Connectors · Identity & security
Sekoia.io MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Sekoia.io and the rest of your systems. It gives your agent 565 Sekoia.io actions (315 reads, 185 writes and 65 that wait for a confirmation) and holds the Sekoia.io credential itself, so the agent never does. It paces Sekoia.io's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "sekoia.assets.list", intent: "check which Sekoia.io account is connected"}# Search assets · read · 1 upstream call- 565actionsin one signed file
- 315readlook, never change
- 185writecreate and update
- 65wait for a yesdestructive, confirmed first
Set up
Connect Sekoia.io in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect Sekoia.io.
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_keySekoia.io API key: in the Sekoia app open Settings > Workspace > API keys, create a key and give it the roles the…hostWhere your Sekoia.io lives: your host
account { op: "connections.requirements", service: "sekoia" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "sekoia.assets.list" }# search assets · read · 1 upstream callcheck { action: "sekoia.communities_roles.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
Sekoia.io at a glance
- Sign-in
- Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_key- Setup fields
host- Limits we pace to
- 10 calls a second, per connection
- API covered
- Sekoia.io public API (v1 and v2 modules; Swagger 2.0 and OpenAPI 3.1 documents)
app.sekoia.io/api - Built from
- Sekoia.io's documentation, read 23 October 2026app.sekoia.ioapp.sekoia.ioapp.sekoia.io
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 271 of 315 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 4, so ask can line Sekoia.io up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in Sekoia.io.
565 actions in 183 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 315readlook, never change
- 185writecreate and update
- 65destructivewait for a confirmation
Communities licenses
142 read · 10 write · 2 destructive
Assign a trial license to the community · Create a self-service Committed license for the selected community (first license, or new module) · Create, update, or schedule a PAYG license for the selected community · List the licenses of a community
Playbooks
148 read · 5 write · 1 destructive
List available playbooks · Create a playbook · Get a playbook · Update a playbook
Assets
125 read · 6 write · 1 destructive
Search assets · Create an asset · Get an asset · Edit an asset
Rules
125 read · 6 write · 1 destructive
List rules · Create a new rule · Get a rule · Update a rule
Multi tenant rules
114 read · 6 write · 1 destructive
Create a new rule · List rules in multi-tenant mode · Get attack navigator matrix with the MITRE technique ids · Disable a rule
Formats
107 read · 2 write · 1 destructive
Create an intake format · Get the available fields leveraged by the formats · List intake formats · Parse a message against a provided format definition
Event search jobs
95 read · 3 write · 1 destructive
Create an event search job · Get the events found by an event search job in descending order · Export all the events matching a search job · Get the fields of the events found by an event search job
Telemetry assets
99 read · 0 write · 0 destructive
Get asset graph · Get the list of intake format UUIDs for the given assets · Get an asset's telemetry · Get target accounts for given asset
175 more areas · 474 actions
- Alerts 8
- Countermeasures 8
- Intakes 8
- Case templates 7
- Connector configurations 7
- Cti ioc collections indicators 7
- Cti objects 7
- Intakes optimization rules 7
- Notebooks queries 7
- Trigger configurations 7
- Alert countermeasure steps 6
- Cases 6
- Communities roles 6
- Cti ioc collections 6
- Cti labels 6
- Cti observables 6
- Custom priorities 6
- Custom statuses 6
- Custom verdicts 6
- Dashboards 6
- Module configurations 6
- Notebooks query parameters 6
- Alerts comments 5
- Assets applications 5
- Assets vulnerabilities 5
- Cases bulk 5
- Cases comments 5
- Communities 5
- Cti feeds 5
- Custom fields 5
- Entities 5
- Formats logs 5
- Generation modes 5
- Notebooks query runs 5
- Playbook runs 5
- Assets bulk 4
- Cases views 4
- Communities API keys 4
- Communities avatars 4
- Communities gated features 4
- Communities license templates 4
- Events 4
- Formats smart descriptions 4
- Modules 4
- Multi tenant rules alert filters 4
