Iru).

Make the first call. Check before a write.

What an AI agent can do in Kandji (Iru).

Devices

Blueprints

Custom apps

Custom scripts

Device notes

In house apps

Ade integrations

Custom profiles