Connectors · Identity & security
Mimecast MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Mimecast and the rest of your systems. It gives your agent 367 Mimecast actions (190 reads, 125 writes and 52 that wait for a confirmation) and holds the Mimecast credential itself, so the agent never does. It paces Mimecast's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "mimecast.users.list_user_users", intent: "check which Mimecast account is connected"}# List user users · read · 1 upstream call- 367actionsin one signed file
- 190readlook, never change
- 125writecreate and update
- 52wait for a yesdestructive, confirmed first
Set up
Connect Mimecast in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Mimecast.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idMimecast API 2.0 client IDclient_secretMimecast API 2.0 client secret (shown when the API application is created)tenant_hostWhere your Mimecast lives: your tenant host
account { op: "connections.requirements", service: "mimecast" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "mimecast.users.list_user_users" }# list user users · read · 1 upstream callcheck { action: "mimecast.users.create_user_users", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Mimecast at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
tenant_host- Limits we pace to
- 10 calls a second, per connection
- API covered
- Mimecast API 2.0 (developer.services.mimecast.com OpenAPI 3.0 specs, fetched 2026-10-22)
api.services.mimecast.com - Built from
- Mimecast's documentation, read 22 October 2026developer.services.mimecast.comdeveloper.services.mimecast.comdeveloper.services.mimecast.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 188 of 190 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line Mimecast up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Mimecast.
367 actions in 20 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 190readlook, never change
- 125writecreate and update
- 52destructivewait for a confirmation
Dmarc
8444 read · 25 write · 15 destructive
Create domains · Create tasks · Create users · Delegated domains
Policy
6423 read · 28 write · 13 destructive
Create anti spoofing bypass policies · Create anti spoofing policies · Create blocked senders policies · Create delivery route definitions
Users
6218 read · 34 write · 10 destructive
List user users · List directory groups · Create user users · Create directory groups
Gateway
2814 read · 8 write · 6 destructive
Create journaling services · Email get email queues · Email send email · Gateway find held messages
Domain
2212 read · 8 write · 2 destructive
Domain create domain · Domain get internal domain · Domain get pending domain · Domain get provision status
Threats
2118 read · 2 write · 1 destructive
List threats events · Create threat reporting subscriptions · List SIEM batch events CG · List SIEM events CG
Account
128 read · 4 write · 0 destructive
Account get account · Account get dashboard notifications · Account get support info · Config snapshot create
Awareness
1010 read · 0 write · 0 destructive
Awareness training company get performance details · Awareness training company get performance summary · Awareness training company get safe score details · Awareness training company get safe score summary
12 more areas · 64 actions
- Threat 10
- Archive 8
- Integration 8
- Audit 7
- CI email 7
- Human risk 7
- Connector 5
- CI remediation 4
- Security events 4
- CI threats 2
- Directory 1
- Onboarding 1
Top actions
The Mimecast API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 9 of Mimecast's 9 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
mimecast.users.list_user_usersList user users | List user users. | read | identity.user.list474 connectors |
mimecast.users.list_directory_groupsList directory groups | List directory groups. | read | identity.group.list262 connectors |
mimecast.users.create_user_usersCreate user users | Create user users. | write | identity.user.create262 connectors |
mimecast.users.create_directory_groupsCreate directory groups | Create directory groups. | write | identity.group.create205 connectors |
mimecast.users.list_directory_groups_membersList directory groups members | List directory groups members. | read | identity.group_member.list103 connectors |
mimecast.onboarding.list_role_rolesList role roles | List role roles. | read | identity.role.list184 connectors |
mimecast.audit.audit_get_audit_eventsAudit get audit events | Audit get audit events. | read | identity.audit_event.search7 connectors |
mimecast.threats.list_threats_eventsList threats events | List Threat events. | read | security.threat.list7 connectors |
mimecast.archive.archive_searchArchive search | Archive search. | read | this connector |
mimecast.users.user_create_userUser create user | User create user. | write | this connector |
mimecast.gateway.email_send_emailEmail send email | Email send email. | write | this connector |
mimecast.users.user_remove_aliasUser remove alias | User remove alias. | destructive | this connector |
Try it
Prompts to paste into Claude.
Each one names the Mimecast actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in Mimecast? List every user and their role.
calls
mimecast.users.list_user_users - Writewrite
Create user users in Mimecast. Show me exactly what you will send before you save it.
calls
mimecast.users.create_user_users
Governance for Mimecast
Destructive actions wait for a yes.