- Notebooks sol detection 4
- Rules alert filters 4
- Statistics alerts 4
- Users 4
- Actions 3
- Alert countermeasures 3
- Alerts bulk workflow 3
- Assets props 3
- Assets typed props 3
- Cases alerts 3
- Cases events 3
- Communities avatars roles 3
- Cti collections 3
- Cti indicators 3
- Cti statistics 3
- Formats doc 3
- Intakes settings 3
- Mfa 3
- Plans 3
- Rules compilation reports 3
- Telemetry cti objects 3
- Telemetry intakes 3
- Telemetry observables 3
- Webhooks 3
- Alert countermeasure steps comments 2
- Alert countermeasures comments 2
- Alerts bulk 2
- Alerts countermeasures 2
- Alerts history 2
- Alerts objects 2
- Alerts threats 2
- Alerts workflow 2
- Assets risk score 2
- Assets tags 2
- Auth 2
- Avatars 2
- Cases countermeasures 2
- Communities licenses alerting 2
- Communities sub communities 2
- Communities teams members 2
- Community settings 2
- Connectors 2
- Cti exports 2
- Cti ioc collections telemetry reports 2
- Cti kill chains 2
- Cti objects notes 2
- Cti objects relationships 2
- Cti observable relationships 2
- Cti relationships 2
- Cti reports 2
- Formats revisions 2
- Invitations 2
- Kill chains 2
- Mfa totp 2
- Multi tenant rules setting 2
- Notebooks datasets 2
- Rules runbook 2
- Rules setting 2
- Rules statistics 2
- Telemetry AI usage 2
- Telemetry events 2
- Telemetry events by status 2
- Telemetry playbook action runs 2
- Telemetry tokens 2
- Triggers 2
- Users sessions 2
- Alert categories catalog 1
- Alert types catalog 1
- Alerts custom fields 1
- Alerts entities 1
- Alerts history comments 1
- Alerts rules 1
- Alerts sources 1
- Alerts statuses 1
- Alerts targets 1
- Alerts titles 1
- Alerts types 1
- Asset tags 1
- Atoms 1
- Cases assets 1
- Cases custom fields 1
- Cases entities 1
- Cases history 1
- Cases kill chains 1
- Cases rules 1
- Cases tags 1
- Cases threats 1
- Comments 1
- Communities permissions 1
- Communities picture 1
- Communities teams 1
- Communities terms 1
- Communities users 1
- Cti bundles 1
- Cti objects observables 1
- Cti objects reports 1
- Cti objects sources 1
- Cti observables indicators 1
- Cti observables relationships 1
- Cti observables reports 1
- Cti reports objects 1
- Cti reports observables 1
- Cti sources 1
- Cti vulnerabilities 1
- Datasources 1
- Edl 1
- Events anomalies 1
- Formats picture 1
- Intakes office365 1
- Me 1
- Me communities 1
- Me permissions 1
- Me terms 1
- Mfa recovery 1
- Mfa webauthn 1
- Multi tenant tags 1
- Node runs 1
- Notebooks 1
- Notebooks sol detection results 1
- Notebooks sol detection schedules 1
- Playbook runs node runs 1
- Playbooks revisions 1
- SSH keys 1
- Support 1
- Tags 1
- Telemetry alert filters 1
- Telemetry parsing issues 1
- Telemetry rules 1
- Users avatars 1
- Users picture 1
Top actions
The Sekoia.io API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 42 of Sekoia.io's 42 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
sekoia.communities_roles.listList the roles of a community | List the roles of a community. | read | identity.role.list184 connectors |
sekoia.me.getGet all information of the current profile | Get all information of the current profile. | read | identity.current_user.get307 connectors |
sekoia.communities_roles.createCreate a new role in the community | Create a new role in the community. | write | identity.role.create105 connectors |
sekoia.assets.listSearch assets | Search assets. | read | asset.asset.list42 connectors |
sekoia.communities_roles.deleteDelete a role from the given community | Delete a role from the given community. | destructive | identity.role.delete106 connectors |
sekoia.users.createCreates an user account | Creates an user account. | write | identity.user.create262 connectors |
sekoia.users.getGet a user given its UUID | Get a user given its UUID. | read | identity.user.get399 connectors |
sekoia.communities_api_keys.createCreate a new API Key | Create a new API Key. | write | identity.api_key.create100 connectors |
sekoia.communities_api_keys.listList apikeys | List apikeys. | read | identity.api_key.list96 connectors |
sekoia.alerts.listList alerts | List alerts. | read | security.alert.list22 connectors |
sekoia.assets.createCreate an asset | Create an asset. | write | asset.asset.create27 connectors |
sekoia.cases.listList cases | List cases. | read | security.incident.list17 connectors |
Try it
Prompts to paste into Claude.
