Connectors · MSP & PSA

SentinelOne Singularity MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to SentinelOne Singularity and the rest of your systems. It gives your agent 174 SentinelOne Singularity actions (73 reads, 79 writes and 22 that wait for a confirmation) and holds the SentinelOne Singularity credential itself, so the agent never does. It paces SentinelOne Singularity's limits and records every call.

Connect SentinelOne Singularity free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

174actionsin one signed file
73readlook, never change
79writecreate and update
22wait for a yesdestructive, confirmed first

Set up

Connect SentinelOne Singularity in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect SentinelOne Singularity.
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- api_tokenSentinelOne API token: console > Settings > Users > Service Users (recommended) or My User > Actions > API Token…
- hostWhere your SentinelOne Singularity lives: your host
```
account { op: "connections.requirements", service: "sentinelone_singularity" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "sentinelone_singularity.users.list" }# list console users · read · 1 upstream callcheck { action: "sentinelone_singularity.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

SentinelOne Singularity at a glance

Sign-in: API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: api_token
Setup fields: host
Limits we pace to: 10 calls a second, per connection
API covered: SentinelOne Management API v2.1, at your SentinelOne Singularity instance's API base URL, which you enter when connecting (path /web/api/v2.1)
Built from: SentinelOne Singularity's documentation, read 22 October 2026usea1-partners.sentinelone.net GitHub GitHub
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 70 of 73 reads, for up to 2 minutes; a write clears what it affects
Shared entities: 4, so ask can line SentinelOne Singularity up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in SentinelOne Singularity.

174 actions in 27 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

73readlook, never change
79writecreate and update
22destructivewait for a confirmation

Agents
33
6 read · 21 write · 6 destructive
List agents · Count agents · Disable agents · Enable agents
Threats
24
11 read · 12 write · 1 destructive
List threats · Create threats from IOCs · List a threat's related events · List threat free-text filters
Sites
11
3 read · 7 write · 1 destructive
List sites · Create a site · Expire a site now · Get a site
Accounts
10
4 read · 6 write · 0 destructive
Create an account · List accounts · Expire an account now · Get an account
Groups
10
3 read · 6 write · 1 destructive
Create a group · List groups · Get a group · Move agents into a group
Device control
9
3 read · 4 write · 2 destructive
Create a device control rule · List device control events · List device control rules · Get device control configuration
Users
9
4 read · 3 write · 2 destructive
List console users · Create a console user · Get a console user · Update a console user
Firewall
8
2 read · 4 write · 2 destructive
List firewall rules · Create a firewall rule · Get firewall control configuration · Update firewall control configuration

19 more areas · 60 actions

DV 7
Installed applications 6
Rules 6
Blocklist 4
Exclusions 4
Remote scripts 4
Alerts 3
App management 3
Hashes 3
Iocs 3
System 3
Unified exclusions 3
Activities 2
Roles 2
Tenant 2
Unified alerts 2
Marketplace 1
Packages 1
Service users 1

Top actions

The SentinelOne Singularity API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 22 of SentinelOne Singularity's 22 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`sentinelone_singularity.users.list`List console users	List console users.	read	`identity.user.list`474 connectors
`sentinelone_singularity.roles.list`List RBAC roles	List RBAC roles.	read	`identity.role.list`184 connectors
`sentinelone_singularity.users.create`Create a console user	Create a console user.	write	`identity.user.create`262 connectors
`sentinelone_singularity.users.update`Update a console user	Update a console user.	write	`identity.user.update`280 connectors
`sentinelone_singularity.users.delete`Delete a console user	Delete a console user.	destructive	`identity.user.delete`253 connectors
`sentinelone_singularity.roles.get`Get an RBAC role	Get an RBAC role.	read	`identity.role.get`127 connectors
`sentinelone_singularity.agents.list`List agents	List agents.	read	`device.endpoint.list`65 connectors