52 Mimecast actions are destructive. The first 10:
- User remove alias
mimecast.users.user_remove_alias - Gateway hold reject
mimecast.gateway.gateway_hold_reject - Directory delete group
mimecast.users.directory_delete_group - User add to purge list
mimecast.users.user_add_to_purge_list - User remove delegate user
mimecast.users.user_remove_delegate_user - TTP URL delete managed URL
mimecast.policy.ttp_url_delete_managed_url - User remove from purge list
mimecast.users.user_remove_from_purge_list - Delete journaling services
mimecast.gateway.delete_journaling_services - Delete greylisting policies
mimecast.policy.delete_greylisting_policies - Domain delete pending domain
mimecast.domain.domain_delete_pending_domain
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
domimecast.gateway.delete_journaling_servicesconfirm_policy: human
Delete journaling services?
intent: the user asked me to delete journaling services
run suspended · waiting for a named person · key mimecast-agent cannot confirm itself
In the console, or from an emailed signed link.
account { op: "keys.create", name: "mimecast-agent", allowed_actions: ["mimecast.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "mimecast.users.user_remove_alias", approver: "[email protected]" }, { match: "mimecast.gateway.gateway_hold_reject", approver: "[email protected]" }, { match: "mimecast.users.directory_delete_group", approver: "[email protected]" } ]}Cost
What Mimecast costs on actionlake.
Every Mimecast action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Mimecast refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 367 Mimecast actions
- 367actions pageeach page of a long list is one call
- 188reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Mimecast action.
367 actions by area: the id your agent calls, what it does, and its effect.
Dmarc84
mimecast.dmarc.create_domainsCreate domainswritemimecast.dmarc.create_tasksCreate taskswritemimecast.dmarc.create_usersCreate userswritemimecast.dmarc.delegated_domainsDelegated domainswritemimecast.dmarc.delegated_domains_dkimDelegated domains DKIMwritemimecast.dmarc.delegated_domains_dmarcDelegated domains DMARCwritemimecast.dmarc.delete_customers_encryption_keyDelete customers encryption keydestructivemimecast.dmarc.delete_delegated_domainsDelete delegated domainsdestructivemimecast.dmarc.delete_delegated_domains_dkimDelete delegated domains DKIMdestructivemimecast.dmarc.delete_delegated_domains_dkim_by_selectorDelete delegated domains DKIM by selectordestructivemimecast.dmarc.delete_delegated_domains_dmarcDelete delegated domains DMARCdestructivemimecast.dmarc.delete_delegated_domains_spfDelete delegated domains SPFdestructivemimecast.dmarc.delete_dmarc_policy_presetDelete DMARC policy presetdestructivemimecast.dmarc.delete_domain_groupsDelete domain groupsdestructivemimecast.dmarc.delete_domain_groups_associationDelete domain groups associationdestructivemimecast.dmarc.delete_domainsDelete domainsdestructivemimecast.dmarc.delete_issuesDelete issuesdestructivemimecast.dmarc.delete_notificationsDelete notificationsdestructivemimecast.dmarc.delete_sources_vendors_associationsDelete sources vendors associationsdestructivemimecast.dmarc.delete_tasksDelete tasksdestructivemimecast.dmarc.delete_usersDelete usersdestructivemimecast.dmarc.dmarc_policy_presetDMARC policy presetwritemimecast.dmarc.domain_groupsDomain groupswritemimecast.dmarc.domain_groups_associationDomain groups associationwritemimecast.dmarc.domains_refresh_dnsDomains refresh DNSwritemimecast.dmarc.get_compliance_dmarc_statisticsGet compliance DMARC statisticsreadmimecast.dmarc.get_compliance_domains_dmarc_policy_changesGet compliance domains DMARC policy changesreadmimecast.dmarc.get_customersGet customersreadmimecast.dmarc.get_customers_encryption_keyGet customers encryption keyreadmimecast.dmarc.get_delegated_domains_dkimGet delegated domains DKIMreadmimecast.dmarc.get_delegated_domains_dkim_detailsGet delegated domains DKIM detailsreadmimecast.dmarc.get_delegated_domains_dmarcGet delegated domains DMARCreadmimecast.dmarc.get_delegated_domains_spfGet delegated domains SPFreadmimecast.dmarc.get_delegated_domains_spf_detailsGet delegated domains SPF detailsreadmimecast.dmarc.get_delegated_domains_statisticsGet delegated domains statisticsreadmimecast.dmarc.get_domain_groupsGet domain groupsreadmimecast.dmarc.get_domainsGet domainsreadmimecast.dmarc.get_domains_statisticsGet domains statisticsreadmimecast.dmarc.get_domains_vendor_configurationsGet domains vendor configurationsreadmimecast.dmarc.get_notificationsGet notificationsreadmimecast.dmarc.get_report_metadataGet report metadatareadmimecast.dmarc.get_reports_resultsGet reports