Connectors · Identity & security
Rapid7 InsightIDR MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Rapid7 InsightIDR and the rest of your systems. It gives your agent 174 Rapid7 InsightIDR actions (102 reads, 54 writes and 18 that wait for a confirmation) and holds the Rapid7 InsightIDR credential itself, so the agent never does. It paces Rapid7 InsightIDR's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "rapid7_insightidr.investigations.list", intent: "check which Rapid7 InsightIDR account is connected"}# List investigations · read · 1 upstream call- 174actionsin one signed file
- 102readlook, never change
- 54writecreate and update
- 18wait for a yesdestructive, confirmed first
Set up
Connect Rapid7 InsightIDR in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Rapid7 InsightIDR.
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_keyInsight Platform API key: insight.rapid7.com > Administration > API Key Management > New User Key (or Organization Key)regionYour Rapid7 InsightIDR region
account { op: "connections.requirements", service: "rapid7_insightidr" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "rapid7_insightidr.investigations.list" }# list investigations · read · 1 upstream callcheck { action: "rapid7_insightidr.detection_rules.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Rapid7 InsightIDR at a glance
- Sign-in
- API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_key- Setup fields
region- Limits we pace to
- 100 calls a minute, per connection
- API covered
- InsightIDR API v1 + v2, SIEM Alerts API, Detection Rules API v1, Log Search REST API, at your own api.insight.rapid7.com address, set when you connect
- Built from
- Rapid7 InsightIDR's documentation, read 23 October 2026help.rapid7.comhelp.rapid7.comdocs.rapid7.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 85 of 102 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line Rapid7 InsightIDR up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Rapid7 InsightIDR.
174 actions in 36 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 102readlook, never change
- 54writecreate and update
- 18destructivewait for a confirmation
Investigations
165 read · 9 write · 2 destructive
List investigations · Create investigation · Get investigation · Update investigation
Alerts
1310 read · 3 write · 0 destructive
Search alerts · Retrieve a single alert · Update a single alert · Create a report for alerts
Detection rules
136 read · 6 write · 1 destructive
Get all Detection Rules and Custom Detection Rules · Create a Custom Detection Rule · Get Detection Rule or Custom Detection Rule information based on an RRN · Obsolete a Custom Detection Rule based on an RRN
Rule exceptions
128 read · 3 write · 1 destructive
Get all Exception counts · Create a Rule Exception for Detection Rule · Get all of your existing Rule Exceptions · Get all Rule Exceptions for a Detection Rule or Custom Detection Rule RRN
Log queries
1010 read · 0 write · 0 destructive
Query Multiple Logs · Retrieve The Log Data Immediately Before And After A Specific Log Line · View Statistics On Past Queries · Query Individual Logs
Alert notifications
83 read · 4 write · 1 destructive
Create a Notification · List All Notifications · List All Targets Attached To A Notification · Retrieve a Notification
Basic detection rules
62 read · 3 write · 1 destructive
Create A Basic Detection Rule · List All Tags · Retrieve a Basic Detection Rule · Replace a Basic Detection Rule
Labels
62 read · 3 write · 1 destructive
Create a Label · List all Labels · Retrieve a Label · Replace a Label
28 more areas · 90 actions
- Precomputed queries 6
- Saved queries 6
- Comments 5
- Leql variables 5
- Logs 5
- Notification targets 5
- S3 archiving 5
- Alert fields 4
- Audit log queries 4
- Community threats 4
- Investigations V1 4
- Logsets 4
- Alert actions 3
- Attachments 3
- Detection rule summaries 3
- Log exports 3
- Usage 3
- Accounts 2
- Assessment reports 2
- Assets 2
- Audit exports 2
- Audit logs 2
- Local accounts 2
- Users 2
- API key 1
- Collectors 1
- Health metrics 1
- Health metrics V1 1
Top actions
The Rapid7 InsightIDR API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 26 of Rapid7 InsightIDR's 28 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