Each one names the Sekoia.io actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Search assets in Sekoia.io and tell me what stands out.
calls
sekoia.assets.list - Writewrite
Create a new role in the community in Sekoia.io. Show me exactly what you will send before you save it.
calls
sekoia.communities_roles.create
Governance for Sekoia.io
Destructive actions wait for a yes.
65 Sekoia.io actions are destructive. The first 10:
- Delete a role from the given community
sekoia.communities_roles.delete - Delete a rule
sekoia.rules.delete - Delete a comment from a case
sekoia.cases_comments.delete - Delete a case
sekoia.cases.delete - Delete an alert
sekoia.alerts.delete - Delete a playbook
sekoia.playbooks.delete - Revoke a 2FA token by UUID
sekoia.mfa.revoke - Revoke an asset
sekoia.assets.revoke - Delete format definition
sekoia.formats.delete - Delete an intake
sekoia.intakes.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete a role from the given community?
intent: the user asked me to delete a role from the given community
account { op: "keys.create", name: "sekoia-agent", allowed_actions: ["sekoia.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "sekoia.communities_roles.delete", approver: "[email protected]" }, { match: "sekoia.rules.delete", approver: "[email protected]" }, { match: "sekoia.cases_comments.delete", approver: "[email protected]" } ]}Cost
What Sekoia.io costs on actionlake.
Every Sekoia.io action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Sekoia.io refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 565 Sekoia.io actions
- 565actions pageeach page of a long list is one call
- 271reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every Sekoia.io action.
565 actions by area: the id your agent calls, what it does, and its effect.
Communities licenses14
sekoia.communities_licenses.assign_trialAssign a trial license to the communitywritesekoia.communities_licenses.create_committedCreate a self-service Committed license for the selected community (first license, or new module)write- and 12 more in this area
Playbooks14
sekoia.playbooks.createCreate a playbookwritesekoia.playbooks.getGet a playbookread- and 12 more in this area
Assets12
sekoia.assets.createCreate an assetwritesekoia.assets.getGet an assetread- and 10 more in this area
Rules12
sekoia.rules.createCreate a new rulewritesekoia.rules.getGet a ruleread- and 10 more in this area
Multi tenant rules11
sekoia.multi_tenant_rules.attack_navigatorGet attack navigator matrix with the MITRE technique idsreadsekoia.multi_tenant_rules.createCreate a new rulewrite- and 9 more in this area
Formats10
sekoia.formats.createCreate an intake formatwritesekoia.formats.fieldsGet the available fields leveraged by the formatsread- and 8 more in this area
Event search jobs9
sekoia.event_search_jobs.createCreate an event search jobwritesekoia.event_search_jobs.eventsGet the events found by an event search job in descending orderread- and 7 more in this area
Telemetry assets9
sekoia.telemetry_assets.accountsGet target accounts for given assetreadsekoia.telemetry_assets.graphGet asset graphread- and 7 more in this area
Alerts8
sekoia.alerts.deleteDelete an alertdestructivesekoia.alerts.getGet a single alert by its UUIDread- and 6 more in this area
Countermeasures8
sekoia.countermeasures.createCreate a new set of countermeasureswritesekoia.countermeasures.getGet set of countermeasuresread- and 6 more in this area
Intakes8
sekoia.intakes.configured_formatsList Configured formatsreadsekoia.intakes.createCreate a new intakewrite- and 6 more in this area
Case templates7
sekoia.case_templates.applyApply a case template to caseswritesekoia.case_templates.createCreate a new case templatewrite- and 5 more in this area
Connector configurations7
sekoia.connector_configurations.createCreate connector configurationwritesekoia.connector_configurations.getGet connector configurationread- and 5 more in this area