resultsreadmimecast.dmarc.get_sources_vendorsGet sources vendorsreadmimecast.dmarc.get_tasksGet tasksreadmimecast.dmarc.get_usersGet usersreadmimecast.dmarc.list_compliance_domains_dns_suggestionsList compliance domains DNS suggestionsreadmimecast.dmarc.list_compliance_domains_enforcementList compliance domains enforcementreadmimecast.dmarc.list_delegated_domainsList delegated domainsreadmimecast.dmarc.list_delegated_domains_dkimList delegated domains DKIMreadmimecast.dmarc.list_detected_domainsList detected domainsreadmimecast.dmarc.list_dmarc_policy_presetList DMARC policy presetreadmimecast.dmarc.list_dns_bimiList DNS BIMIreadmimecast.dmarc.list_dns_dkimList DNS DKIMreadmimecast.dmarc.list_dns_dmarcList DNS DMARCreadmimecast.dmarc.list_dns_spfList DNS SPFreadmimecast.dmarc.list_domain_groupsList domain groupsreadmimecast.dmarc.list_domainsList domainsreadmimecast.dmarc.list_eventsList eventsreadmimecast.dmarc.list_issuesList issuesreadmimecast.dmarc.list_notificationsList notificationsreadmimecast.dmarc.list_sourcesList sourcesreadmimecast.dmarc.list_sources_compliance_actionsList sources compliance actionsreadmimecast.dmarc.list_sources_compliance_statisticsList sources compliance statisticsreadmimecast.dmarc.list_sources_vendorsList sources vendorsreadmimecast.dmarc.list_tasksList tasksreadmimecast.dmarc.list_tasks_summaryList tasks summaryreadmimecast.dmarc.list_usersList usersreadmimecast.dmarc.list_users_current_userList users current userreadmimecast.dmarc.notificationsNotificationswritemimecast.dmarc.replace_customers_encryption_keyReplace customers encryption keywritemimecast.dmarc.replace_delegated_domains_dkimReplace delegated domains DKIMwritemimecast.dmarc.replace_delegated_domains_spfReplace delegated domains SPFwritemimecast.dmarc.replace_detected_domains_statusReplace detected domains statuswritemimecast.dmarc.replace_dmarc_policy_presetReplace DMARC policy presetwritemimecast.dmarc.replace_domain_groupsReplace domain groupswritemimecast.dmarc.replace_notificationsReplace notificationswritemimecast.dmarc.replace_tasksReplace taskswritemimecast.dmarc.replace_usersReplace userswritemimecast.dmarc.reportsReportsreadmimecast.dmarc.sources_vendors_associationsSources vendors associationswritemimecast.dmarc.update_detected_domainsUpdate detected domainswritemimecast.dmarc.update_domainsUpdate domainswritemimecast.dmarc.update_sources_vendorsUpdate sources vendorswritemimecast.dmarc.update_tasksUpdate taskswrite
Policy64
mimecast.policy.create_anti_spoofing_bypass_policiesCreate anti spoofing bypass policieswritemimecast.policy.create_anti_spoofing_policiesCreate anti spoofing policieswritemimecast.policy.create_blocked_senders_policiesCreate blocked senders policieswritemimecast.policy.create_delivery_route_definitionsCreate delivery route definitionswritemimecast.policy.create_delivery_route_policiesCreate delivery route policieswritemimecast.policy.create_dns_authentication_outbound_definitionsCreate DNS authentication outbound definitionswritemimecast.policy.create_dns_authentication_outbound_policiesCreate DNS authentication outbound policieswritemimecast.policy.create_greylisting_policiesCreate greylisting policieswritemimecast.policy.delete_anti_spoofing_bypass_policiesDelete anti spoofing bypass policiesdestructivemimecast.policy.delete_anti_spoofing_policiesDelete anti spoofing policiesdestructivemimecast.policy.delete_blocked_senders_policiesDelete blocked senders policiesdestructivemimecast.policy.delete_delivery_route_definitionsDelete delivery route definitionsdestructivemimecast.policy.delete_delivery_route_policiesDelete delivery route policiesdestructivemimecast.policy.delete_dns_authentication_outbound_definitionsDelete DNS authentication outbound definitionsdestructivemimecast.policy.delete_dns_authentication_outbound_policiesDelete DNS authentication outbound policiesdestructivemimecast.policy.delete_greylisting_policiesDelete greylisting policiesdestructivemimecast.policy.delivery_route_verifyDelivery route verifywritemimecast.policy.dns_authentication_outbound_definitions_verifyDNS authentication outbound definitions verifywritemimecast.policy.get_anti_spoofing_bypass_policiesGet anti spoofing bypass policiesreadmimecast.policy.get_anti_spoofing_policiesGet anti spoofing policiesreadmimecast.policy.get_blocked_senders_policiesGet blocked senders policiesreadmimecast.policy.get_delivery_route_definitionsGet delivery route definitionsreadmimecast.policy.get_delivery_route_policiesGet delivery route policiesreadmimecast.policy.get_dns_authentication_outbound_definitionsGet DNS authentication outbound definitionsreadmimecast.policy.get_dns_authentication_outbound_policiesGet DNS authentication outbound