rapid7_insightidr.users.searchSearch users | Search users. | read | identity.user.search40 connectors |
rapid7_insightidr.investigations.listList investigations | List investigations. | read | security.incident.list17 connectors |
rapid7_insightidr.users.getGet user by RRN | Get user by RRN. | read | identity.user.get399 connectors |
rapid7_insightidr.alerts.searchSearch alerts | Search alerts. | read | security.alert.search6 connectors |
rapid7_insightidr.assets.searchSearch assets | Search assets. | read | device.endpoint.search8 connectors |
rapid7_insightidr.assets.getGet asset by RRN | Get asset by RRN. | read | device.endpoint.get57 connectors |
rapid7_insightidr.detection_rules.listGet all Detection Rules and Custom Detection Rules | Get all Detection Rules and Custom Detection Rules. | read | security.detection_rule.list13 connectors |
rapid7_insightidr.detection_rules.createCreate a Custom Detection Rule | Create a Custom Detection Rule. | write | security.detection_rule.create11 connectors |
rapid7_insightidr.comments.listList comments | List comments. | read | security.incident_note.list9 connectors |
rapid7_insightidr.comments.createCreate comment | Create comment. | write | security.incident_note.create8 connectors |
rapid7_insightidr.investigations.createCreate investigation | Create investigation. | write | security.incident.create8 connectors |
rapid7_insightidr.detection_rules.deleteObsolete a Custom Detection Rule based on an RRN | Obsolete a Custom Detection Rule based on an RRN. | destructive | security.detection_rule.delete11 connectors |
Try it
Prompts to paste into Claude.
Each one names the Rapid7 InsightIDR actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which Rapid7 InsightIDR incidents are open, and how long has each been open?
calls
rapid7_insightidr.investigations.list - Writewrite
Create a Custom Detection Rule in Rapid7 InsightIDR. Show me exactly what you will send before you save it.
calls
rapid7_insightidr.detection_rules.create
Governance for Rapid7 InsightIDR
Destructive actions wait for a yes.
18 Rapid7 InsightIDR actions are destructive. These are all of them:
- Obsolete a Custom Detection Rule based on an RRN
rapid7_insightidr.detection_rules.delete - Delete a comment
rapid7_insightidr.comments.delete - Delete a Log
rapid7_insightidr.logs.delete - Delete a Label
rapid7_insightidr.labels.delete - Delete a Log Set
rapid7_insightidr.logsets.delete - Delete an attachment
rapid7_insightidr.attachments.delete - Delete An Export Job By Id
rapid7_insightidr.log_exports.delete - Disable Daily Archiving
rapid7_insightidr.s3_archiving.delete - Delete A Saved Query
rapid7_insightidr.saved_queries.delete - Delete an LEQL variable
rapid7_insightidr.leql_variables.delete - Delete a Rule Exception
rapid7_insightidr.rule_exceptions.delete - Delete a Community Threat
rapid7_insightidr.community_threats.delete - Delete a Notification
rapid7_insightidr.alert_notifications.delete - Delete A Pre-Computed Query
rapid7_insightidr.precomputed_queries.delete - Remove alert associated to an investigation
rapid7_insightidr.investigations.remove_alert - Delete a Target
rapid7_insightidr.notification_targets.delete - Delete a Basic Detection Rule
rapid7_insightidr.basic_detection_rules.delete - Remove aisoc clusters from an investigation
rapid7_insightidr.investigations.remove_aisoc_clusters
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Obsolete a Custom Detection Rule based on an RRN?
intent: the user asked me to obsolete a Custom Detection Rule based on an RRN
account { op: "keys.create", name: "rapid7-insightidr-agent", allowed_actions: ["rapid7_insightidr.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "rapid7_insightidr.detection_rules.delete", approver: "[email protected]" }, { match: "rapid7_insightidr.comments.delete", approver: "[email protected]" }, { match: "rapid7_insightidr.logs.delete", approver: "[email protected]" } ]}Cost
What Rapid7 InsightIDR costs on actionlake.
Every Rapid7 InsightIDR action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Rapid7 InsightIDR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 174 Rapid7 InsightIDR actions
- 174actions pageeach page of a long list is one call
- 85reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Rapid7 InsightIDR action.
174 actions by area: the id your agent calls, what it does, and its effect.
