--- title: "Rapid7 InsightIDR MCP server for AI agents - actionlake" description: "Give Claude 174 Rapid7 InsightIDR actions through one MCP server: investigations, alerts. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/rapid7-insightidr updated: 2026-10-23 --- Connectors · Identity & security # Rapid7 InsightIDR MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Rapid7 InsightIDR and the rest of your systems. It gives your agent 174 Rapid7 InsightIDR actions (102 reads, 54 writes and 18 that wait for a confirmation) and holds the Rapid7 InsightIDR credential itself, so the agent never does. It paces Rapid7 InsightIDR's limits and records every call. [Connect Rapid7 InsightIDR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "rapid7_insightidr.investigations.list", intent: "check which Rapid7 InsightIDR account is connected" } # List investigations · read · 1 upstream call ``` - 174 actions in one signed file - 102 read look, never change - 54 write create and update - 18 wait for a yes destructive, confirmed first Set up ## Connect Rapid7 InsightIDR in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Rapid7 InsightIDR. API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Insight Platform API key: insight.rapid7.com > Administration > API Key Management > New User Key (or Organization Key) - `region` Your Rapid7 InsightIDR region ``` account { op: "connections.requirements", service: "rapid7_insightidr" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "rapid7_insightidr.investigations.list" } # list investigations · read · 1 upstream call check { action: "rapid7_insightidr.detection_rules.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Rapid7 InsightIDR at a glance **Sign-in** API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` **Setup fields** `region` **Limits we pace to** 100 calls a minute, per connection **API covered** InsightIDR API v1 + v2, SIEM Alerts API, Detection Rules API v1, Log Search REST API, at your own api.insight.rapid7.com address, set when you connect **Built from** Rapid7 InsightIDR's documentation, read 23 October 2026[help.rapid7.com](https://help.rapid7.com/insightidr/en-us/api/v1/insightidr-api-v1.json) [help.rapid7.com](https://help.rapid7.com/insightidr/en-us/api/v2/insightidr-api-v2.json) [docs.rapid7.com](https://docs.rapid7.com/_api/insightidr-alert-triage.yaml) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 85 of 102 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 4, so ask can line Rapid7 InsightIDR up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Rapid7 InsightIDR. 174 actions in 36 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **102** read look, never change - **54** write create and update - **18** destructive wait for a confirmation 1. ### Investigations 16 5 read · 9 write · 2 destructive List investigations · Create investigation · Get investigation · Update investigation 2. ### Alerts 13 10 read · 3 write · 0 destructive Search alerts · Retrieve a single alert · Update a single alert · Create a report for alerts 3. ### Detection rules 13 6 read · 6 write · 1 destructive Get all Detection Rules and Custom Detection Rules · Create a Custom Detection Rule · Get Detection Rule or Custom Detection Rule information based on an RRN · Obsolete a Custom Detection Rule based on an RRN 4. ### Rule exceptions 12 8 read · 3 write · 1 destructive Get all Exception counts · Create a Rule Exception for Detection Rule · Get all of your existing Rule Exceptions · Get all Rule Exceptions for a Detection Rule or Custom Detection Rule RRN 5. ### Log queries 10 10 read · 0 write · 0 destructive Query Multiple Logs · Retrieve The Log Data Immediately Before And After A Specific Log Line · View Statistics On Past Queries · Query Individual Logs 6. ### Alert notifications 8 3 read · 4 write · 1 destructive Create a Notification · List All Notifications · List All Targets Attached To A Notification · Retrieve a