policiesreadmimecast.policy.get_greylisting_policiesGet greylisting policiesreadmimecast.policy.list_anti_spoofing_bypass_policiesList anti spoofing bypass policiesreadmimecast.policy.list_anti_spoofing_policiesList anti spoofing policiesreadmimecast.policy.list_blocked_senders_policiesList blocked senders policiesreadmimecast.policy.list_delivery_route_definitionsList delivery route definitionsreadmimecast.policy.list_delivery_route_policiesList delivery route policiesreadmimecast.policy.list_dns_authentication_outbound_definitionsList DNS authentication outbound definitionsreadmimecast.policy.list_dns_authentication_outbound_policiesList DNS authentication outbound policiesreadmimecast.policy.list_greylisting_policiesList greylisting policiesreadmimecast.policy.policy_address_alteration_create_address_alteration_setPolicy address alteration create address alteration setwritemimecast.policy.policy_address_alteration_create_definitionPolicy address alteration create definitionwritemimecast.policy.policy_address_alteration_create_policyPolicy address alteration create policywritemimecast.policy.policy_address_alteration_delete_definitionPolicy address alteration delete definitiondestructivemimecast.policy.policy_address_alteration_delete_policyPolicy address alteration delete policydestructivemimecast.policy.policy_address_alteration_get_address_alteration_setPolicy address alteration get address alteration setreadmimecast.policy.policy_address_alteration_get_definitionPolicy address alteration get definitionreadmimecast.policy.policy_address_alteration_get_policyPolicy address alteration get policyreadmimecast.policy.policy_address_alteration_update_policyPolicy address alteration update policywritemimecast.policy.policy_antispoofing_bypass_create_policyPolicy antispoofing bypass create policywritemimecast.policy.policy_antispoofing_bypass_delete_policyPolicy antispoofing bypass delete policydestructivemimecast.policy.policy_antispoofing_bypass_get_policyPolicy antispoofing bypass get policyreadmimecast.policy.policy_antispoofing_bypass_update_policyPolicy antispoofing bypass update policywritemimecast.policy.policy_blockedsenders_create_policyPolicy blockedsenders create policywritemimecast.policy.policy_blockedsenders_get_policyPolicy blockedsenders get policyreadmimecast.policy.policy_webwhiteurl_create_policy_with_targetsPolicy webwhiteurl create policy with targetswritemimecast.policy.policy_webwhiteurl_delete_policy_with_targetsPolicy webwhiteurl delete policy with targetsdestructivemimecast.policy.policy_webwhiteurl_get_policy_with_targetsPolicy webwhiteurl get policy with targetsreadmimecast.policy.policy_webwhiteurl_update_policy_with_targetsPolicy webwhiteurl update policy with targetswritemimecast.policy.ttp_url_create_managed_urlTTP URL create managed URLwritemimecast.policy.ttp_url_delete_managed_urlTTP URL delete managed URLdestructivemimecast.policy.ttp_url_get_all_managed_urlsTTP URL get all managed URLsreadmimecast.policy.update_anti_spoofing_bypass_policiesUpdate anti spoofing bypass policieswritemimecast.policy.update_anti_spoofing_policiesUpdate anti spoofing policieswritemimecast.policy.update_blocked_senders_policiesUpdate blocked senders policieswritemimecast.policy.update_delivery_route_definitionsUpdate delivery route definitionswritemimecast.policy.update_delivery_route_policiesUpdate delivery route policieswritemimecast.policy.update_dns_authentication_outbound_definitionsUpdate DNS authentication outbound definitionswritemimecast.policy.update_dns_authentication_outbound_policiesUpdate DNS authentication outbound policieswritemimecast.policy.update_greylisting_policiesUpdate greylisting policieswrite
Users62
mimecast.users.attribute_find_attribute_typesAttribute find attribute typesreadmimecast.users.create_directory_groupsCreate directory groupswritemimecast.users.create_directory_groups_membersCreate directory groups memberswritemimecast.users.create_user_usersCreate user userswritemimecast.users.delete_directory_integrations_active_directoryDelete directory integrations active directorydestructivemimecast.users.delete_directory_integrations_googleDelete directory integrations googledestructivemimecast.users.delete_directory_integrations_m365Delete directory integrations M365destructivemimecast.users.directory_add_group_memberDirectory add group memberwritemimecast.users.directory_create_groupDirectory create groupwritemimecast.users.directory_delete_groupDirectory delete groupdestructivemimecast.users.directory_execute_syncDirectory execute syncwritemimecast.users.directory_find_groupsDirectory find groupsreadmimecast.users.directory_get_connectionDirectory get connectionreadmimecast.users.directory_get_group_membersDirectory