Investigations16
rapid7_insightidr.investigations.add_aisoc_clustersAdd aisoc clusters to an investigationwriterapid7_insightidr.investigations.assignAssign user to investigationwriterapid7_insightidr.investigations.bulk_closeClose investigations in bulkwriterapid7_insightidr.investigations.createCreate investigationwriterapid7_insightidr.investigations.create_from_aisoc_clustersCreate investigation with aisoc clusterswriterapid7_insightidr.investigations.getGet investigationreadrapid7_insightidr.investigations.listList investigationsreadrapid7_insightidr.investigations.list_alertsList alerts associated with the specified investigationreadrapid7_insightidr.investigations.list_product_alertsGet a list of Rapid7 product alerts associated with the specified investigationreadrapid7_insightidr.investigations.remove_aisoc_clustersRemove aisoc clusters from an investigationdestructiverapid7_insightidr.investigations.remove_alertRemove alert associated to an investigationdestructiverapid7_insightidr.investigations.searchSearch investigationsreadrapid7_insightidr.investigations.set_dispositionSet the disposition of an investigationwriterapid7_insightidr.investigations.set_prioritySet the priority of an investigationwriterapid7_insightidr.investigations.set_statusSet the status of an investigationwriterapid7_insightidr.investigations.updateUpdate investigationwrite
Alerts13
rapid7_insightidr.alerts.bulk_updateUpdate multiple alertswriterapid7_insightidr.alerts.generate_reportCreate a report for alertsreadrapid7_insightidr.alerts.getRetrieve a single alertreadrapid7_insightidr.alerts.get_manyRetrieve multiple alertsreadrapid7_insightidr.alerts.get_process_treeRetrieve a single process treereadrapid7_insightidr.alerts.investigateCreate an investigation with alertswriterapid7_insightidr.alerts.list_actorsRetrieve an alert's actorsreadrapid7_insightidr.alerts.list_assignee_optionsRetrieve assignees for a single alertreadrapid7_insightidr.alerts.list_evidencesRetrieve evidence for a single alertreadrapid7_insightidr.alerts.list_process_treesRetrieve all process trees for an alertreadrapid7_insightidr.alerts.searchSearch alertsreadrapid7_insightidr.alerts.search_assignee_optionsRetrieve assignees for multiple alertsreadrapid7_insightidr.alerts.updateUpdate a single alertwrite
Detection rules13
rapid7_insightidr.detection_rules.add_workflowsAdd Workflowswriterapid7_insightidr.detection_rules.countGet all Detection Rule and Custom Detection Rule countsreadrapid7_insightidr.detection_rules.createCreate a Custom Detection Rulewriterapid7_insightidr.detection_rules.deleteObsolete a Custom Detection Rule based on an RRNdestructiverapid7_insightidr.detection_rules.exportExport Custom Detection Rules based on a Filterreadrapid7_insightidr.detection_rules.getGet Detection Rule or Custom Detection Rule information based on an RRNreadrapid7_insightidr.detection_rules.importImport Custom Detection Ruleswriterapid7_insightidr.detection_rules.listGet all Detection Rules and Custom Detection Rulesreadrapid7_insightidr.detection_rules.list_historyModification Historyreadrapid7_insightidr.detection_rules.remove_workflowsObsolete Workflowswriterapid7_insightidr.detection_rules.restoreRestore a Custom Detection Rule based on an RRNwriterapid7_insightidr.detection_rules.searchGet filtered view of Detection Rules and Custom Detection Rulesreadrapid7_insightidr.detection_rules.updateUpdate Detection Rules and Custom Detection Ruleswrite
Rule exceptions12