Notification 7. ### Basic detection rules 6 2 read · 3 write · 1 destructive Create A Basic Detection Rule · List All Tags · Retrieve a Basic Detection Rule · Replace a Basic Detection Rule 8. ### Labels 6 2 read · 3 write · 1 destructive Create a Label · List all Labels · Retrieve a Label · Replace a Label **28 more areas · 90 actions** - Precomputed queries **6** - Saved queries **6** - Comments **5** - Leql variables **5** - Logs **5** - Notification targets **5** - S3 archiving **5** - Alert fields **4** - Audit log queries **4** - Community threats **4** - Investigations V1 **4** - Logsets **4** - Alert actions **3** - Attachments **3** - Detection rule summaries **3** - Log exports **3** - Usage **3** - Accounts **2** - Assessment reports **2** - Assets **2** - Audit exports **2** - Audit logs **2** - Local accounts **2** - Users **2** - API key **1** - Collectors **1** - Health metrics **1** - Health metrics V1 **1** Top actions ## The Rapid7 InsightIDR API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 26 of Rapid7 InsightIDR's 28 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `rapid7_insightidr.users.search` Search users | Search users. | read | `identity.user.search` 40 connectors | | `rapid7_insightidr.investigations.list` List investigations | List investigations. | read | `security.incident.list` 17 connectors | | `rapid7_insightidr.users.get` Get user by RRN | Get user by RRN. | read | `identity.user.get` 399 connectors | | `rapid7_insightidr.alerts.search` Search alerts | Search alerts. | read | `security.alert.search` 6 connectors | | `rapid7_insightidr.assets.search` Search assets | Search assets. | read | `device.endpoint.search` 8 connectors | | `rapid7_insightidr.assets.get` Get asset by RRN | Get asset by RRN. | read | `device.endpoint.get` 57 connectors | | `rapid7_insightidr.detection_rules.list` Get all Detection Rules and Custom Detection Rules | Get all Detection Rules and Custom Detection Rules. | read | `security.detection_rule.list` 13 connectors | | `rapid7_insightidr.detection_rules.create` Create a Custom Detection Rule | Create a Custom Detection Rule. | write | `security.detection_rule.create` 11 connectors | | `rapid7_insightidr.comments.list` List comments | List comments. | read | `security.incident_note.list` 9 connectors | | `rapid7_insightidr.comments.create` Create comment | Create comment. | write | `security.incident_note.create` 8 connectors | | `rapid7_insightidr.investigations.create` Create investigation | Create investigation. | write | `security.incident.create` 8 connectors | | `rapid7_insightidr.detection_rules.delete` Obsolete a Custom Detection Rule based on an RRN | Obsolete a Custom Detection Rule based on an RRN. | destructive | `security.detection_rule.delete` 11 connectors | Try it ## Prompts to paste into Claude. Each one names the Rapid7 InsightIDR actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Rapid7 InsightIDR incidents are open, and how long has each been open? calls `rapid7_insightidr.investigations.list` 2. Write write Create a Custom Detection Rule in Rapid7 InsightIDR. Show me exactly what you will send before you save it. calls `rapid7_insightidr.detection_rules.create` Governance for Rapid7 InsightIDR ## Destructive actions wait for a yes. 18 Rapid7 InsightIDR actions are destructive. These are all of them: - Obsolete a Custom Detection Rule based on an RRN `rapid7_insightidr.detection_rules.delete` - Delete a comment `rapid7_insightidr.comments.delete` - Delete a Log `rapid7_insightidr.logs.delete` - Delete a Label `rapid7_insightidr.labels.delete` - Delete a Log Set `rapid7_insightidr.logsets.delete` - Delete an attachment `rapid7_insightidr.attachments.delete` - Delete An Export Job By Id `rapid7_insightidr.log_exports.delete` - Disable Daily Archiving `rapid7_insightidr.s3_archiving.delete` - Delete A Saved Query `rapid7_insightidr.saved_queries.delete` - Delete an LEQL variable `rapid7_insightidr.leql_variables.delete` - Delete a Rule Exception `rapid7_insightidr.rule_exceptions.delete` - Delete a Community Threat `rapid7_insightidr.community_threats.delete` - Delete a Notification `rapid7_insightidr.alert_notifications.delete` - Delete A Pre-Computed Query `rapid7_insightidr.precomputed_queries.delete` - Remove alert associated to an investigation `rapid7_insightidr.investigations.remove_alert` - Delete a Target `rapid7_insightidr.notification_targets.delete` - Delete a Basic Detection Rule `rapid7_insightidr.basic_detection_rules.delete` - Remove aisoc clusters from an investigation `rapid7_insightidr.investigations.remove_aisoc_clusters` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do rapid7_insightidr.detection_rules.delete confirm_policy: **human** Obsolete a Custom Detection Rule based on an RRN? **intent:** the user asked me to obsolete a Custom Detection Rule based on an RRN run suspended · waiting for a named person · key _rapid7-insightidr-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "rapid7-insightidr-agent", allowed_actions: ["rapid7_insightidr.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "rapid7_insightidr.detection_rules.delete", approver: "lead@example.com" }, { match: "rapid7_insightidr.comments.delete", approver: "lead@example.com" }, { match: "rapid7_insightidr.logs.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Rapid7 InsightIDR only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Rapid7 InsightIDR costs on actionlake. Every Rapid7 InsightIDR action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Rapid7 InsightIDR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 174 Rapid7 InsightIDR actions - 174 actions page each page of a long list is one call - 85 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Rapid7 InsightIDR action. 174 actions by area: the id your agent calls, what it does, and its effect. **Investigations 16** - `rapid7_insightidr.investigations.add_aisoc_clusters` Add aisoc clusters to an investigation write - `rapid7_insightidr.investigations.assign` Assign user to investigation write - `rapid7_insightidr.investigations.bulk_close` Close investigations in bulk write - `rapid7_insightidr.investigations.create` Create investigation write - `rapid7_insightidr.investigations.create_from_aisoc_clusters` Create investigation with aisoc clusters write - `rapid7_insightidr.investigations.get` Get investigation read - `rapid7_insightidr.investigations.list` List investigations read - `rapid7_insightidr.investigations.list_alerts` List alerts associated with the specified investigation read - `rapid7_insightidr.investigations.list_product_alerts` Get a list of Rapid7 product alerts associated with the specified investigation read - `rapid7_insightidr.investigations.remove_aisoc_clusters` Remove aisoc clusters from an investigation destructive - `rapid7_insightidr.investigations.remove_alert` Remove alert associated to an investigation destructive - `rapid7_insightidr.investigations.search` Search investigations read - `rapid7_insightidr.investigations.set_disposition` Set the disposition of an investigation write - `rapid7_insightidr.investigations.set_priority` Set the priority of an investigation write - `rapid7_insightidr.investigations.set_status` Set the status of an investigation write - `rapid7_insightidr.investigations.update` Update investigation write **Alerts 13** - `rapid7_insightidr.alerts.bulk_update` Update multiple alerts write - `rapid7_insightidr.alerts.generate_report` Create a report for alerts read - `rapid7_insightidr.alerts.get` Retrieve a single alert read - `rapid7_insightidr.alerts.get_many` Retrieve multiple alerts read - `rapid7_insightidr.alerts.get_process_tree` Retrieve a single process tree read - `rapid7_insightidr.alerts.investigate` Create an investigation with alerts write - `rapid7_insightidr.alerts.list_actors` Retrieve an alert's actors read - `rapid7_insightidr.alerts.list_assignee_options` Retrieve assignees for a single alert read - `rapid7_insightidr.alerts.list_evidences` Retrieve evidence for a single alert read - `rapid7_insightidr.alerts.list_process_trees` Retrieve all process trees for an alert read - `rapid7_insightidr.alerts.search` Search alerts read - `rapid7_insightidr.alerts.search_assignee_options` Retrieve assignees for multiple alerts read - `rapid7_insightidr.alerts.update` Update a single alert write **Detection rules 13** - `rapid7_insightidr.detection_rules.add_workflows` Add Workflows write - `rapid7_insightidr.detection_rules.count` Get all Detection Rule and Custom Detection Rule counts read - `rapid7_insightidr.detection_rules.create` Create a Custom Detection Rule write - `rapid7_insightidr.detection_rules.delete` Obsolete a Custom Detection Rule based on an RRN destructive - `rapid7_insightidr.detection_rules.export` Export Custom Detection Rules based on a Filter read - `rapid7_insightidr.detection_rules.get` Get Detection Rule or Custom Detection Rule information based on an RRN read - `rapid7_insightidr.detection_rules.import` Import Custom Detection Rules write - `rapid7_insightidr.detection_rules.list` Get all Detection Rules and Custom Detection Rules read - `rapid7_insightidr.detection_rules.list_history` Modification History read - `rapid7_insightidr.detection_rules.remove_workflows` Obsolete Workflows write - `rapid7_insightidr.detection_rules.restore` Restore a Custom Detection Rule based on an RRN write - `rapid7_insightidr.detection_rules.search` Get filtered view of Detection Rules and Custom Detection Rules read - `rapid7_insightidr.detection_rules.update` Update Detection Rules and Custom Detection Rules write **Rule exceptions 12** - `rapid7_insightidr.rule_exceptions.bulk_update` Update Exceptions write - `rapid7_insightidr.rule_exceptions.count` Get all Exception counts read - `rapid7_insightidr.rule_exceptions.create` Create a Rule Exception for Detection Rule write - `rapid7_insightidr.rule_exceptions.delete` Delete a Rule Exception destructive - `rapid7_insightidr.rule_exceptions.get` Retrieve a rule exception from an RRN read - `rapid7_insightidr.rule_exceptions.get_for_rule` Get Rule Exception using its RRN read - `rapid7_insightidr.rule_exceptions.list` Get all of your existing Rule Exceptions read - `rapid7_insightidr.rule_exceptions.list_for_rule` Get all Rule Exceptions for a Detection Rule or Custom Detection Rule RRN read - `rapid7_insightidr.rule_exceptions.preview_key_value` Return Preview using Key Value Pair read - `rapid7_insightidr.rule_exceptions.preview_leql` Return Preview using LEQL read - `rapid7_insightidr.rule_exceptions.search` Get all of your existing Rule Exceptions in a filtered view read - `rapid7_insightidr.rule_exceptions.update` Update the logic of a Rule Exception for a Detection Rule write **Log queries 10** - `rapid7_insightidr.log_queries.get_context` Retrieve The Log Data Immediately Before And After A Specific Log Line read - `rapid7_insightidr.log_queries.list_endpoints` List All Endpoints read - `rapid7_insightidr.log_queries.list_search_stats` View Statistics On Past Queries read - `rapid7_insightidr.log_queries.poll` Poll a Query In Progress read - `rapid7_insightidr.log_queries.query_log` Query Individual Logs read - `rapid7_insightidr.log_queries.query_logset` Query Individual Log Sets read - `rapid7_insightidr.log_queries.query_logsets_by_name` Query Multiple Log Sets read - `rapid7_insightidr.log_queries.run` Query Multiple Logs read - `rapid7_insightidr.log_queries.run_saved_query` Use a Saved Query (logs specified) read - `rapid7_insightidr.log_queries.run_saved_query_on_logs` Use a Saved Query (logs unspecified) read **Alert notifications 8** - `rapid7_insightidr.alert_notifications.create` Create a Notification write - `rapid7_insightidr.alert_notifications.delete` Delete a Notification destructive - `rapid7_insightidr.alert_notifications.get` Retrieve