--- title: "Mimecast MCP server for AI agents - actionlake" description: "Give Claude 367 Mimecast actions through one MCP server: dmarc, policy, users, gateway. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/mimecast updated: 2026-10-22 --- Connectors · Identity & security # Mimecast MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Mimecast and the rest of your systems. It gives your agent 367 Mimecast actions (190 reads, 125 writes and 52 that wait for a confirmation) and holds the Mimecast credential itself, so the agent never does. It paces Mimecast's limits and records every call. [Connect Mimecast free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "mimecast.users.list_user_users", intent: "check which Mimecast account is connected" } # List user users · read · 1 upstream call ``` - 367 actions in one signed file - 190 read look, never change - 125 write create and update - 52 wait for a yes destructive, confirmed first Set up ## Connect Mimecast in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Mimecast. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Mimecast API 2.0 client ID - `client_secret` Mimecast API 2.0 client secret (shown when the API application is created) - `tenant_host` Where your Mimecast lives: your tenant host ``` account { op: "connections.requirements", service: "mimecast" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "mimecast.users.list_user_users" } # list user users · read · 1 upstream call check { action: "mimecast.users.create_user_users", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Mimecast at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_host` **Limits we pace to** 10 calls a second, per connection **API covered** Mimecast API 2.0 (developer.services.mimecast.com OpenAPI 3.0 specs, fetched 2026-10-22)`api.services.mimecast.com` **Built from** Mimecast's documentation, read 22 October 2026[developer.services.mimecast.com](https://developer.services.mimecast.com/portals/api/sites/mimecast-prod-apigee-developer/liveportal/apis/accountmanagement/download_spec) [developer.services.mimecast.com](https://developer.services.mimecast.com/portals/api/sites/mimecast-prod-apigee-developer/liveportal/apis/archivedataaccess/download_spec) [developer.services.mimecast.com](https://developer.services.mimecast.com/portals/api/sites/mimecast-prod-apigee-developer/liveportal/apis/auditevents/download_spec) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 188 of 190 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line Mimecast up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Mimecast. 367 actions in 20 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **190** read look, never change - **125** write create and update - **52** destructive wait for a confirmation 1. ### Dmarc 84 44 read · 25 write · 15 destructive Create domains · Create tasks · Create users · Delegated domains 2. ### Policy 64 23 read · 28 write · 13 destructive Create anti spoofing bypass policies · Create anti spoofing policies · Create blocked senders policies · Create delivery route definitions 3. ### Users 62 18 read · 34 write · 10 destructive List user users · List directory groups · Create user users · Create directory groups 4. ### Gateway 28 14 read · 8 write · 6 destructive Create journaling services · Email get email queues · Email send email · Gateway find held messages 5. ### Domain 22 12 read · 8 write · 2 destructive Domain create domain · Domain get internal domain · Domain get pending domain · Domain get provision status 6. ### Threats 21 18 read · 2 write · 1 destructive List threats events · Create threat reporting subscriptions · List SIEM batch events CG · List SIEM events CG 7. ### Account 12 8 read · 4 write · 0 destructive Account get account · Account get dashboard notifications · Account get support info · Config snapshot create 8. ### Awareness 10 10 read · 0 write · 0 destructive Awareness training company get performance details · Awareness training company get performance summary · Awareness training company get safe score details · Awareness training company get safe score summary **12 more areas · 64 actions** - Threat **10** - Archive **8** - Integration **8** - Audit **7** - CI email **7** - Human risk **7** - Connector **5** - CI remediation **4** - Security events **4** - CI threats **2** - Directory **1** - Onboarding **1** Top actions ## The Mimecast API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 9 of Mimecast's 9 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `mimecast.users.list_user_users` List user users | List user users. | read | `identity.user.list` 474 connectors | | `mimecast.users.list_directory_groups` List directory groups | List directory groups. | read | `identity.group.list` 262 connectors | | `mimecast.users.create_user_users` Create user users | Create user users. | write | `identity.user.create` 262 connectors | | `mimecast.users.create_directory_groups` Create directory groups | Create directory groups. | write | `identity.group.create` 205 connectors | | `mimecast.users.list_directory_groups_members` List directory groups members | List directory groups members. | read | `identity.group_member.list` 103 connectors | | `mimecast.onboarding.list_role_roles` List role roles | List role roles. | read | `identity.role.list` 184 connectors | | `mimecast.audit.audit_get_audit_events` Audit get audit