get group membersreadmimecast.users.directory_groups_remove_membersDirectory groups remove membersdestructivemimecast.users.directory_integrations_active_directoryDirectory integrations active directorywritemimecast.users.directory_integrations_active_directory_test_authenticationDirectory integrations active directory test authenticationwritemimecast.users.directory_integrations_active_directory_test_certificatesDirectory integrations active directory test certificateswritemimecast.users.directory_integrations_active_directory_test_connectivityDirectory integrations active directory test connectivitywritemimecast.users.directory_integrations_active_directory_test_egress_connectivityDirectory integrations active directory test egress connectivitywritemimecast.users.directory_integrations_active_directory_test_emailDirectory integrations active directory test emailwritemimecast.users.directory_integrations_active_directory_test_validationDirectory integrations active directory test validationwritemimecast.users.directory_integrations_googleDirectory integrations googlewritemimecast.users.directory_integrations_google_test_authenticationDirectory integrations google test authenticationwritemimecast.users.directory_integrations_google_test_authorisationDirectory integrations google test authorisationwritemimecast.users.directory_integrations_google_test_connectivityDirectory integrations google test connectivitywritemimecast.users.directory_integrations_google_test_emailDirectory integrations google test emailwritemimecast.users.directory_integrations_m365Directory integrations M365writemimecast.users.directory_integrations_m365_test_authenticationDirectory integrations M365 test authenticationwritemimecast.users.directory_integrations_m365_test_authorisationDirectory integrations M365 test authorisationwritemimecast.users.directory_integrations_m365_test_connectivityDirectory integrations M365 test connectivitywritemimecast.users.directory_integrations_m365_test_connectorDirectory integrations M365 test connectorwritemimecast.users.directory_integrations_m365_test_emailDirectory integrations M365 test emailwritemimecast.users.directory_integrations_sync_requestsDirectory integrations sync requestswritemimecast.users.directory_remove_group_memberDirectory remove group memberdestructivemimecast.users.directory_update_groupDirectory update groupwritemimecast.users.get_directory_groupsGet directory groupsreadmimecast.users.get_directory_integrations_active_directoryGet directory integrations active directoryreadmimecast.users.get_directory_integrations_googleGet directory integrations googlereadmimecast.users.get_directory_integrations_m365Get directory integrations M365readmimecast.users.list_directory_groupsList directory groupsreadmimecast.users.list_directory_groups_membersList directory groups membersreadmimecast.users.list_directory_integrationsList directory integrationsreadmimecast.users.list_user_usersList user usersreadmimecast.users.update_directory_integrations_active_directoryUpdate directory integrations active directorywritemimecast.users.update_directory_integrations_googleUpdate directory integrations googlewritemimecast.users.update_directory_integrations_m365Update directory integrations M365writemimecast.users.user_add_delegate_userUser add delegate userwritemimecast.users.user_add_to_purge_listUser add to purge listdestructivemimecast.users.user_create_userUser create userwritemimecast.users.user_find_delegate_usersUser find delegate usersreadmimecast.users.user_get_aliasesUser get aliasesreadmimecast.users.user_get_attributesUser get attributesreadmimecast.users.user_get_import_statusUser get import statusreadmimecast.users.user_get_internal_usersUser get internal usersreadmimecast.users.user_get_most_used_contactsUser get most used contactsreadmimecast.users.user_remove_aliasUser remove aliasdestructivemimecast.users.user_remove_delegate_userUser remove delegate userdestructivemimecast.users.user_remove_from_purge_listUser remove from purge listdestructivemimecast.users.user_update_aliasUser update aliaswritemimecast.users.user_update_attributesUser update attributeswritemimecast.users.user_update_userUser update userwrite
Gateway28