Cti ioc collections indicators7
sekoia.cti_ioc_collections_indicators.createCreate indicators in the given IOC collectionwritesekoia.cti_ioc_collections_indicators.create_from_textBulk create indicatorswrite- and 5 more in this area
Cti objects7
sekoia.cti_objects.listList objectsreadsekoia.cti_objects.list_lightList objects (light)read- and 5 more in this area
Intakes optimization rules7
sekoia.intakes_optimization_rules.actionsList Actions supported for Optimization rulesreadsekoia.intakes_optimization_rules.createCreate a new optimization rulewrite- and 5 more in this area
Notebooks queries7
sekoia.notebooks_queries.bulk_updateBulk Updatewritesekoia.notebooks_queries.createSave Querywrite- and 5 more in this area
Trigger configurations7
sekoia.trigger_configurations.createCreate a trigger configurationwritesekoia.trigger_configurations.emit_eventEmit event for trigger configurationwrite- and 5 more in this area
Alert countermeasure steps6
sekoia.alert_countermeasure_steps.activateActivate an action step of a countermeasurewritesekoia.alert_countermeasure_steps.createCreate or update an action step in the countermeasurewrite- and 4 more in this area
Cases6
sekoia.cases.createCreate a new casewritesekoia.cases.getGet a case by its UUIDread- and 4 more in this area
Communities roles6
sekoia.communities_roles.createCreate a new role in the communitywritesekoia.communities_roles.deleteDelete a role from the given communitydestructive- and 4 more in this area
Cti ioc collections6
sekoia.cti_ioc_collections.count_total_iocsCount indicators in a communityreadsekoia.cti_ioc_collections.createCreate a new IOC collectionwrite- and 4 more in this area
Cti labels6
sekoia.cti_labels.add_labelAdd a new label value to groupwritesekoia.cti_labels.createCreate a new labelwrite- and 4 more in this area
Cti observables6
sekoia.cti_observables.bulk_searchBulk search observablesreadsekoia.cti_observables.countCount observablesread- and 4 more in this area
Custom priorities6
sekoia.custom_priorities.createCreate a new custom prioritywritesekoia.custom_priorities.getGet a single custom priority based on its UUIDread- and 4 more in this area
Custom statuses6
sekoia.custom_statuses.createCreate a new custom statuswritesekoia.custom_statuses.getGet a custom status based on its UUIDread- and 4 more in this area
Custom verdicts6
sekoia.custom_verdicts.createCreate a new custom verdictwritesekoia.custom_verdicts.getGet a single custom verdict based on its UUIDread- and 4 more in this area
Dashboards6
sekoia.dashboards.createCreate a new dashboardwritesekoia.dashboards.getGet a dashboard by its UUIDread- and 4 more in this area
Module configurations6
sekoia.module_configurations.createCreate a module configurationwritesekoia.module_configurations.getGet a module configurationread- and 4 more in this area
Notebooks query parameters6
sekoia.notebooks_query_parameters.createCreate Query Parameterwritesekoia.notebooks_query_parameters.getGet Query Parameterread- and 4 more in this area
Alerts comments 5Assets applications 5Assets vulnerabilities 5Cases bulk 5Cases comments 5Communities 5Cti feeds 5Custom fields 5Entities 5Formats logs 5Generation modes 5Notebooks query runs 5Playbook runs 5Assets bulk 4Cases views 4Communities API keys 4Communities avatars 4Communities gated features 4Communities license templates 4Events 4Formats smart descriptions 4Modules 4Multi tenant rules alert filters 4Notebooks sol detection 4Rules alert filters 4Statistics alerts 4Users 4Actions 3Alert countermeasures 3Alerts bulk workflow 3Assets props 3Assets typed props 3Cases alerts 3Cases events 3Communities avatars roles 3Cti collections 3Cti indicators 3Cti statistics 3Formats doc 3Intakes settings 3Mfa 3Plans 3Rules compilation reports 3Telemetry cti objects 3Telemetry intakes 3Telemetry observables 3Webhooks 