--- title: "Proofpoint Essentials MCP server for AI agents - actionlake" description: "Give Claude 77 Proofpoint Essentials actions through one MCP server: users, domains, dkim. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/proofpoint-essentials updated: 2026-10-23 --- Connectors · MSP & PSA # Proofpoint Essentials MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Proofpoint Essentials and the rest of your systems. It gives your agent 77 Proofpoint Essentials actions (33 reads, 30 writes and 14 that wait for a confirmation) and holds the Proofpoint Essentials credential itself, so the agent never does. It paces Proofpoint Essentials's limits and records every call. [Connect Proofpoint Essentials free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "proofpoint_essentials.me.get", intent: "check which Proofpoint Essentials account is connected" } # Read metadata about the currently logged in User · read · 1 upstream call ``` - 77 actions in one signed file - 33 read look, never change - 30 write create and update - 14 wait for a yes destructive, confirmed first Set up ## Connect Proofpoint Essentials in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Proofpoint Essentials. Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `username` Proofpoint Essentials admin user (the email address you sign in with) - `password` That admin user's Proofpoint Essentials password (sent as the X-Password header) - `host` Where your Proofpoint Essentials lives: your host ``` account { op: "connections.requirements", service: "proofpoint_essentials" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "proofpoint_essentials.me.get" } # read metadata about the currently logged in user · read · 1 upstream call check { action: "proofpoint_essentials.users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Proofpoint Essentials at a glance **Sign-in** Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `username` `password` **Setup fields** `host` **Limits we pace to** 5 calls a second, per connection **API covered** Proofpoint Essentials Interface API v1 (OpenAPI 3.0.0), at your Proofpoint Essentials instance's API base URL, which you enter when connecting **Built from** Proofpoint Essentials's documentation, read 23 October 2026[us1.proofpointessentials.com](https://us1.proofpointessentials.com/apidocs/apidocs/docs) [us1.proofpointessentials.com](https://us1.proofpointessentials.com/api/v1/docs/specification.php) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 33 of 33 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 3, so ask can line Proofpoint Essentials up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Proofpoint Essentials. 77 actions in 22 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **33** read look, never change - **30** write create and update - **14** destructive wait for a confirmation 1. ### Users 9 3 read · 4 write · 2 destructive Read all Users belonging to an Organization · Create a new User. Batch POST supported with list of User objects · Read a User belonging to an Organization · Update a User belonging to an Organization 2. ### Domains 8 4 read · 3 write · 1 destructive Create a new Domain. Batch POST supported with list of Domain objects · Read all domains associated with an Organization · Read a single Domain associated with an Organization · Update a Domain associated with an Organization 3. ### Dkim 6 2 read · 2 write · 2 destructive Create a DKIM keypair · Read DKIM Signing data for all keypairs associated with this domain · Read DKIM Signing data for a single keypair by selector name · Delete a DKIM keypair by selector name 4. ### Email tagging 6 2 read · 3 write · 1 destructive Create Email Tagging Exempt Senders for an Organization · Retrieve Email Tagging Exempt Senders · Read email tagging settings for an Organization · Update email tagging settings for an Organization 5. ### Idps 5 2 read · 2 write · 1 destructive Read a list of all Identity Providers (IDPs) for the target Organization · Create a new Identity Provider (IDP) · Read a single Identity Provider (IDP) · Update an Identity Provider (IDP) 6. ### Orgs 5 2 read · 2 write · 1 destructive Read an Organization and its child Organizations · Create a new Organization. Batch POST supported with list of Organization objects · Read an Organization · Update an Organization 7. ### Products 5 2 read · 2 write · 1 destructive Read a list of Products applicable to an Organization. Includes