events | Audit get audit events. | read | `identity.audit_event.search` 7 connectors | | `mimecast.threats.list_threats_events` List threats events | List Threat events. | read | `security.threat.list` 7 connectors | | `mimecast.archive.archive_search` Archive search | Archive search. | read | this connector | | `mimecast.users.user_create_user` User create user | User create user. | write | this connector | | `mimecast.gateway.email_send_email` Email send email | Email send email. | write | this connector | | `mimecast.users.user_remove_alias` User remove alias | User remove alias. | destructive | this connector | Try it ## Prompts to paste into Claude. Each one names the Mimecast actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in Mimecast? List every user and their role. calls `mimecast.users.list_user_users` 2. Write write Create user users in Mimecast. Show me exactly what you will send before you save it. calls `mimecast.users.create_user_users` Governance for Mimecast ## Destructive actions wait for a yes. 52 Mimecast actions are destructive. The first 10: - User remove alias `mimecast.users.user_remove_alias` - Gateway hold reject `mimecast.gateway.gateway_hold_reject` - Directory delete group `mimecast.users.directory_delete_group` - User add to purge list `mimecast.users.user_add_to_purge_list` - User remove delegate user `mimecast.users.user_remove_delegate_user` - TTP URL delete managed URL `mimecast.policy.ttp_url_delete_managed_url` - User remove from purge list `mimecast.users.user_remove_from_purge_list` - Delete journaling services `mimecast.gateway.delete_journaling_services` - Delete greylisting policies `mimecast.policy.delete_greylisting_policies` - Domain delete pending domain `mimecast.domain.domain_delete_pending_domain` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do mimecast.gateway.delete_journaling_services confirm_policy: **human** Delete journaling services? **intent:** the user asked me to delete journaling services run suspended · waiting for a named person · key _mimecast-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "mimecast-agent", allowed_actions: ["mimecast.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "mimecast.users.user_remove_alias", approver: "lead@example.com" }, { match: "mimecast.gateway.gateway_hold_reject", approver: "lead@example.com" }, { match: "mimecast.users.directory_delete_group", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Mimecast only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Mimecast costs on actionlake. Every Mimecast action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Mimecast refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 367 Mimecast actions - 367 actions page each page of a long list is one call - 188 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Mimecast action. 367 actions by area: the id your agent calls, what it does, and its effect. **Dmarc 84** - `mimecast.dmarc.create_domains` Create domains write - `mimecast.dmarc.create_tasks` Create tasks write - `mimecast.dmarc.create_users` Create users write - `mimecast.dmarc.delegated_domains` Delegated domains write - `mimecast.dmarc.delegated_domains_dkim` Delegated domains DKIM write - `mimecast.dmarc.delegated_domains_dmarc` Delegated domains DMARC write - `mimecast.dmarc.delete_customers_encryption_key` Delete customers encryption key destructive - `mimecast.dmarc.delete_delegated_domains` Delete delegated domains destructive - `mimecast.dmarc.delete_delegated_domains_dkim` Delete delegated domains DKIM destructive - `mimecast.dmarc.delete_delegated_domains_dkim_by_selector` Delete delegated domains DKIM by selector destructive - `mimecast.dmarc.delete_delegated_domains_dmarc` Delete delegated domains DMARC destructive - `mimecast.dmarc.delete_delegated_domains_spf` Delete delegated domains SPF destructive - `mimecast.dmarc.delete_dmarc_policy_preset` Delete DMARC policy preset destructive - `mimecast.dmarc.delete_domain_groups` Delete domain groups destructive - `mimecast.dmarc.delete_domain_groups_association` Delete domain groups association destructive - `mimecast.dmarc.delete_domains` Delete domains destructive - `mimecast.dmarc.delete_issues` Delete issues destructive - `mimecast.dmarc.delete_notifications` Delete notifications destructive - `mimecast.dmarc.delete_sources_vendors_associations` Delete sources vendors associations destructive - `mimecast.dmarc.delete_tasks` Delete tasks destructive - `mimecast.dmarc.delete_users` Delete users destructive - `mimecast.dmarc.dmarc_policy_preset` DMARC policy preset write - `mimecast.dmarc.domain_groups` Domain groups write - `mimecast.dmarc.domain_groups_association` Domain groups association write - `mimecast.dmarc.domains_refresh_dns` Domains refresh DNS write - `mimecast.dmarc.get_compliance_dmarc_statistics` Get compliance DMARC statistics read - `mimecast.dmarc.get_compliance_domains_dmarc_policy_changes` Get compliance domains DMARC policy changes read - `mimecast.dmarc.get_customers` Get customers read - `mimecast.dmarc.get_customers_encryption_key` Get customers encryption key read - `mimecast.dmarc.get_delegated_domains_dkim` Get delegated domains DKIM read - `mimecast.dmarc.get_delegated_domains_dkim_details` Get delegated domains DKIM details read - `mimecast.dmarc.get_delegated_domains_dmarc` Get delegated domains DMARC read - `mimecast.dmarc.get_delegated_domains_spf` Get