3Alert countermeasure steps comments 2Alert countermeasures comments 2Alerts bulk 2Alerts countermeasures 2Alerts history 2Alerts objects 2Alerts threats 2Alerts workflow 2Assets risk score 2Assets tags 2Auth 2Avatars 2Cases countermeasures 2Communities licenses alerting 2Communities sub communities 2Communities teams members 2Community settings 2Connectors 2Cti exports 2Cti ioc collections telemetry reports 2Cti kill chains 2Cti objects notes 2Cti objects relationships 2Cti observable relationships 2Cti relationships 2Cti reports 2Formats revisions 2Invitations 2Kill chains 2Mfa totp 2Multi tenant rules setting 2Notebooks datasets 2Rules runbook 2Rules setting 2Rules statistics 2Telemetry AI usage 2Telemetry events 2Telemetry events by status 2Telemetry playbook action runs 2Telemetry tokens 2Triggers 2Users sessions 2Alert categories catalog 1Alert types catalog 1Alerts custom fields 1Alerts entities 1Alerts history comments 1Alerts rules 1Alerts sources 1Alerts statuses 1Alerts targets 1Alerts titles 1Alerts types 1Asset tags 1Atoms 1Cases assets 1Cases custom fields 1Cases entities 1Cases history 1Cases kill chains 1Cases rules 1Cases tags 1Cases threats 1Comments 1Communities permissions 1Communities picture 1Communities teams 1Communities terms 1Communities users 1Cti bundles 1Cti objects observables 1Cti objects reports 1Cti objects sources 1Cti observables indicators 1Cti observables relationships 1Cti observables reports 1Cti reports objects 1Cti reports observables 1Cti sources 1Cti vulnerabilities 1Datasources 1Edl 1Events anomalies 1Formats picture 1Intakes office365 1Me 1Me communities 1Me permissions 1Me terms 1Mfa recovery 1Mfa webauthn 1Multi tenant tags 1Node runs 1Notebooks 1Notebooks sol detection results 1Notebooks sol detection schedules 1Playbook runs node runs 1Playbooks revisions 1SSH keys 1Support 1Tags 1Telemetry alert filters 1Telemetry parsing issues 1Telemetry rules 1Users avatars 1Users picture 1
This index shows a sample of each area. All 565 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The Sekoia.io MCP server, answered.
Is there a Sekoia.io MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 565 Sekoia.io actions across communities licenses, playbooks, assets and rules, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Sekoia.io.
What do I need to connect Sekoia.io?
Sekoia.io API key: in the Sekoia app open Settings > Workspace > API keys, create a key and give it the roles the…. Plus your host. The free call account { op: "connections.requirements", service: "sekoia" } lists exactly what to paste.
Can an AI agent delete or change things in Sekoia.io?
Only if its key allows it, and only with an explicit confirmation. 65 Sekoia.io actions are destructive, including delete a role from the given community, delete a rule and delete a comment from a case. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my Sekoia.io API limit?
actionlake paces every call to the limits in the Sekoia.io service file: 10 calls a second per connection. Repeated reads are answered from cache (271 Sekoia.io actions can be), which never reaches Sekoia.io.
What does a Sekoia.io action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (565 Sekoia.io actions page). Cache hits, searches, dry runs and calls Sekoia.io refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which Sekoia.io API does it cover?
The Sekoia.io public API (v1 and v2 modules; Swagger 2.0 and OpenAPI 3.1 documents) at app.sekoia.io/api by default, or the base URL set when you connect. It is built from Sekoia.io's documentation as read on 23 October 2026. 565 actions in 183 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my Sekoia.io data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Sekoia.io credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent Sekoia.io today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