mimecast.gateway.create_journaling_servicesCreate journaling serviceswritemimecast.gateway.delete_email_outbound_ip_addressesDelete email outbound IP addressesdestructivemimecast.gateway.delete_journaling_servicesDelete journaling servicesdestructivemimecast.gateway.email_get_email_queuesEmail get email queuesreadmimecast.gateway.email_managed_senders_internal_addresses_bulk_deleteEmail managed senders internal addresses bulk deletedestructivemimecast.gateway.email_managed_senders_recipients_bulk_deleteEmail managed senders recipients bulk deletedestructivemimecast.gateway.email_managed_senders_senders_bulk_deleteEmail managed senders senders bulk deletedestructivemimecast.gateway.email_send_emailEmail send emailwritemimecast.gateway.gateway_find_held_messagesGateway find held messagesreadmimecast.gateway.gateway_find_processing_messagesGateway find processing messagesreadmimecast.gateway.gateway_get_hold_message_listGateway get hold message listreadmimecast.gateway.gateway_get_hold_summary_listGateway get hold summary listreadmimecast.gateway.gateway_hold_rejectGateway hold rejectdestructivemimecast.gateway.gateway_hold_releaseGateway hold releasewritemimecast.gateway.get_email_gateway_detailsGet email gateway detailsreadmimecast.gateway.get_email_statisticsGet email statisticsreadmimecast.gateway.get_journaling_servicesGet journaling servicesreadmimecast.gateway.journaling_get_serviceJournaling get servicereadmimecast.gateway.list_email_outbound_ip_addressesList email outbound IP addressesreadmimecast.gateway.list_journaling_servicesList journaling servicesreadmimecast.gateway.managedsender_permit_or_block_senderManagedsender permit or block senderwritemimecast.gateway.message_finder_get_message_infoMessage finder get message inforeadmimecast.gateway.message_finder_searchMessage finder searchreadmimecast.gateway.replace_email_outbound_ip_addressesReplace email outbound IP addresseswritemimecast.gateway.ttp_url_decode_urlTTP URL decode URLreadmimecast.gateway.update_email_gateway_detailsUpdate email gateway detailswritemimecast.gateway.update_email_protection_modeUpdate email protection modewritemimecast.gateway.update_journaling_servicesUpdate journaling serviceswrite
Domain22
mimecast.domain.delete_domain_pending_domainsDelete domain pending domainsdestructivemimecast.domain.domain_create_domainDomain create domainwritemimecast.domain.domain_delete_pending_domainDomain delete pending domaindestructivemimecast.domain.domain_get_internal_domainDomain get internal domainreadmimecast.domain.domain_get_pending_domainDomain get pending domainreadmimecast.domain.domain_get_provision_statusDomain get provision statusreadmimecast.domain.domain_get_verification_codeDomain get verification codereadmimecast.domain.domain_internal_domains_m365_registerDomain internal domains M365 registerwritemimecast.domain.domain_internal_domains_verifyDomain internal domains verifywritemimecast.domain.domain_pending_domainsDomain pending domainswritemimecast.domain.domain_pending_domains_generate_tokenDomain pending domains generate tokenwritemimecast.domain.domain_pending_domains_verifyDomain pending domains verifywritemimecast.domain.domain_verify_domainDomain verify domainwritemimecast.domain.get_domain_external_domainsGet domain external domainsreadmimecast.domain.get_domain_internal_domainsGet domain internal domainsreadmimecast.domain.get_domain_internal_domains_dns_recordsGet domain internal domains DNS recordsreadmimecast.domain.get_domain_pending_domainsGet domain pending domainsreadmimecast.domain.list_domain_external_domainsList domain external domainsreadmimecast.domain.list_domain_internal_domainsList domain internal domainsreadmimecast.domain.list_domain_internal_domains_m365_lookupList domain internal domains M365 lookupreadmimecast.domain.list_domain_pending_domainsList domain pending domainsreadmimecast.domain.update_domain_internal_domainsUpdate domain internal domainswrite
Threats21
mimecast.threats.create_threat_reporting_subscriptionsCreate threat reporting subscriptionswritemimecast.threats.delete_threat_reporting_subscriptionsDelete threat reporting subscriptionsdestructivemimecast.threats.get_threat_reporting_reported_emailsGet threat reporting reported emailsreadmimecast.threats.get_threat_reporting_reported_emails_by_reported_message_aggregate_idGet threat reporting reported emails by reported message aggregate IDreadmimecast.threats.get_threat_reporting_threat_analysisGet threat reporting threat analysisreadmimecast.threats.get_threats_events_detailsGet threats events detailsreadmimecast.threats.list_siem_batch_events_cgList SIEM batch events CGreadmimecast.threats.list_siem_events_cgList SIEM events CGreadmimecast.threats.list_threat_reporting_subscriptionsList threat reporting subscriptionsreadmimecast.threats.list_threat_reporting_threat_reportsList threat reporting threat reportsreadmimecast.threats.list_threats_eventsList threats eventsreadmimecast.threats.list_threats_stats_attachment_scansList threats stats attachment scansreadmimecast.threats.list_threats_stats_gateway_detectionsList threats stats gateway detectionsreadmimecast.threats.list_threats_stats_impersonationsList threats stats impersonationsreadmimecast.threats.list_threats_stats_phishingList threats stats phishingreadmimecast.threats.list_threats_stats_suspiciousList threats stats suspiciousreadmimecast.threats.list_threats_stats_threats_by_recipientList threats stats threats by recipientreadmimecast.threats.list_threats_stats_threats_by_senderList threats stats threats by senderreadmimecast.threats.list_threats_stats_unwantedList threats stats unwantedreadmimecast.threats.list_threats_stats_url_clicksList threats stats URL clicksreadmimecast.threats.update_threat_reporting_subscriptionsUpdate threat reporting subscriptionswrite