delegated domains SPF read - `mimecast.dmarc.get_delegated_domains_spf_details` Get delegated domains SPF details read - `mimecast.dmarc.get_delegated_domains_statistics` Get delegated domains statistics read - `mimecast.dmarc.get_domain_groups` Get domain groups read - `mimecast.dmarc.get_domains` Get domains read - `mimecast.dmarc.get_domains_statistics` Get domains statistics read - `mimecast.dmarc.get_domains_vendor_configurations` Get domains vendor configurations read - `mimecast.dmarc.get_notifications` Get notifications read - `mimecast.dmarc.get_report_metadata` Get report metadata read - `mimecast.dmarc.get_reports_results` Get reports results read - `mimecast.dmarc.get_sources_vendors` Get sources vendors read - `mimecast.dmarc.get_tasks` Get tasks read - `mimecast.dmarc.get_users` Get users read - `mimecast.dmarc.list_compliance_domains_dns_suggestions` List compliance domains DNS suggestions read - `mimecast.dmarc.list_compliance_domains_enforcement` List compliance domains enforcement read - `mimecast.dmarc.list_delegated_domains` List delegated domains read - `mimecast.dmarc.list_delegated_domains_dkim` List delegated domains DKIM read - `mimecast.dmarc.list_detected_domains` List detected domains read - `mimecast.dmarc.list_dmarc_policy_preset` List DMARC policy preset read - `mimecast.dmarc.list_dns_bimi` List DNS BIMI read - `mimecast.dmarc.list_dns_dkim` List DNS DKIM read - `mimecast.dmarc.list_dns_dmarc` List DNS DMARC read - `mimecast.dmarc.list_dns_spf` List DNS SPF read - `mimecast.dmarc.list_domain_groups` List domain groups read - `mimecast.dmarc.list_domains` List domains read - `mimecast.dmarc.list_events` List events read - `mimecast.dmarc.list_issues` List issues read - `mimecast.dmarc.list_notifications` List notifications read - `mimecast.dmarc.list_sources` List sources read - `mimecast.dmarc.list_sources_compliance_actions` List sources compliance actions read - `mimecast.dmarc.list_sources_compliance_statistics` List sources compliance statistics read - `mimecast.dmarc.list_sources_vendors` List sources vendors read - `mimecast.dmarc.list_tasks` List tasks read - `mimecast.dmarc.list_tasks_summary` List tasks summary read - `mimecast.dmarc.list_users` List users read - `mimecast.dmarc.list_users_current_user` List users current user read - `mimecast.dmarc.notifications` Notifications write - `mimecast.dmarc.replace_customers_encryption_key` Replace customers encryption key write - `mimecast.dmarc.replace_delegated_domains_dkim` Replace delegated domains DKIM write - `mimecast.dmarc.replace_delegated_domains_spf` Replace delegated domains SPF write - `mimecast.dmarc.replace_detected_domains_status` Replace detected domains status write - `mimecast.dmarc.replace_dmarc_policy_preset` Replace DMARC policy preset write - `mimecast.dmarc.replace_domain_groups` Replace domain groups write - `mimecast.dmarc.replace_notifications` Replace notifications write - `mimecast.dmarc.replace_tasks` Replace tasks write - `mimecast.dmarc.replace_users` Replace users write - `mimecast.dmarc.reports` Reports read - `mimecast.dmarc.sources_vendors_associations` Sources vendors associations write - `mimecast.dmarc.update_detected_domains` Update detected domains write - `mimecast.dmarc.update_domains` Update domains write - `mimecast.dmarc.update_sources_vendors` Update sources vendors write - `mimecast.dmarc.update_tasks` Update tasks write **Policy 64** - `mimecast.policy.create_anti_spoofing_bypass_policies` Create anti spoofing bypass policies write - `mimecast.policy.create_anti_spoofing_policies` Create anti spoofing policies write - `mimecast.policy.create_blocked_senders_policies` Create blocked senders policies write - `mimecast.policy.create_delivery_route_definitions` Create delivery route definitions write - `mimecast.policy.create_delivery_route_policies` Create delivery route policies write - `mimecast.policy.create_dns_authentication_outbound_definitions` Create DNS authentication outbound definitions write - `mimecast.policy.create_dns_authentication_outbound_policies` Create DNS authentication outbound policies write - `mimecast.policy.create_greylisting_policies` Create greylisting policies write - `mimecast.policy.delete_anti_spoofing_bypass_policies` Delete anti spoofing bypass policies destructive - `mimecast.policy.delete_anti_spoofing_policies` Delete anti spoofing policies destructive - `mimecast.policy.delete_blocked_senders_policies` Delete blocked senders policies destructive - `mimecast.policy.delete_delivery_route_definitions` Delete delivery route definitions destructive - `mimecast.policy.delete_delivery_route_policies` Delete delivery route policies destructive - `mimecast.policy.delete_dns_authentication_outbound_definitions` Delete DNS authentication outbound definitions destructive - `mimecast.policy.delete_dns_authentication_outbound_policies` Delete DNS authentication outbound policies destructive - `mimecast.policy.delete_greylisting_policies` Delete greylisting policies destructive - `mimecast.policy.delivery_route_verify` Delivery route verify write - `mimecast.policy.dns_authentication_outbound_definitions_verify` DNS authentication outbound definitions verify write - `mimecast.policy.get_anti_spoofing_bypass_policies` Get anti spoofing bypass policies read - `mimecast.policy.get_anti_spoofing_policies` Get anti spoofing policies read - `mimecast.policy.get_blocked_senders_policies` Get blocked senders policies read - `mimecast.policy.get_delivery_route_definitions` Get delivery route definitions read - `mimecast.policy.get_delivery_route_policies` Get delivery route policies read - `mimecast.policy.get_dns_authentication_outbound_definitions` Get DNS authentication outbound definitions read - `mimecast.policy.get_dns_authentication_outbound_policies` Get DNS authentication outbound policies read - `mimecast.policy.get_greylisting_policies` Get greylisting policies read - `mimecast.policy.list_anti_spoofing_bypass_policies` List anti spoofing bypass policies read - `mimecast.policy.list_anti_spoofing_policies` List anti spoofing policies read - `mimecast.policy.list_blocked_senders_policies` List blocked senders policies read - `mimecast.policy.list_delivery_route_definitions` List delivery route definitions read - `mimecast.policy.list_delivery_route_policies` List delivery route policies read - `mimecast.policy.list_dns_authentication_outbound_definitions` List DNS authentication outbound definitions read - `mimecast.policy.list_dns_authentication_outbound_policies` List DNS authentication outbound policies read - `mimecast.policy.list_greylisting_policies` List greylisting policies read - `mimecast.policy.policy_address_alteration_create_address_alteration_set` Policy address alteration create address alteration set write - `mimecast.policy.policy_address_alteration_create_definition` Policy address alteration create definition write - `mimecast.policy.policy_address_alteration_create_policy` Policy address alteration create policy write - `mimecast.policy.policy_address_alteration_delete_definition` Policy address alteration delete definition destructive - `mimecast.policy.policy_address_alteration_delete_policy` Policy address alteration delete policy destructive - `mimecast.policy.policy_address_alteration_get_address_alteration_set` Policy address alteration get address alteration set read - `mimecast.policy.policy_address_alteration_get_definition` Policy address alteration get definition read - `mimecast.policy.policy_address_alteration_get_policy` Policy address alteration get policy read - `mimecast.policy.policy_address_alteration_update_policy` Policy address alteration update policy write - `mimecast.policy.policy_antispoofing_bypass_create_policy` Policy antispoofing bypass create policy write - `mimecast.policy.policy_antispoofing_bypass_delete_policy` Policy antispoofing bypass delete policy destructive - `mimecast.policy.policy_antispoofing_bypass_get_policy` Policy antispoofing bypass get policy read - `mimecast.policy.policy_antispoofing_bypass_update_policy` Policy antispoofing bypass update policy write - `mimecast.policy.policy_blockedsenders_create_policy` Policy blockedsenders create policy write - `mimecast.policy.policy_blockedsenders_get_policy` Policy blockedsenders get policy read - `mimecast.policy.policy_webwhiteurl_create_policy_with_targets` Policy webwhiteurl create policy with targets write - `mimecast.policy.policy_webwhiteurl_delete_policy_with_targets` Policy webwhiteurl delete policy with targets destructive - `mimecast.policy.policy_webwhiteurl_get_policy_with_targets` Policy webwhiteurl get policy with targets read - `mimecast.policy.policy_webwhiteurl_update_policy_with_targets` Policy webwhiteurl update policy with targets write - `mimecast.policy.ttp_url_create_managed_url` TTP URL create managed URL write - `mimecast.policy.ttp_url_delete_managed_url` TTP URL delete managed URL destructive - `mimecast.policy.ttp_url_get_all_managed_urls` TTP URL get all managed URLs read - `mimecast.policy.update_anti_spoofing_bypass_policies` Update anti spoofing bypass policies write - `mimecast.policy.update_anti_spoofing_policies` Update anti spoofing policies write - `mimecast.policy.update_blocked_senders_policies` Update blocked senders policies write - `mimecast.policy.update_delivery_route_definitions` Update delivery route definitions write - `mimecast.policy.update_delivery_route_policies` Update delivery route policies write - `mimecast.policy.update_dns_authentication_outbound_definitions` Update DNS authentication outbound definitions write - `mimecast.policy.update_dns_authentication_outbound_policies` Update DNS authentication outbound policies write - `mimecast.policy.update_greylisting_policies` Update greylisting policies write **Users 62** - `mimecast.users.attribute_find_attribute_types` Attribute find attribute types read - `mimecast.users.create_directory_groups` Create directory groups write - `mimecast.users.create_directory_groups_members` Create directory groups members write - `mimecast.users.create_user_users` Create user users write - `mimecast.users.delete_directory_integrations_active_directory` Delete directory integrations active directory destructive - `mimecast.users.delete_directory_integrations_google` Delete directory integrations google destructive - `mimecast.users.delete_directory_integrations_m365` Delete directory integrations M365 destructive - `mimecast.users.directory_add_group_member` Directory add group member write - `mimecast.users.directory_create_group` Directory create group write - `mimecast.users.directory_delete_group` Directory delete group destructive - `mimecast.users.directory_execute_sync` Directory execute sync write - `mimecast.users.directory_find_groups` Directory