rapid7_insightidr.rule_exceptions.bulk_updateUpdate Exceptionswriterapid7_insightidr.rule_exceptions.countGet all Exception countsreadrapid7_insightidr.rule_exceptions.createCreate a Rule Exception for Detection Rulewriterapid7_insightidr.rule_exceptions.deleteDelete a Rule Exceptiondestructiverapid7_insightidr.rule_exceptions.getRetrieve a rule exception from an RRNreadrapid7_insightidr.rule_exceptions.get_for_ruleGet Rule Exception using its RRNreadrapid7_insightidr.rule_exceptions.listGet all of your existing Rule Exceptionsreadrapid7_insightidr.rule_exceptions.list_for_ruleGet all Rule Exceptions for a Detection Rule or Custom Detection Rule RRNreadrapid7_insightidr.rule_exceptions.preview_key_valueReturn Preview using Key Value Pairreadrapid7_insightidr.rule_exceptions.preview_leqlReturn Preview using LEQLreadrapid7_insightidr.rule_exceptions.searchGet all of your existing Rule Exceptions in a filtered viewreadrapid7_insightidr.rule_exceptions.updateUpdate the logic of a Rule Exception for a Detection Rulewrite
Log queries10
rapid7_insightidr.log_queries.get_contextRetrieve The Log Data Immediately Before And After A Specific Log Linereadrapid7_insightidr.log_queries.list_endpointsList All Endpointsreadrapid7_insightidr.log_queries.list_search_statsView Statistics On Past Queriesreadrapid7_insightidr.log_queries.pollPoll a Query In Progressreadrapid7_insightidr.log_queries.query_logQuery Individual Logsreadrapid7_insightidr.log_queries.query_logsetQuery Individual Log Setsreadrapid7_insightidr.log_queries.query_logsets_by_nameQuery Multiple Log Setsreadrapid7_insightidr.log_queries.runQuery Multiple Logsreadrapid7_insightidr.log_queries.run_saved_queryUse a Saved Query (logs specified)readrapid7_insightidr.log_queries.run_saved_query_on_logsUse a Saved Query (logs unspecified)read
Alert notifications8
rapid7_insightidr.alert_notifications.createCreate a Notificationwriterapid7_insightidr.alert_notifications.deleteDelete a Notificationdestructiverapid7_insightidr.alert_notifications.getRetrieve a Notificationreadrapid7_insightidr.alert_notifications.listList All Notificationsreadrapid7_insightidr.alert_notifications.list_targetsList All Targets Attached To A Notificationreadrapid7_insightidr.alert_notifications.replaceReplace a Notificationwriterapid7_insightidr.alert_notifications.updateModify a Notificationwriterapid7_insightidr.alert_notifications.update_targetModify the Targets Attached To A Notificationwrite
Basic detection rules6
rapid7_insightidr.basic_detection_rules.createCreate A Basic Detection Rulewriterapid7_insightidr.basic_detection_rules.deleteDelete a Basic Detection Ruledestructiverapid7_insightidr.basic_detection_rules.getRetrieve a Basic Detection Rulereadrapid7_insightidr.basic_detection_rules.listList All Tagsreadrapid7_insightidr.basic_detection_rules.replaceReplace a Basic Detection Rulewriterapid7_insightidr.basic_detection_rules.updateModify a Basic Detection Rulewrite
Labels6
rapid7_insightidr.labels.createCreate a Labelwriterapid7_insightidr.labels.deleteDelete a Labeldestructiverapid7_insightidr.labels.getRetrieve a Labelreadrapid7_insightidr.labels.listList all Labelsreadrapid7_insightidr.labels.replaceReplace a Labelwriterapid7_insightidr.labels.updateUpdate a Labelwrite
Precomputed queries6
rapid7_insightidr.precomputed_queries.createCreate A Pre-Computed Querywriterapid7_insightidr.precomputed_queries.deleteDelete A Pre-Computed Querydestructiverapid7_insightidr.precomputed_queries.getRetrieve A Pre-Computed Queryreadrapid7_insightidr.precomputed_queries.listList All Pre-Computed Queriesreadrapid7_insightidr.precomputed_queries.queryFetch Query Resultsreadrapid7_insightidr.precomputed_queries.updateReplace a Pre-Computed Querywrite
Saved queries6
rapid7_insightidr.saved_queries.createCreate A Saved Querywriterapid7_insightidr.saved_queries.deleteDelete A Saved Querydestructiverapid7_insightidr.saved_queries.getRetrieve A Saved Queryreadrapid7_insightidr.saved_queries.listList All Saved Queriesreadrapid7_insightidr.saved_queries.replaceReplace A Saved Querywriterapid7_insightidr.saved_queries.updateModify A Saved Querywrite
Comments5