both available and purchased products · Used to purchase a Product · Read a single Product by Label · Update a Product 8. ### Azure sync exemptions 4 1 read · 1 write · 2 destructive List of Sync Exemptions for an organization · Add to organizations Sync Exemptions · Delete one Sync Exemption belonging to organization · Delete all organizations Sync Exemptions **14 more areas · 29 actions** - Groups **4** - Sender lists **4** - Azure settings **3** - Billing **2** - Features **2** - Licensing **2** - Login settings **2** - Mfa settings **2** - Reporting **2** - Stats **2** - Endpoints **1** - Me **1** - Package **1** - Tokens **1** Top actions ## The Proofpoint Essentials API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 21 of Proofpoint Essentials's 21 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `proofpoint_essentials.users.list` Read all Users belonging to an Organization | Read all Users belonging to an Organization. | read | `identity.user.list` 474 connectors | | `proofpoint_essentials.me.get` Read metadata about the currently logged in User | Read metadata about the currently logged in User. | read | `identity.current_user.get` 307 connectors | | `proofpoint_essentials.users.create` Create a new User. Batch POST supported with list of User objects | Create a new User. Batch POST supported with list of User objects. | write | `identity.user.create` 262 connectors | | `proofpoint_essentials.orgs.children.list` Read an Organization and its child Organizations | Read an Organization and its child Organizations. | read | `crm.company.list` 162 connectors | | `proofpoint_essentials.users.delete` Delete a User | Delete a User. | destructive | `identity.user.delete` 253 connectors | | `proofpoint_essentials.orgs.create` Create a new Organization. Batch POST supported with list of Organization objects | Create a new Organization. Batch POST supported with list of Organization objects. | write | `crm.company.create` 142 connectors | | `proofpoint_essentials.idps.list` Read a list of all Identity Providers (IDPs) for the target Organization | Read a list of all Identity Providers (IDPs) for the target Organization. | read | `identity.identity_provider.list` 22 connectors | | `proofpoint_essentials.idps.create` Create a new Identity Provider (IDP) | Create a new Identity Provider (IDP). | write | `identity.identity_provider.create` 15 connectors | | `proofpoint_essentials.products.list` Read a list of Products applicable to an Organization. Includes both available and purchased products | Read a list of Products applicable to an Organization. Includes both available and purchased products. | read | `finance.subscription.list` 37 connectors | | `proofpoint_essentials.products.create` Used to purchase a Product | Used to purchase a Product. | write | `finance.subscription.create` 27 connectors | | `proofpoint_essentials.dkim.list` Read DKIM Signing data for all keypairs associated with this domain | Read DKIM Signing data for all keypairs associated with this domain. | read | this connector | | `proofpoint_essentials.dkim.create` Create a DKIM keypair | Create a DKIM keypair. | write | this connector | Try it ## Prompts to paste into Claude. Each one names the Proofpoint Essentials actions it will call, so you know what it reads and what it changes before you send it. 1. Read read List the companies in Proofpoint Essentials and flag likely duplicates by name or domain. calls `proofpoint_essentials.orgs.children.list` 2. Write write Create a new User. Batch POST supported with list of User objects in Proofpoint Essentials. Show me exactly what you will send before you save it. calls `proofpoint_essentials.users.create` Governance for Proofpoint Essentials ## Destructive actions wait for a yes. 14 Proofpoint Essentials actions are destructive. These are all of them: - Delete a User `proofpoint_essentials.users.delete` - Delete an Organization `proofpoint_essentials.orgs.delete` - Delete an Identity Provider (IDP) `proofpoint_essentials.idps.delete` - Delete a Product subscription. NOTE this will not normally be available to customers depending on the Product `proofpoint_essentials.products.delete` - Delete a DKIM keypair by selector name `proofpoint_essentials.dkim.delete` - Delete a Domain `proofpoint_essentials.domains.delete` - Delete sender lists for an Organization `proofpoint_essentials.sender_lists.delete` - Clear and reset Azure Active Directory information for an Organization `proofpoint_essentials.azure_settings.delete` - Delete one Sync Exemption belonging to organization `proofpoint_essentials.azure_sync_exemptions.delete` - Delete all DKIM keypairs associated with a domain `proofpoint_essentials.dkim.all.delete` - Delete sender lists for a User `proofpoint_essentials.users.sender_lists.delete` - Delete sender lists for a Group `proofpoint_essentials.groups.sender_lists.delete` - Delete specified Email Tagging Exempt Senders for an Organization `proofpoint_essentials.email_tagging.exemptions.delete` - Delete all organizations Sync Exemptions `proofpoint_essentials.azure_sync_exemptions.all.