Connectors · MSP & PSA

KnowBe4 MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to KnowBe4 and the rest of your systems. It gives your agent 37 KnowBe4 actions (30 reads, 4 writes and 3 that wait for a confirmation) and holds the KnowBe4 credential itself, so the agent never does. It paces KnowBe4's limits and records every call.

Connect KnowBe4 free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

37actionsin one signed file
30readlook, never change
4writecreate and update
3wait for a yesdestructive, confirmed first

Set up

Connect KnowBe4 in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect KnowBe4.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- api_keyKnowBe4 API key
- apiYour KnowBe4 api
- regionYour KnowBe4 region
```
account { op: "connections.requirements", service: "knowbe4" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "knowbe4.users.list" }# list all users · read · 1 upstream callcheck { action: "knowbe4.events.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

KnowBe4 at a glance

Sign-in: Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: api_key
Setup fields: apiregion
Limits we pace to: 50 calls a minute, per connection
API covered: KnowBe4 Reporting API v1 and User Event API (OpenAPI 3.0.1 documents from developer.knowbe4.com), at your region's knowbe4.com address, set when you connect
Built from: KnowBe4's documentation, read 23 October 2026developer.knowbe4.com developer.knowbe4.com developer.knowbe4.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 30 of 30 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 2, so ask can line KnowBe4 up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in KnowBe4.

37 actions in 14 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

30readlook, never change
4writecreate and update
3destructivewait for a confirmation

Events
6
2 read · 2 write · 2 destructive
List all user events · Get a specific user event · Post a new user event · Post a batch of user events
Event types
5
2 read · 2 write · 1 destructive
List all event types · Get a specific event type · Create an event type · Update a specific event type
Groups
3
3 read · 0 write · 0 destructive
List all groups · Get a specific group · Get a specific group's risk score history
Phishing security tests
3
3 read · 0 write · 0 destructive
List all phishing security tests (PSTs) · List the PSTs of a specific phishing campaign · Get a specific PST
Users
3
3 read · 0 write · 0 destructive
List all users · Get a specific user · Get a specific user's risk score history
Account
2
2 read · 0 write · 0 destructive
Get the account's risk score history · Get account and subscription data
Phishing campaigns
2
2 read · 0 write · 0 destructive
List all phishing campaigns · Get a specific phishing campaign
Phishing recipients
2
2 read · 0 write · 0 destructive
List all recipient results of a PST · Get a specific recipient's PST results

6 more areas · 11 actions

Policies 2
Statuses 2
Store purchases 2
Training campaigns 2
Training enrollments 2
Group members 1

Top actions

The KnowBe4 API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 9 of KnowBe4's 11 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`knowbe4.users.list`List all users	List all users.	read	`identity.user.list`474 connectors
`knowbe4.groups.list`List all groups	List all groups.	read	`identity.group.list`262 connectors
`knowbe4.users.get`Get a specific user	Get a specific user.	read	`identity.user.get`399 connectors
`knowbe4.groups.get`Get a specific group	Get a specific group.	read	`identity.group.get`212 connectors
`knowbe4.policies.list`List all uploaded policies	List all uploaded policies.	read	`security.policy.list`36 connectors
`knowbe4.group_members.list`List the users in a specific group	List the users in a specific group.	read	`identity.group_member.list`103 connectors
`knowbe4.policies.get`Get a specific uploaded policy	Get a specific uploaded policy.	read	`security.policy.get`30 connectors
`knowbe4.phishing_campaigns.list`List all phishing campaigns	List all phishing campaigns.	read	`security.phishing_simulation.list`4 connectors
`knowbe4.events.create`Post a new user event	Post a new user event.	write	this connector
`knowbe4.event_types.create`Create an event type	Create an event type.	write	this connector
`knowbe4.events.create_batch`Post a batch of user events	Post a batch of user events.	write	this connector
`knowbe4.events.delete`Delete a specific user event	Delete a specific user event.	destructive	this connector

Try it

Prompts to paste into Claude.

Each one names the KnowBe4 actions it will call, so you know what it reads and what it changes before you send it.

Readread
Who has access in KnowBe4? List every user and their role.
callsknowbe4.users.list
Writewrite
Post a new user event in KnowBe4. Show me exactly what you will send before you save it.
callsknowbe4.events.create

Governance for KnowBe4

Destructive actions wait for a yes.

3 KnowBe4 actions are destructive. These are all of them:

Delete a specific user eventknowbe4.events.delete
Delete a specific event typeknowbe4.event_types.delete
Delete a batch of user events matching filtersknowbe4.events.delete_batch

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doknowbe4.events.deleteconfirm_policy: human

Delete a specific user event?

intent: the user asked me to delete a specific user event