find groups read - `mimecast.users.directory_get_connection` Directory get connection read - `mimecast.users.directory_get_group_members` Directory get group members read - `mimecast.users.directory_groups_remove_members` Directory groups remove members destructive - `mimecast.users.directory_integrations_active_directory` Directory integrations active directory write - `mimecast.users.directory_integrations_active_directory_test_authentication` Directory integrations active directory test authentication write - `mimecast.users.directory_integrations_active_directory_test_certificates` Directory integrations active directory test certificates write - `mimecast.users.directory_integrations_active_directory_test_connectivity` Directory integrations active directory test connectivity write - `mimecast.users.directory_integrations_active_directory_test_egress_connectivity` Directory integrations active directory test egress connectivity write - `mimecast.users.directory_integrations_active_directory_test_email` Directory integrations active directory test email write - `mimecast.users.directory_integrations_active_directory_test_validation` Directory integrations active directory test validation write - `mimecast.users.directory_integrations_google` Directory integrations google write - `mimecast.users.directory_integrations_google_test_authentication` Directory integrations google test authentication write - `mimecast.users.directory_integrations_google_test_authorisation` Directory integrations google test authorisation write - `mimecast.users.directory_integrations_google_test_connectivity` Directory integrations google test connectivity write - `mimecast.users.directory_integrations_google_test_email` Directory integrations google test email write - `mimecast.users.directory_integrations_m365` Directory integrations M365 write - `mimecast.users.directory_integrations_m365_test_authentication` Directory integrations M365 test authentication write - `mimecast.users.directory_integrations_m365_test_authorisation` Directory integrations M365 test authorisation write - `mimecast.users.directory_integrations_m365_test_connectivity` Directory integrations M365 test connectivity write - `mimecast.users.directory_integrations_m365_test_connector` Directory integrations M365 test connector write - `mimecast.users.directory_integrations_m365_test_email` Directory integrations M365 test email write - `mimecast.users.directory_integrations_sync_requests` Directory integrations sync requests write - `mimecast.users.directory_remove_group_member` Directory remove group member destructive - `mimecast.users.directory_update_group` Directory update group write - `mimecast.users.get_directory_groups` Get directory groups read - `mimecast.users.get_directory_integrations_active_directory` Get directory integrations active directory read - `mimecast.users.get_directory_integrations_google` Get directory integrations google read - `mimecast.users.get_directory_integrations_m365` Get directory integrations M365 read - `mimecast.users.list_directory_groups` List directory groups read - `mimecast.users.list_directory_groups_members` List directory groups members read - `mimecast.users.list_directory_integrations` List directory integrations read - `mimecast.users.list_user_users` List user users read - `mimecast.users.update_directory_integrations_active_directory` Update directory integrations active directory write - `mimecast.users.update_directory_integrations_google` Update directory integrations google write - `mimecast.users.update_directory_integrations_m365` Update directory integrations M365 write - `mimecast.users.user_add_delegate_user` User add delegate user write - `mimecast.users.user_add_to_purge_list` User add to purge list destructive - `mimecast.users.user_create_user` User create user write - `mimecast.users.user_find_delegate_users` User find delegate users read - `mimecast.users.user_get_aliases` User get aliases read - `mimecast.users.user_get_attributes` User get attributes read - `mimecast.users.user_get_import_status` User get import status read - `mimecast.users.user_get_internal_users` User get internal users read - `mimecast.users.user_get_most_used_contacts` User get most used contacts read - `mimecast.users.user_remove_alias` User remove alias destructive - `mimecast.users.user_remove_delegate_user` User remove delegate user destructive - `mimecast.users.user_remove_from_purge_list` User remove from purge list destructive - `mimecast.users.user_update_alias` User update alias write - `mimecast.users.user_update_attributes` User update attributes write - `mimecast.users.user_update_user` User update user write **Gateway 28** - `mimecast.gateway.create_journaling_services` Create journaling services write - `mimecast.gateway.delete_email_outbound_ip_addresses` Delete email outbound IP addresses destructive - `mimecast.gateway.delete_journaling_services` Delete journaling services destructive - `mimecast.gateway.email_get_email_queues` Email get email queues read - `mimecast.gateway.email_managed_senders_internal_addresses_bulk_delete` Email managed senders internal addresses bulk delete destructive - `mimecast.gateway.email_managed_senders_recipients_bulk_delete` Email managed senders recipients bulk delete destructive - `mimecast.gateway.email_managed_senders_senders_bulk_delete` Email managed senders