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do proofpoint_essentials.users.delete confirm_policy: **human** Delete a User? **intent:** the user asked me to delete a User run suspended · waiting for a named person · key _proofpoint-essentials-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "proofpoint-essentials-agent", allowed_actions: ["proofpoint_essentials.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "proofpoint_essentials.users.delete", approver: "lead@example.com" }, { match: "proofpoint_essentials.orgs.delete", approver: "lead@example.com" }, { match: "proofpoint_essentials.idps.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Proofpoint Essentials only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Proofpoint Essentials costs on actionlake. Every Proofpoint Essentials action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Proofpoint Essentials refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 77 Proofpoint Essentials actions - 77 actions page each page of a long list is one call - 33 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Proofpoint Essentials action. 77 actions by area: the id your agent calls, what it does, and its effect. **Users 9** - `proofpoint_essentials.users.create` Create a new User. Batch POST supported with list of User objects write - `proofpoint_essentials.users.delete` Delete a User destructive - `proofpoint_essentials.users.get` Read a User belonging to an Organization read - `proofpoint_essentials.users.list` Read all Users belonging to an Organization read - `proofpoint_essentials.users.sender_lists.delete` Delete sender lists for a User destructive - `proofpoint_essentials.users.sender_lists.get` Read sender lists for a User read - `proofpoint_essentials.users.sender_lists.patch` Update sender lists for a User write - `proofpoint_essentials.users.sender_lists.update` Update sender lists for a User write - `proofpoint_essentials.users.update` Update a User belonging to an Organization write **Domains 8** - `proofpoint_essentials.domains.create` Create a new Domain. Batch POST supported with list of Domain objects write - `proofpoint_essentials.domains.delete` Delete a Domain destructive - `proofpoint_essentials.domains.get` Read a single Domain associated with an Organization read - `proofpoint_essentials.domains.health.get` Run a health check on the domain read - `proofpoint_essentials.domains.list` Read all domains associated with an Organization read - `proofpoint_essentials.domains.update` Update a Domain associated with an Organization write - `proofpoint_essentials.domains.verification.update` Run a verification check on the domain using the method specified. No Request data required, and result is shown via the write - `proofpoint_essentials.domains.verification_code.get` Read the verification code required to verify the domain. Use this for TXT or META verification read **Dkim 6** - `proofpoint_essentials.dkim.all.delete` Delete all DKIM keypairs associated with a domain destructive - `proofpoint_essentials.dkim.create` Create a DKIM keypair write - `proofpoint_essentials.dkim.delete` Delete a DKIM keypair by selector name destructive - `proofpoint_essentials.dkim.get` Read DKIM Signing data for a single keypair by selector name read - `proofpoint_essentials.dkim.list` Read DKIM Signing data for all keypairs associated with this domain read - `proofpoint_essentials.dkim.verification.update` Verify the DKIM keypair is valid by verifying the Public Key in DNS write **Email tagging 6** - `proofpoint_essentials.email_tagging.exemptions.create` Create Email Tagging Exempt Senders for an Organization write - `proofpoint_essentials.email_tagging.exemptions.delete` Delete specified Email Tagging Exempt Senders for an Organization destructive - `proofpoint_essentials.email_tagging.exemptions.list` Retrieve Email Tagging Exempt Senders read - `proofpoint_essentials.email_tagging.get` Read email tagging settings for an Organization read - `proofpoint_essentials.email_tagging.patch` Update a specific email tagging setting for an Organization write - `proofpoint_essentials.email_tagging.update` Update email tagging settings for an Organization write **Idps 5** - `proofpoint_essentials.idps.create` Create a new Identity Provider (IDP) write - `proofpoint_essentials.idps.delete` Delete an Identity Provider (IDP) destructive - `proofpoint_essentials.idps.get` Read a single Identity Provider (IDP) read - `proofpoint_essentials.idps.list` Read a list of all Identity Providers (IDPs) for the target Organization read - `proofpoint_essentials.idps.update` Update an Identity Provider (IDP) write **Orgs 5** - `proofpoint_essentials.orgs.children.list` Read an Organization and its child Organizations read - `proofpoint_essentials.orgs.create` Create a new Organization. Batch POST supported with list of Organization objects write - `proofpoint_essentials.orgs.delete` Delete an Organization destructive - `proofpoint_essentials.orgs.get` Read an Organization read - `proofpoint_essentials.orgs.patch` Update an Organization write **Products 5** - `proofpoint_essentials.products.create` Used to purchase a Product write - `proofpoint_essentials.products.delete` Delete a Product subscription. NOTE this will not normally be available to customers depending on the Product destructive - `proofpoint_essentials.products.get` Read a single Product by Label read - `proofpoint_essentials.products.list` Read a list of Products applicable to an Organization. Includes both available and purchased products read - `proofpoint_essentials.products.patch` Update a Product write **Azure sync exemptions 4** - `proofpoint_essentials.azure_sync_exemptions.all.delete` Delete all organizations Sync Exemptions destructive - `proofpoint_essentials.azure_sync_exemptions.delete` Delete one Sync Exemption belonging to organization destructive - `proofpoint_essentials.azure_sync_exemptions.list` List of Sync Exemptions for an organization read - `proofpoint_essentials.azure_sync_exemptions.update` Add to organizations Sync Exemptions write **Groups 4** - `proofpoint_essentials.groups.sender_lists.delete` Delete sender lists for a Group destructive - `proofpoint_essentials.groups.sender_lists.get` Read sender lists for a Group read - `proofpoint_essentials.groups.sender_lists.patch` Update sender lists for a Group write - `proofpoint_essentials.groups.sender_lists.update` Update sender lists for a Group write **Sender lists 4** - `proofpoint_essentials.sender_lists.delete` Delete sender lists for an Organization destructive - `proofpoint_essentials.sender_lists.get` Read sender lists for an Organization read - `proofpoint_essentials.sender_lists.patch` Update sender lists for an Organization write - `proofpoint_essentials.sender_lists.update` Update sender lists for an Organization write **Azure settings 3** - `proofpoint_essentials.azure_settings.delete` Clear and reset Azure Active Directory information for an Organization destructive - `proofpoint_essentials.azure_settings.get` Load Azure Active Directory information for an Organization read - `proofpoint_essentials.azure_settings.update` Update Azure Active Directory information for an Organization write **Billing 2** - `proofpoint_essentials.billing.get` Read billing data for an Organization read - `proofpoint_essentials.billing.orgs.list` Read billing data for an Organization and its children read **Features 2** - `proofpoint_essentials.features.get` Read all Features relevant to an Organization. Note that the items returned will be specific to the licensing package read - `proofpoint_essentials.features.update` Update an Organization's feature set. The feature set will differ for different types of licensing package so the applic write **Licensing 2** - `proofpoint_essentials.licensing.get` Read all Licensing data relevant to an Organization read - `proofpoint_essentials.licensing.update` Update an Organization's Licensing data write **Login settings 2** - `proofpoint_essentials.login_settings.get` Read Authentication login settings for the target Organization read - `proofpoint_essentials.login_settings.update` Update Login settings for the target Organization write **Mfa settings 2** - `proofpoint_essentials.mfa_settings.get` Read MFA