run suspended · waiting for a named person · key knowbe4-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "knowbe4-agent",  allowed_actions: ["knowbe4.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "knowbe4.events.delete", approver: "[email protected]" },    { match: "knowbe4.event_types.delete", approver: "[email protected]" },    { match: "knowbe4.events.delete_batch", approver: "[email protected]" }  ]}

Illustrative. Scoped to KnowBe4 only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What KnowBe4 costs on actionlake.

Every KnowBe4 action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call KnowBe4 refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 37 KnowBe4 actions
13actions pageeach page of a long list is one call
30reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every KnowBe4 action.

37 actions by area: the id your agent calls, what it does, and its effect.

Events6

knowbe4.events.createPost a new user eventwrite
knowbe4.events.create_batchPost a batch of user eventswrite
knowbe4.events.deleteDelete a specific user eventdestructive
knowbe4.events.delete_batchDelete a batch of user events matching filtersdestructive
knowbe4.events.getGet a specific user eventread
knowbe4.events.listList all user eventsread

Event types5

knowbe4.event_types.createCreate an event typewrite
knowbe4.event_types.deleteDelete a specific event typedestructive
knowbe4.event_types.getGet a specific event typeread
knowbe4.event_types.listList all event typesread
knowbe4.event_types.updateUpdate a specific event typewrite

Groups3

knowbe4.groups.getGet a specific groupread
knowbe4.groups.listList all groupsread
knowbe4.groups.list_risk_score_historyGet a specific group's risk score historyread

Phishing security tests3

knowbe4.phishing_security_tests.getGet a specific PSTread
knowbe4.phishing_security_tests.listList all phishing security tests (PSTs)read
knowbe4.phishing_security_tests.list_by_campaignList the PSTs of a specific phishing campaignread

Users3

knowbe4.users.getGet a specific userread
knowbe4.users.listList all usersread
knowbe4.users.list_risk_score_historyGet a specific user's risk score historyread

Account2

knowbe4.account.getGet account and subscription dataread
knowbe4.account.list_risk_score_historyGet the account's risk score historyread

Phishing campaigns2

knowbe4.phishing_campaigns.getGet a specific phishing campaignread
knowbe4.phishing_campaigns.listList all phishing campaignsread

Phishing recipients2

knowbe4.phishing_recipients.getGet a specific recipient's PST resultsread
knowbe4.phishing_recipients.listList all recipient results of a PSTread

Policies2

knowbe4.policies.getGet a specific uploaded policyread
knowbe4.policies.listList all uploaded policiesread

Statuses2

knowbe4.statuses.getGet a specific event request statusread
knowbe4.statuses.listList all event request statusesread

Store purchases2

knowbe4.store_purchases.getGet a specific store purchaseread
knowbe4.store_purchases.listList all store purchases (training content)read

Training campaigns2

knowbe4.training_campaigns.getGet a specific training campaignread
knowbe4.training_campaigns.listList all training campaignsread

Training enrollments2

knowbe4.training_enrollments.getGet a specific training enrollmentread
knowbe4.training_enrollments.listList all training enrollmentsread

Group members1

knowbe4.group_members.listList the users in a specific groupread

Questions

The KnowBe4 MCP server, answered.

Is there a KnowBe4 MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 37 KnowBe4 actions across events, event types, groups and phishing security tests, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by KnowBe4.

What do I need to connect KnowBe4?

KnowBe4 API key. Plus your api and your region. The free call account { op: "connections.requirements", service: "knowbe4" } lists exactly what to paste.

Can an AI agent delete or change things in KnowBe4?

Only if its key allows it, and only with an explicit confirmation. 3 KnowBe4 actions are destructive, including delete a specific user event, delete a specific event type and delete a batch of user events matching filters. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my KnowBe4 API limit?

actionlake paces every call to the limits in the KnowBe4 service file: 50 calls a minute per connection. Repeated reads are answered from cache (30 KnowBe4 actions can be), which never reaches KnowBe4.

What does a KnowBe4 action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (13 KnowBe4 actions page). Cache hits, searches, dry runs and calls KnowBe4 refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which KnowBe4 API does it cover?

The KnowBe4 Reporting API v1 and User Event API (OpenAPI 3.0.1 documents from developer.knowbe4.com) at your region's knowbe4.com address, set when you connect. It is built from KnowBe4's documentation as read on 23 October 2026. 37 actions in 14 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my KnowBe4 data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your KnowBe4 credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent KnowBe4 today.

Connect KnowBe4 free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

KnowBe4 MCP server for AI agents.

Connect KnowBe4 in three steps.

Add actionlake to Claude.

Connect KnowBe4.

Make the first call. Check before a write.

What an AI agent can do in KnowBe4.

Events

Event types

Groups

Phishing security tests

Users

Account

Phishing campaigns

Phishing recipients