a Notification read - `rapid7_insightidr.alert_notifications.list` List All Notifications read - `rapid7_insightidr.alert_notifications.list_targets` List All Targets Attached To A Notification read - `rapid7_insightidr.alert_notifications.replace` Replace a Notification write - `rapid7_insightidr.alert_notifications.update` Modify a Notification write - `rapid7_insightidr.alert_notifications.update_target` Modify the Targets Attached To A Notification write **Basic detection rules 6** - `rapid7_insightidr.basic_detection_rules.create` Create A Basic Detection Rule write - `rapid7_insightidr.basic_detection_rules.delete` Delete a Basic Detection Rule destructive - `rapid7_insightidr.basic_detection_rules.get` Retrieve a Basic Detection Rule read - `rapid7_insightidr.basic_detection_rules.list` List All Tags read - `rapid7_insightidr.basic_detection_rules.replace` Replace a Basic Detection Rule write - `rapid7_insightidr.basic_detection_rules.update` Modify a Basic Detection Rule write **Labels 6** - `rapid7_insightidr.labels.create` Create a Label write - `rapid7_insightidr.labels.delete` Delete a Label destructive - `rapid7_insightidr.labels.get` Retrieve a Label read - `rapid7_insightidr.labels.list` List all Labels read - `rapid7_insightidr.labels.replace` Replace a Label write - `rapid7_insightidr.labels.update` Update a Label write **Precomputed queries 6** - `rapid7_insightidr.precomputed_queries.create` Create A Pre-Computed Query write - `rapid7_insightidr.precomputed_queries.delete` Delete A Pre-Computed Query destructive - `rapid7_insightidr.precomputed_queries.get` Retrieve A Pre-Computed Query read - `rapid7_insightidr.precomputed_queries.list` List All Pre-Computed Queries read - `rapid7_insightidr.precomputed_queries.query` Fetch Query Results read - `rapid7_insightidr.precomputed_queries.update` Replace a Pre-Computed Query write **Saved queries 6** - `rapid7_insightidr.saved_queries.create` Create A Saved Query write - `rapid7_insightidr.saved_queries.delete` Delete A Saved Query destructive - `rapid7_insightidr.saved_queries.get` Retrieve A Saved Query read - `rapid7_insightidr.saved_queries.list` List All Saved Queries read - `rapid7_insightidr.saved_queries.replace` Replace A Saved Query write - `rapid7_insightidr.saved_queries.update` Modify A Saved Query write **Comments 5** - `rapid7_insightidr.comments.create` Create comment write - `rapid7_insightidr.comments.delete` Delete a comment destructive - `rapid7_insightidr.comments.get` Get comment by rrn read - `rapid7_insightidr.comments.list` List comments read - `rapid7_insightidr.comments.set_visibility` Update comment visibility write **Leql variables 5** - `rapid7_insightidr.leql_variables.create` Create an LEQL variable write - `rapid7_insightidr.leql_variables.delete` Delete an LEQL variable destructive - `rapid7_insightidr.leql_variables.get` Retrieve an LEQL variable read - `rapid7_insightidr.leql_variables.list` List all LEQL variables read - `rapid7_insightidr.leql_variables.update` Update an LEQL variable write **Logs 5** - `rapid7_insightidr.logs.delete` Delete a Log destructive - `rapid7_insightidr.logs.get` Retrieve a Log read - `rapid7_insightidr.logs.get_top_keys` Retrieve Most Common Keys For A Log read - `rapid7_insightidr.logs.list` Retrieve All Logs read - `rapid7_insightidr.logs.list_event_sources` Retrieve Log Event Sources read **Notification targets 5** - `rapid7_insightidr.notification_targets.create` Create a Target write - `rapid7_insightidr.notification_targets.delete` Delete a Target destructive - `rapid7_insightidr.notification_targets.get` Retrieve a Target read - `rapid7_insightidr.notification_targets.list` List All Targets read - `rapid7_insightidr.notification_targets.update` Replace a Target write **S3 archiving 5** - `rapid7_insightidr.s3_archiving.create` Enable Daily Archiving write - `rapid7_insightidr.s3_archiving.delete` Disable Daily Archiving destructive - `rapid7_insightidr.s3_archiving.get` View Daily Archiving Settings read - `rapid7_insightidr.s3_archiving.replace` Replace Daily Archiving Settings write - `rapid7_insightidr.s3_archiving.update` Modify Daily Archiving Settings write **Alert fields 4** - `rapid7_insightidr.alert_fields.get` Retrieve a single alert field read - `rapid7_insightidr.alert_fields.list` Retrieves all supported alert fields V2 read - `rapid7_insightidr.alert_fields.list_legacy` Retrieve all alert fields read - `rapid7_insightidr.alert_fields.list_values` Retrieve values for a single alert field read **Audit log queries 4** - `rapid7_insightidr.audit_log_queries.list_endpoints` List All Endpoints read - `rapid7_insightidr.audit_log_queries.poll` Poll a Query In Progress read - `rapid7_insightidr.audit_log_queries.query_log` Query Individual Logs Using LEQL read - `rapid7_insightidr.audit_log_queries.run` Query Multiple Logs Using LEQL read **Community threats 4** - `rapid7_insightidr.community_threats.add_indicators` Add indicators to a Community Threat write - `rapid7_insightidr.community_threats.create` Create a Community Threat write - `rapid7_insightidr.community_threats.delete` Delete a Community Threat destructive - `rapid7_insightidr.community_threats.replace_indicators` Replace indicators for a Community Threat write **Investigations V1 4** - `rapid7_insightidr.investigations_v1.assign` Assign user to investigation write - `rapid7_insightidr.investigations_v1.bulk_close` Close investigations in bulk write - `rapid7_insightidr.investigations_v1.list` List investigations read - `rapid7_insightidr.investigations_v1.set_status` Set the status of an investigation write **Logsets 4** - `rapid7_insightidr.logsets.delete` Delete a Log Set destructive - `rapid7_insightidr.logsets.get` Retrieve a Log Set read - `rapid7_insightidr.logsets.list` List All Log Sets read - `rapid7_insightidr.logsets.update` Replace a Log Set write **Alert actions 3** - `rapid7_insightidr.alert_actions.get_result` Retrieve alert action result read - `rapid7_insightidr.alert_actions.list` Retrieve alert actions read - `rapid7_insightidr.alert_actions.list_tasks` Retrieve alert action tasks read **Attachments 3** - `rapid7_insightidr.attachments.delete` Delete an attachment destructive - `rapid7_insightidr.attachments.get` Get attachment information read - `rapid7_insightidr.attachments.list` List attachments read **Detection rule summaries 3** - `rapid7_insightidr.detection_rule_summaries.get` Get summary information for a Detection Rule or Custom Detection Rule by its RRN read - `rapid7_insightidr.detection_rule_summaries.list` Get summary information for all Detection Rules and Custom Detection Rules read - `rapid7_insightidr.detection_rule_summaries.search` Get summary information for a filtered list of Detection Rules and Custom Detection Rules read **Log exports 3** - `rapid7_insightidr.log_exports.delete` Delete An Export Job By Id destructive - `rapid7_insightidr.log_exports.get` Retrieve An Export Job By Id read - `rapid7_insightidr.log_exports.list` Retrieve All Export Jobs read **Usage 3** - `rapid7_insightidr.usage.get_log` Data Size For a Specific Log read - `rapid7_insightidr.usage.get_organization` Total Data Size Across All Logs read - `rapid7_insightidr.usage.list_logs` Data Size Broken Down By Log read **Accounts 2** - `rapid7_insightidr.accounts.get` Get account by RRN read - `rapid7_insightidr.accounts.search` Search accounts read **Assessment reports 2** - `rapid7_insightidr.assessment_reports.dismiss` Dismiss Assessment Reports write - `rapid7_insightidr.assessment_reports.search` Get filtered view of Assessment Reports read **Assets 2** - `rapid7_insightidr.assets.get` Get asset by RRN read - `rapid7_insightidr.assets.search` Search assets read **Audit exports 2** - `rapid7_insightidr.audit_exports.get` Retrieve An Export Job By Id read - `rapid7_insightidr.audit_exports.list` Retrieve All Export Jobs read **Audit logs 