Account12
mimecast.account.account_get_accountAccount get accountreadmimecast.account.account_get_dashboard_notificationsAccount get dashboard notificationsreadmimecast.account.account_get_support_infoAccount get support inforeadmimecast.account.config_snapshot_createConfig snapshot createwritemimecast.account.config_snapshot_exportConfig snapshot exportreadmimecast.account.config_snapshot_listConfig snapshot listreadmimecast.account.config_snapshot_restoreConfig snapshot restorewritemimecast.account.get_identity_whoamiGet identity whoamireadmimecast.account.list_account_emergency_contactList account emergency contactreadmimecast.account.provisioning_get_packagesProvisioning get packagesreadmimecast.account.replace_account_emergency_contactReplace account emergency contactwritemimecast.account.update_account_emergency_contactUpdate account emergency contactwrite
Awareness10
mimecast.awareness.awareness_training_company_get_performance_detailsAwareness training company get performance detailsreadmimecast.awareness.awareness_training_company_get_performance_summaryAwareness training company get performance summaryreadmimecast.awareness.awareness_training_company_get_safe_score_detailsAwareness training company get safe score detailsreadmimecast.awareness.awareness_training_company_get_safe_score_summaryAwareness training company get safe score summaryreadmimecast.awareness.awareness_training_company_get_watchlist_detailsAwareness training company get watchlist detailsreadmimecast.awareness.awareness_training_company_get_watchlist_summaryAwareness training company get watchlist summaryreadmimecast.awareness.awareness_training_phishing_campaign_get_campaignAwareness training phishing campaign get campaignreadmimecast.awareness.awareness_training_phishing_campaign_get_user_dataAwareness training phishing campaign get user datareadmimecast.awareness.awareness_training_queue_get_queueAwareness training queue get queuereadmimecast.awareness.awareness_training_user_get_training_detailsAwareness training user get training detailsread
Threat10
mimecast.threat.byo_threat_intelligence_create_batchBYO threat intelligence create batchwritemimecast.threat.byo_threat_intelligence_delete_batchBYO threat intelligence delete batchdestructivemimecast.threat.byo_threat_intelligence_get_batchesBYO threat intelligence get batchesreadmimecast.threat.byo_threat_intelligence_get_quotaBYO threat intelligence get quotareadmimecast.threat.ttp_remediation_createTTP remediation createwritemimecast.threat.ttp_remediation_find_incidentsTTP remediation find incidentsreadmimecast.threat.ttp_remediation_get_incidentTTP remediation get incidentreadmimecast.threat.ttp_remediation_search_hashTTP remediation search hashreadmimecast.threat.ttp_remediation_v2_createTTP remediation v2 createwritemimecast.threat.ttp_threat_intel_get_feedTTP threat intel get feedread
Archive8
mimecast.archive.archive_get_message_detailArchive get message detailreadmimecast.archive.archive_get_message_listArchive get message listreadmimecast.archive.archive_searchArchive searchreadmimecast.archive.dataretention_messages_visibilityDataretention messages visibilitywritemimecast.archive.dataretention_retention_adjustmentDataretention retention adjustmentwritemimecast.archive.dataretention_smart_tags_messagesDataretention smart tags messageswritemimecast.archive.dataretention_smart_tags_messages_searchDataretention smart tags messages searchreadmimecast.archive.list_dataretention_smart_tagsList dataretention smart tagsread
Integration8
mimecast.integration.create_marketplace_integrationsCreate marketplace integrationswritemimecast.integration.delete_marketplace_consent_requestsDelete marketplace consent requestsdestructivemimecast.integration.delete_marketplace_integrationsDelete marketplace integrationsdestructivemimecast.integration.get_marketplace_consent_requestsGet marketplace consent requestsreadmimecast.integration.get_marketplace_integrationsGet marketplace integrationsreadmimecast.integration.list_marketplace_consent_requestsList marketplace consent requestsreadmimecast.integration.list_marketplace_integrationsList marketplace integrationsreadmimecast.integration.update_marketplace_integrationsUpdate marketplace integrationswrite