senders bulk delete destructive - `mimecast.gateway.email_send_email` Email send email write - `mimecast.gateway.gateway_find_held_messages` Gateway find held messages read - `mimecast.gateway.gateway_find_processing_messages` Gateway find processing messages read - `mimecast.gateway.gateway_get_hold_message_list` Gateway get hold message list read - `mimecast.gateway.gateway_get_hold_summary_list` Gateway get hold summary list read - `mimecast.gateway.gateway_hold_reject` Gateway hold reject destructive - `mimecast.gateway.gateway_hold_release` Gateway hold release write - `mimecast.gateway.get_email_gateway_details` Get email gateway details read - `mimecast.gateway.get_email_statistics` Get email statistics read - `mimecast.gateway.get_journaling_services` Get journaling services read - `mimecast.gateway.journaling_get_service` Journaling get service read - `mimecast.gateway.list_email_outbound_ip_addresses` List email outbound IP addresses read - `mimecast.gateway.list_journaling_services` List journaling services read - `mimecast.gateway.managedsender_permit_or_block_sender` Managedsender permit or block sender write - `mimecast.gateway.message_finder_get_message_info` Message finder get message info read - `mimecast.gateway.message_finder_search` Message finder search read - `mimecast.gateway.replace_email_outbound_ip_addresses` Replace email outbound IP addresses write - `mimecast.gateway.ttp_url_decode_url` TTP URL decode URL read - `mimecast.gateway.update_email_gateway_details` Update email gateway details write - `mimecast.gateway.update_email_protection_mode` Update email protection mode write - `mimecast.gateway.update_journaling_services` Update journaling services write **Domain 22** - `mimecast.domain.delete_domain_pending_domains` Delete domain pending domains destructive - `mimecast.domain.domain_create_domain` Domain create domain write - `mimecast.domain.domain_delete_pending_domain` Domain delete pending domain destructive - `mimecast.domain.domain_get_internal_domain` Domain get internal domain read - `mimecast.domain.domain_get_pending_domain` Domain get pending domain read - `mimecast.domain.domain_get_provision_status` Domain get provision status read - `mimecast.domain.domain_get_verification_code` Domain get verification code read - `mimecast.domain.domain_internal_domains_m365_register` Domain internal domains M365 register write - `mimecast.domain.domain_internal_domains_verify` Domain internal domains verify write - `mimecast.domain.domain_pending_domains` Domain pending domains write - `mimecast.domain.domain_pending_domains_generate_token` Domain pending domains generate token write - `mimecast.domain.domain_pending_domains_verify` Domain pending domains verify write - `mimecast.domain.domain_verify_domain` Domain verify domain write - `mimecast.domain.get_domain_external_domains` Get domain external domains read - `mimecast.domain.get_domain_internal_domains` Get domain internal domains read - `mimecast.domain.get_domain_internal_domains_dns_records` Get domain internal domains DNS records read - `mimecast.domain.get_domain_pending_domains` Get domain pending domains read - `mimecast.domain.list_domain_external_domains` List domain external domains read - `mimecast.domain.list_domain_internal_domains` List domain internal domains read - `mimecast.domain.list_domain_internal_domains_m365_lookup` List domain internal domains M365 lookup read - `mimecast.domain.list_domain_pending_domains` List domain pending domains read - `mimecast.domain.update_domain_internal_domains` Update domain internal domains write **Threats 21** - `mimecast.threats.create_threat_reporting_subscriptions` Create threat reporting subscriptions write - `mimecast.threats.delete_threat_reporting_subscriptions` Delete threat reporting subscriptions destructive - `mimecast.threats.get_threat_reporting_reported_emails` Get threat reporting reported emails read - `mimecast.threats.get_threat_reporting_reported_emails_by_reported_message_aggregate_id` Get threat reporting reported emails by reported message aggregate ID read - `mimecast.threats.get_threat_reporting_threat_analysis` Get threat reporting threat analysis read - `mimecast.threats.get_threats_events_details` Get threats events details read - `mimecast.threats.list_siem_batch_events_cg` List SIEM batch events CG read - `mimecast.threats.list_siem_events_cg` List SIEM events CG read - `mimecast.threats.list_threat_reporting_subscriptions` List threat reporting subscriptions read - `mimecast.threats.list_threat_reporting_threat_reports` List threat reporting threat reports read - `mimecast.threats.list_threats_events` List threats events read - `mimecast.threats.list_threats_stats_attachment_scans` List threats stats attachment scans read - `mimecast.threats.list_threats_stats_gateway_detections` List threats stats gateway detections read - `mimecast.threats.list_threats_stats_impersonations` List threats stats impersonations read - `mimecast.threats.list_threats_stats_phishing` List threats stats phishing read - `mimecast.threats.list_threats_stats_suspicious` List threats stats suspicious read - `mimecast.threats.list_threats_stats_threats_by_recipient` List threats stats threats by recipient read - `mimecast.threats.list_threats_stats_threats_by_sender` List threats stats threats by sender read - `mimecast.threats.list_threats_stats_unwanted` List threats