2** - `rapid7_insightidr.audit_logs.get` Retrieve An Audit Log read - `rapid7_insightidr.audit_logs.list` Retrieve All Audit Logs read **Local accounts 2** - `rapid7_insightidr.local_accounts.get` Get local account by RRN read - `rapid7_insightidr.local_accounts.search` Search local accounts read **Users 2** - `rapid7_insightidr.users.get` Get user by RRN read - `rapid7_insightidr.users.search` Search users read **API key 1** - `rapid7_insightidr.api_key.validate` Validate the API key read **Collectors 1** - `rapid7_insightidr.collectors.create` Add Collector write **Health metrics 1** - `rapid7_insightidr.health_metrics.list` Retrieve health metrics by org read **Health metrics V1 1** - `rapid7_insightidr.health_metrics_v1.list` Retrieve health metrics by org read Questions ## The Rapid7 InsightIDR MCP server, answered. **Is there a Rapid7 InsightIDR MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 174 Rapid7 InsightIDR actions across investigations, alerts, detection rules and rule exceptions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Rapid7 InsightIDR. **What do I need to connect Rapid7 InsightIDR?** Insight Platform API key: insight.rapid7.com > Administration > API Key Management > New User Key (or Organization Key). Plus your region. The free call account { op: "connections.requirements", service: "rapid7_insightidr" } lists exactly what to paste. **Can an AI agent delete or change things in Rapid7 InsightIDR?** Only if its key allows it, and only with an explicit confirmation. 18 Rapid7 InsightIDR actions are destructive, including obsolete a Custom Detection Rule based on an RRN, delete a comment and delete a Log. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Rapid7 InsightIDR API limit?** actionlake paces every call to the limits in the Rapid7 InsightIDR service file: 100 calls a minute per connection. Repeated reads are answered from cache (85 Rapid7 InsightIDR actions can be), which never reaches Rapid7 InsightIDR. **What does a Rapid7 InsightIDR action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (174 Rapid7 InsightIDR actions page). Cache hits, searches, dry runs and calls Rapid7 InsightIDR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Rapid7 InsightIDR API does it cover?** The InsightIDR API v1 + v2, SIEM Alerts API, Detection Rules API v1, Log Search REST API at your own api.insight.rapid7.com address, set when you connect. It is built from Rapid7 InsightIDR's documentation as read on 23 October 2026. 174 actions in 36 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Rapid7 InsightIDR data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Rapid7 InsightIDR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Rapid7 InsightIDR Shares the most action names with - [Sekoia.io 15](https://actionlake.com/connectors/sekoia-io) - [StrangeBee TheHive 10](https://actionlake.com/connectors/strangebee-thehive) - [Splunk SOAR 9](https://actionlake.com/connectors/splunk-soar) - [Torq 9](https://actionlake.com/connectors/torq) - [Expel Workbench 7](https://actionlake.com/connectors/expel-workbench) - [Panther 7](https://actionlake.com/connectors/panther) Joins with, on shared entities - [Acronis Cyber Protect Cloud 4](https://actionlake.com/connectors/acronis-cyber-protect-cloud) - [NinjaOne 3](https://actionlake.com/connectors/ninjaone) - [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud) - [Veeam Service Provider Console 3](https://actionlake.com/connectors/veeam-service-provider-console) - [Dynatrace 3](https://actionlake.com/connectors/dynatrace) - [Rootly 3](https://actionlake.com/connectors/rootly) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Rapid7 InsightIDR; the name is the vendor's own. Counts are from the Rapid7 InsightIDR service file, version 1.0.0. ## Give your agent Rapid7 InsightIDR today. [Connect Rapid7 InsightIDR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/rapid7-insightidr More: https://actionlake.com/llms.txt