rapid7_insightidr.comments.createCreate commentwriterapid7_insightidr.comments.deleteDelete a commentdestructiverapid7_insightidr.comments.getGet comment by rrnreadrapid7_insightidr.comments.listList commentsreadrapid7_insightidr.comments.set_visibilityUpdate comment visibilitywrite
Leql variables5
rapid7_insightidr.leql_variables.createCreate an LEQL variablewriterapid7_insightidr.leql_variables.deleteDelete an LEQL variabledestructiverapid7_insightidr.leql_variables.getRetrieve an LEQL variablereadrapid7_insightidr.leql_variables.listList all LEQL variablesreadrapid7_insightidr.leql_variables.updateUpdate an LEQL variablewrite
Logs5
rapid7_insightidr.logs.deleteDelete a Logdestructiverapid7_insightidr.logs.getRetrieve a Logreadrapid7_insightidr.logs.get_top_keysRetrieve Most Common Keys For A Logreadrapid7_insightidr.logs.listRetrieve All Logsreadrapid7_insightidr.logs.list_event_sourcesRetrieve Log Event Sourcesread
Notification targets5
rapid7_insightidr.notification_targets.createCreate a Targetwriterapid7_insightidr.notification_targets.deleteDelete a Targetdestructiverapid7_insightidr.notification_targets.getRetrieve a Targetreadrapid7_insightidr.notification_targets.listList All Targetsreadrapid7_insightidr.notification_targets.updateReplace a Targetwrite
S3 archiving5
rapid7_insightidr.s3_archiving.createEnable Daily Archivingwriterapid7_insightidr.s3_archiving.deleteDisable Daily Archivingdestructiverapid7_insightidr.s3_archiving.getView Daily Archiving Settingsreadrapid7_insightidr.s3_archiving.replaceReplace Daily Archiving Settingswriterapid7_insightidr.s3_archiving.updateModify Daily Archiving Settingswrite
Alert fields4
rapid7_insightidr.alert_fields.getRetrieve a single alert fieldreadrapid7_insightidr.alert_fields.listRetrieves all supported alert fields V2readrapid7_insightidr.alert_fields.list_legacyRetrieve all alert fieldsreadrapid7_insightidr.alert_fields.list_valuesRetrieve values for a single alert fieldread
Audit log queries4
rapid7_insightidr.audit_log_queries.list_endpointsList All Endpointsreadrapid7_insightidr.audit_log_queries.pollPoll a Query In Progressreadrapid7_insightidr.audit_log_queries.query_logQuery Individual Logs Using LEQLreadrapid7_insightidr.audit_log_queries.runQuery Multiple Logs Using LEQLread
Community threats4
rapid7_insightidr.community_threats.add_indicatorsAdd indicators to a Community Threatwriterapid7_insightidr.community_threats.createCreate a Community Threatwriterapid7_insightidr.community_threats.deleteDelete a Community Threatdestructiverapid7_insightidr.community_threats.replace_indicatorsReplace indicators for a Community Threatwrite
Investigations V14
rapid7_insightidr.investigations_v1.assignAssign user to investigationwriterapid7_insightidr.investigations_v1.bulk_closeClose investigations in bulkwriterapid7_insightidr.investigations_v1.listList investigationsreadrapid7_insightidr.investigations_v1.set_statusSet the status of an investigationwrite
Logsets4
rapid7_insightidr.logsets.deleteDelete a Log Setdestructiverapid7_insightidr.logsets.getRetrieve a Log Setreadrapid7_insightidr.logsets.listList All Log Setsreadrapid7_insightidr.logsets.updateReplace a Log Setwrite
Alert actions3
rapid7_insightidr.alert_actions.get_resultRetrieve alert action resultreadrapid7_insightidr.alert_actions.listRetrieve alert actionsreadrapid7_insightidr.alert_actions.list_tasksRetrieve alert action tasksread
Attachments3
rapid7_insightidr.attachments.deleteDelete an attachmentdestructiverapid7_insightidr.attachments.getGet attachment informationreadrapid7_insightidr.attachments.listList attachmentsread
Detection rule summaries3
rapid7_insightidr.detection_rule_summaries.getGet summary information for a Detection Rule or Custom Detection Rule by its RRNreadrapid7_insightidr.detection_rule_summaries.listGet summary information for all Detection Rules and Custom Detection Rulesreadrapid7_insightidr.detection_rule_summaries.searchGet summary information for a filtered list of Detection Rules and Custom Detection Rulesread