Audit7
mimecast.audit.archive_get_archive_search_logsArchive get archive search logsreadmimecast.audit.archive_get_search_logsArchive get search logsreadmimecast.audit.archive_get_view_logsArchive get view logsreadmimecast.audit.audit_get_audit_eventsAudit get audit eventsreadmimecast.audit.audit_get_categoriesAudit get categoriesreadmimecast.audit.gateway_get_held_release_logsGateway get held release logsreadmimecast.audit.gateway_get_rejectionsGateway get rejectionsread
CI email7
mimecast.ci_email.create_email_policiesCreate email policieswritemimecast.ci_email.delete_email_policiesDelete email policiesdestructivemimecast.ci_email.email_onboardingEmail onboardingwritemimecast.ci_email.get_email_policiesGet email policiesreadmimecast.ci_email.get_email_policies_default_policyGet email policies default policyreadmimecast.ci_email.update_email_policiesUpdate email policieswritemimecast.ci_email.update_email_policies_default_policyUpdate email policies default policywrite
Human risk7
mimecast.human_risk.individuals_risk_profilesIndividuals risk profilesreadmimecast.human_risk.individuals_searchIndividuals searchreadmimecast.human_risk.list_departmentsList departmentsreadmimecast.human_risk.list_locationsList locationsreadmimecast.human_risk.list_organizationList organizationreadmimecast.human_risk.list_organization_attacksList organization attacksreadmimecast.human_risk.list_organization_behaviorsList organization behaviorsread
Connector5
mimecast.connector.create_connector_connectorsCreate connector connectorswritemimecast.connector.delete_connector_connectorsDelete connector connectorsdestructivemimecast.connector.get_connector_connectorsGet connector connectorsreadmimecast.connector.list_connector_connectorsList connector connectorsreadmimecast.connector.update_connector_connectorsUpdate connector connectorswrite
CI remediation4
mimecast.ci_remediation.get_security_remediation_bulkGet security remediation bulkreadmimecast.ci_remediation.get_security_remediation_eventsGet security remediation eventsreadmimecast.ci_remediation.security_remediation_bulkSecurity remediation bulkwritemimecast.ci_remediation.security_remediation_eventsSecurity remediation eventswrite
Security events4
mimecast.security_events.dlp_get_logsDLP get logsreadmimecast.security_events.ttp_attachment_get_logsTTP attachment get logsreadmimecast.security_events.ttp_impersonation_get_logsTTP impersonation get logsreadmimecast.security_events.ttp_url_get_logsTTP URL get logsread
CI threats2
mimecast.ci_threats.list_siem_batch_events_ciList SIEM batch events CIreadmimecast.ci_threats.list_siem_events_ciList SIEM events CIread
Directory1
mimecast.directory.list_directory_attribute_typesList directory attribute typesread
Onboarding1
mimecast.onboarding.list_role_rolesList role rolesread
Questions
The Mimecast MCP server, answered.
Is there a Mimecast MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 367 Mimecast actions across dmarc, policy, users and gateway, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Mimecast.
What do I need to connect Mimecast?
Mimecast API 2.0 client ID and Mimecast API 2.0 client secret (shown when the API application is created). Plus your tenant host. The free call account { op: "connections.requirements", service: "mimecast" } lists exactly what to paste.
Can an AI agent delete or change things in Mimecast?
Only if its key allows it, and only with an explicit confirmation. 52 Mimecast actions are destructive, including user remove alias, gateway hold reject and directory delete group. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Mimecast API limit?
actionlake paces every call to the limits in the Mimecast service file: 10 calls a second per connection. Repeated reads are answered from cache (188 Mimecast actions can be), which never reaches Mimecast.
What does a Mimecast action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (367 Mimecast actions page). Cache hits, searches, dry runs and calls Mimecast refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Mimecast API does it cover?
The Mimecast API 2.0 (developer.services.mimecast.com OpenAPI 3.0 specs, fetched 2026-10-22) at api.services.mimecast.com by default, or the base URL set when you connect. It is built from Mimecast's documentation as read on 22 October 2026. 367 actions in 20 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Mimecast data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Mimecast credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Mimecast today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