settings for the target Organization read - `proofpoint_essentials.mfa_settings.update` Update MFA settings for the target Organization write **Reporting 2** - `proofpoint_essentials.reporting.direction.get` Read statistics data for an Organization read - `proofpoint_essentials.reporting.get` Read statistics data for an Organization read **Stats 2** - `proofpoint_essentials.stats.partner.get` Read statistics data for an Organization for the last 1/7/30/90 days read - `proofpoint_essentials.stats.partner_orgs.list` Read statistics data for an Organization and its children for the last 1/7/30/90 days read **Endpoints 1** - `proofpoint_essentials.endpoints.get` Query which Proofpoint stack(s) a domain is active on read **Me 1** - `proofpoint_essentials.me.get` Read metadata about the currently logged in User read **Package 1** - `proofpoint_essentials.package.update` Update an Organization's Package data write **Tokens 1** - `proofpoint_essentials.tokens.create` Create an Odin access token for the specified user write Questions ## The Proofpoint Essentials MCP server, answered. **Is there a Proofpoint Essentials MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 77 Proofpoint Essentials actions across users, domains, dkim and email tagging, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Proofpoint Essentials. **What do I need to connect Proofpoint Essentials?** Proofpoint Essentials admin user (the email address you sign in with) and That admin user's Proofpoint Essentials password (sent as the X-Password header). Plus your host. The free call account { op: "connections.requirements", service: "proofpoint_essentials" } lists exactly what to paste. **Can an AI agent delete or change things in Proofpoint Essentials?** Only if its key allows it, and only with an explicit confirmation. 14 Proofpoint Essentials actions are destructive, including delete a User, delete an Organization and delete an Identity Provider (IDP). Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Proofpoint Essentials API limit?** actionlake paces every call to the limits in the Proofpoint Essentials service file: 5 calls a second per connection. Repeated reads are answered from cache (33 Proofpoint Essentials actions can be), which never reaches Proofpoint Essentials. **What does a Proofpoint Essentials action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (77 Proofpoint Essentials actions page). Cache hits, searches, dry runs and calls Proofpoint Essentials refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Proofpoint Essentials API does it cover?** The Proofpoint Essentials Interface API v1 (OpenAPI 3.0.0) at your Proofpoint Essentials instance's API base URL, which you enter when connecting. It is built from Proofpoint Essentials's documentation as read on 23 October 2026. 77 actions in 22 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Proofpoint Essentials data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Proofpoint Essentials credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Proofpoint Essentials Shares the most action names with - [Veeam Service Provider Console 11](https://actionlake.com/connectors/veeam-service-provider-console) - [ThreatDown OneView 10](https://actionlake.com/connectors/threatdown-oneview) - [MSP360 Managed Backup 10](https://actionlake.com/connectors/msp360-managed-backup) - [TP-Link Omada Open API 10](https://actionlake.com/connectors/tp-link-omada-open-api) - [CloudRadial 10](https://actionlake.com/connectors/cloudradial) - [Google Workspace Reseller 8](https://actionlake.com/connectors/google-workspace-reseller) Joins with, on shared entities - [Red Hat OpenShift Cluster Manager 3](https://actionlake.com/connectors/red-hat-openshift-cluster-manager) - [Autodesk Construction Cloud 3](https://actionlake.com/connectors/autodesk-construction-cloud) - [Toggl Track 3](https://actionlake.com/connectors/toggl-track) - [Harvest 3](https://actionlake.com/connectors/harvest) - [Hubstaff 3](https://actionlake.com/connectors/hubstaff) - [Clockify 3](https://actionlake.com/connectors/clockify) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Proofpoint Essentials; the name is the vendor's own. Counts are from the Proofpoint Essentials service file, version 1.0.0. ## Give your agent Proofpoint Essentials today. [Connect Proofpoint Essentials free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/proofpoint-essentials More: https://actionlake.com/llms.txt