stats unwanted read - `mimecast.threats.list_threats_stats_url_clicks` List threats stats URL clicks read - `mimecast.threats.update_threat_reporting_subscriptions` Update threat reporting subscriptions write **Account 12** - `mimecast.account.account_get_account` Account get account read - `mimecast.account.account_get_dashboard_notifications` Account get dashboard notifications read - `mimecast.account.account_get_support_info` Account get support info read - `mimecast.account.config_snapshot_create` Config snapshot create write - `mimecast.account.config_snapshot_export` Config snapshot export read - `mimecast.account.config_snapshot_list` Config snapshot list read - `mimecast.account.config_snapshot_restore` Config snapshot restore write - `mimecast.account.get_identity_whoami` Get identity whoami read - `mimecast.account.list_account_emergency_contact` List account emergency contact read - `mimecast.account.provisioning_get_packages` Provisioning get packages read - `mimecast.account.replace_account_emergency_contact` Replace account emergency contact write - `mimecast.account.update_account_emergency_contact` Update account emergency contact write **Awareness 10** - `mimecast.awareness.awareness_training_company_get_performance_details` Awareness training company get performance details read - `mimecast.awareness.awareness_training_company_get_performance_summary` Awareness training company get performance summary read - `mimecast.awareness.awareness_training_company_get_safe_score_details` Awareness training company get safe score details read - `mimecast.awareness.awareness_training_company_get_safe_score_summary` Awareness training company get safe score summary read - `mimecast.awareness.awareness_training_company_get_watchlist_details` Awareness training company get watchlist details read - `mimecast.awareness.awareness_training_company_get_watchlist_summary` Awareness training company get watchlist summary read - `mimecast.awareness.awareness_training_phishing_campaign_get_campaign` Awareness training phishing campaign get campaign read - `mimecast.awareness.awareness_training_phishing_campaign_get_user_data` Awareness training phishing campaign get user data read - `mimecast.awareness.awareness_training_queue_get_queue` Awareness training queue get queue read - `mimecast.awareness.awareness_training_user_get_training_details` Awareness training user get training details read **Threat 10** - `mimecast.threat.byo_threat_intelligence_create_batch` BYO threat intelligence create batch write - `mimecast.threat.byo_threat_intelligence_delete_batch` BYO threat intelligence delete batch destructive - `mimecast.threat.byo_threat_intelligence_get_batches` BYO threat intelligence get batches read - `mimecast.threat.byo_threat_intelligence_get_quota` BYO threat intelligence get quota read - `mimecast.threat.ttp_remediation_create` TTP remediation create write - `mimecast.threat.ttp_remediation_find_incidents` TTP remediation find incidents read - `mimecast.threat.ttp_remediation_get_incident` TTP remediation get incident read - `mimecast.threat.ttp_remediation_search_hash` TTP remediation search hash read - `mimecast.threat.ttp_remediation_v2_create` TTP remediation v2 create write - `mimecast.threat.ttp_threat_intel_get_feed` TTP threat intel get feed read **Archive 8** - `mimecast.archive.archive_get_message_detail` Archive get message detail read - `mimecast.archive.archive_get_message_list` Archive get message list read - `mimecast.archive.archive_search` Archive search read - `mimecast.archive.dataretention_messages_visibility` Dataretention messages visibility write - `mimecast.archive.dataretention_retention_adjustment` Dataretention retention adjustment write - `mimecast.archive.dataretention_smart_tags_messages` Dataretention smart tags messages write - `mimecast.archive.dataretention_smart_tags_messages_search` Dataretention smart tags messages search read - `mimecast.archive.list_dataretention_smart_tags` List dataretention smart tags read **Integration 8** - `mimecast.integration.create_marketplace_integrations` Create marketplace integrations write - `mimecast.integration.delete_marketplace_consent_requests` Delete marketplace consent requests destructive - `mimecast.integration.delete_marketplace_integrations` Delete marketplace integrations destructive - `mimecast.integration.get_marketplace_consent_requests` Get marketplace consent requests read - `mimecast.integration.get_marketplace_integrations` Get marketplace integrations read - `mimecast.integration.list_marketplace_consent_requests` List marketplace consent requests read - `mimecast.integration.list_marketplace_integrations` List marketplace integrations read - `mimecast.integration.update_marketplace_integrations` Update marketplace integrations write **Audit 7** - `mimecast.audit.archive_get_archive_search_logs` Archive get archive search logs read - `mimecast.audit.archive_get_search_logs` Archive get search logs read - `mimecast.audit.archive_get_view_logs` Archive get view logs read - `mimecast.audit.audit_get_audit_events` Audit get audit events read - `mimecast.audit.audit_get_categories` Audit get categories read - `mimecast.audit.gateway_get_held_release_logs` Gateway get held release logs read - `mimecast.audit.gateway_get_rejections` Gateway get rejections read **CI email 7** - `mimecast.ci_email.create_email_policies` Create