Log exports3
rapid7_insightidr.log_exports.deleteDelete An Export Job By Iddestructiverapid7_insightidr.log_exports.getRetrieve An Export Job By Idreadrapid7_insightidr.log_exports.listRetrieve All Export Jobsread
Usage3
rapid7_insightidr.usage.get_logData Size For a Specific Logreadrapid7_insightidr.usage.get_organizationTotal Data Size Across All Logsreadrapid7_insightidr.usage.list_logsData Size Broken Down By Logread
Accounts2
rapid7_insightidr.accounts.getGet account by RRNreadrapid7_insightidr.accounts.searchSearch accountsread
Assessment reports2
rapid7_insightidr.assessment_reports.dismissDismiss Assessment Reportswriterapid7_insightidr.assessment_reports.searchGet filtered view of Assessment Reportsread
Assets2
rapid7_insightidr.assets.getGet asset by RRNreadrapid7_insightidr.assets.searchSearch assetsread
Audit exports2
rapid7_insightidr.audit_exports.getRetrieve An Export Job By Idreadrapid7_insightidr.audit_exports.listRetrieve All Export Jobsread
Audit logs2
rapid7_insightidr.audit_logs.getRetrieve An Audit Logreadrapid7_insightidr.audit_logs.listRetrieve All Audit Logsread
Local accounts2
rapid7_insightidr.local_accounts.getGet local account by RRNreadrapid7_insightidr.local_accounts.searchSearch local accountsread
Users2
rapid7_insightidr.users.getGet user by RRNreadrapid7_insightidr.users.searchSearch usersread
API key1
rapid7_insightidr.api_key.validateValidate the API keyread
Collectors1
rapid7_insightidr.collectors.createAdd Collectorwrite
Health metrics1
rapid7_insightidr.health_metrics.listRetrieve health metrics by orgread
Health metrics V11
rapid7_insightidr.health_metrics_v1.listRetrieve health metrics by orgread
Questions
The Rapid7 InsightIDR MCP server, answered.
Is there a Rapid7 InsightIDR MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 174 Rapid7 InsightIDR actions across investigations, alerts, detection rules and rule exceptions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Rapid7 InsightIDR.
What do I need to connect Rapid7 InsightIDR?
Insight Platform API key: insight.rapid7.com > Administration > API Key Management > New User Key (or Organization Key). Plus your region. The free call account { op: "connections.requirements", service: "rapid7_insightidr" } lists exactly what to paste.
Can an AI agent delete or change things in Rapid7 InsightIDR?
Only if its key allows it, and only with an explicit confirmation. 18 Rapid7 InsightIDR actions are destructive, including obsolete a Custom Detection Rule based on an RRN, delete a comment and delete a Log. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Rapid7 InsightIDR API limit?
actionlake paces every call to the limits in the Rapid7 InsightIDR service file: 100 calls a minute per connection. Repeated reads are answered from cache (85 Rapid7 InsightIDR actions can be), which never reaches Rapid7 InsightIDR.
What does a Rapid7 InsightIDR action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (174 Rapid7 InsightIDR actions page). Cache hits, searches, dry runs and calls Rapid7 InsightIDR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Rapid7 InsightIDR API does it cover?
The InsightIDR API v1 + v2, SIEM Alerts API, Detection Rules API v1, Log Search REST API at your own api.insight.rapid7.com address, set when you connect. It is built from Rapid7 InsightIDR's documentation as read on 23 October 2026. 174 actions in 36 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Rapid7 InsightIDR data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Rapid7 InsightIDR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Rapid7 InsightIDR today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