email policies write - `mimecast.ci_email.delete_email_policies` Delete email policies destructive - `mimecast.ci_email.email_onboarding` Email onboarding write - `mimecast.ci_email.get_email_policies` Get email policies read - `mimecast.ci_email.get_email_policies_default_policy` Get email policies default policy read - `mimecast.ci_email.update_email_policies` Update email policies write - `mimecast.ci_email.update_email_policies_default_policy` Update email policies default policy write **Human risk 7** - `mimecast.human_risk.individuals_risk_profiles` Individuals risk profiles read - `mimecast.human_risk.individuals_search` Individuals search read - `mimecast.human_risk.list_departments` List departments read - `mimecast.human_risk.list_locations` List locations read - `mimecast.human_risk.list_organization` List organization read - `mimecast.human_risk.list_organization_attacks` List organization attacks read - `mimecast.human_risk.list_organization_behaviors` List organization behaviors read **Connector 5** - `mimecast.connector.create_connector_connectors` Create connector connectors write - `mimecast.connector.delete_connector_connectors` Delete connector connectors destructive - `mimecast.connector.get_connector_connectors` Get connector connectors read - `mimecast.connector.list_connector_connectors` List connector connectors read - `mimecast.connector.update_connector_connectors` Update connector connectors write **CI remediation 4** - `mimecast.ci_remediation.get_security_remediation_bulk` Get security remediation bulk read - `mimecast.ci_remediation.get_security_remediation_events` Get security remediation events read - `mimecast.ci_remediation.security_remediation_bulk` Security remediation bulk write - `mimecast.ci_remediation.security_remediation_events` Security remediation events write **Security events 4** - `mimecast.security_events.dlp_get_logs` DLP get logs read - `mimecast.security_events.ttp_attachment_get_logs` TTP attachment get logs read - `mimecast.security_events.ttp_impersonation_get_logs` TTP impersonation get logs read - `mimecast.security_events.ttp_url_get_logs` TTP URL get logs read **CI threats 2** - `mimecast.ci_threats.list_siem_batch_events_ci` List SIEM batch events CI read - `mimecast.ci_threats.list_siem_events_ci` List SIEM events CI read **Directory 1** - `mimecast.directory.list_directory_attribute_types` List directory attribute types read **Onboarding 1** - `mimecast.onboarding.list_role_roles` List role roles read Questions ## The Mimecast MCP server, answered. **Is there a Mimecast MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 367 Mimecast actions across dmarc, policy, users and gateway, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Mimecast. **What do I need to connect Mimecast?** Mimecast API 2.0 client ID and Mimecast API 2.0 client secret (shown when the API application is created). Plus your tenant host. The free call account { op: "connections.requirements", service: "mimecast" } lists exactly what to paste. **Can an AI agent delete or change things in Mimecast?** Only if its key allows it, and only with an explicit confirmation. 52 Mimecast actions are destructive, including user remove alias, gateway hold reject and directory delete group. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Mimecast API limit?** actionlake paces every call to the limits in the Mimecast service file: 10 calls a second per connection. Repeated reads are answered from cache (188 Mimecast actions can be), which never reaches Mimecast. **What does a Mimecast action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (367 Mimecast actions page). Cache hits, searches, dry runs and calls Mimecast refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Mimecast API does it cover?** The Mimecast API 2.0 (developer.services.mimecast.com OpenAPI 3.0 specs, fetched 2026-10-22) at api.services.mimecast.com by default, or the base URL set when you connect. It is built from Mimecast's documentation as read on 22 October 2026. 367 actions in 20 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Mimecast data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Mimecast credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Mimecast Shares the most action names with - [BeyondTrust Password Safe 7](https://actionlake.com/connectors/beyondtrust-password-safe) - [Cloudflare 6](https://actionlake.com/connectors/cloudflare) - [Bitwarden 6](https://actionlake.com/connectors/bitwarden) - [Zscaler Internet Access (ZIA) 5](https://actionlake.com/connectors/zscaler-internet-access-zia) - [Descope 4](https://actionlake.com/connectors/descope) - [Rubrik Security Cloud 3](https://actionlake.com/connectors/rubrik-security-cloud) Joins with, on shared entities - [HaloPSA 2](https://actionlake.com/connectors/halopsa) - [Slack 2](https://actionlake.com/connectors/slack) - [ServiceNow 2](https://actionlake.com/connectors/servicenow) - [Fortinet FortiGate 2](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx) - [Commvault Cloud 2](https://actionlake.com/connectors/commvault-cloud) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Mimecast; the name is the vendor's own. Counts are from the Mimecast service file, version 1.0.0. ## Give your agent Mimecast today. [Connect Mimecast free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/mimecast More: https://actionlake.com/llms.txt