`sentinelone_singularity.users.me`Get the current user	Get the current user.	read	`identity.current_user.get`307 connectors
`sentinelone_singularity.service_users.list`List service users	List service users.	read	`identity.service_account.list`35 connectors
`sentinelone_singularity.activities.list`List activities	List activities.	read	`security.audit_log.list`69 connectors
`sentinelone_singularity.alerts.list`List alerts	List alerts.	read	`security.alert.list`22 connectors
`sentinelone_singularity.rules.create`Create a custom detection rule	Create a custom detection rule.	write	`security.detection_rule.create`11 connectors

Try it

Prompts to paste into Claude.

Each one names the SentinelOne Singularity actions it will call, so you know what it reads and what it changes before you send it.

Readread
Which SentinelOne Singularity devices have not checked in for a week?
callssentinelone_singularity.agents.list
Writewrite
Create a console user in SentinelOne Singularity. Show me exactly what you will send before you save it.
callssentinelone_singularity.users.create
Across systemsread
Which SentinelOne Singularity companies have invoices in NetSuite, and how many each?
callssentinelone_singularity.sites.listnetsuite.views.invoices

Across your systems

SentinelOne Singularity, joined to the rest of your business.

One ask fetches from SentinelOne Singularity and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

Which SentinelOne Singularity companies have invoices in NetSuite, and how many each?
sentinelone_singularity.sites.list + netsuite.views.invoices, on crm.company · NetSuite
Which SentinelOne Singularity companies have tickets in HubSpot CRM, and how many each?
sentinelone_singularity.sites.list + hubspot_crm.tickets.list, on crm.company · HubSpot CRM

Also mapped by other connectorsidentity.user 517crm.company 227identity.role 107device.endpoint 69

ask

ask {  intent: "which SentinelOne Singularity companies have invoices in NetSuite, and how many each",  steps: [    { action: "sentinelone_singularity.sites.list", as: "co", input: {}, limit: 100, max_pages: 5 },    { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "co",        right: "inv",        on: "crm.company",        group_by: "co.name",        select: ["co.name", "count(inv.id) as invoices"]    } }  ]}

Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for SentinelOne Singularity

Destructive actions wait for a yes.

22 SentinelOne Singularity actions are destructive. These are all of them:

Delete a console usersentinelone_singularity.users.delete
Delete threat intelligence IOCssentinelone_singularity.iocs.delete
Delete custom detection rulessentinelone_singularity.rules.delete
Delete a sitesentinelone_singularity.sites.delete
Delete a groupsentinelone_singularity.groups.delete
Shut down endpointssentinelone_singularity.agents.shutdown
Delete firewall rulessentinelone_singularity.firewall.delete
Uninstall agentssentinelone_singularity.agents.uninstall
Remove blocklist entriessentinelone_singularity.blocklist.delete
Disable firewall rulessentinelone_singularity.firewall.disable
Delete exclusionssentinelone_singularity.exclusions.delete
Delete console users in bulksentinelone_singularity.users.delete_bulk
Decommission agentssentinelone_singularity.agents.decommission
Delete a threat notesentinelone_singularity.threats.notes_delete
Delete device control rulessentinelone_singularity.device_control.delete
Restart endpointssentinelone_singularity.agents.restart_machine
Disable device control rulessentinelone_singularity.device_control.disable
Run a remote scriptsentinelone_singularity.remote_scripts.execute
Reject agent uninstall requestssentinelone_singularity.agents.reject_uninstall
Approve agent uninstall requestssentinelone_singularity.agents.approve_uninstall
Delete unified exclusionssentinelone_singularity.unified_exclusions.delete
Cancel a Deep Visibility querysentinelone_singularity.dv.cancel_query

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dosentinelone_singularity.users.deleteconfirm_policy: human

Delete a console user?

intent: the user asked me to delete a console user

run suspended · waiting for a named person · key sentinelone-singularity-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "sentinelone-singularity-agent",  allowed_actions: ["sentinelone_singularity.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "sentinelone_singularity.users.delete", approver: "[email protected]" },    { match: "sentinelone_singularity.iocs.delete", approver: "[email protected]" },    { match: "sentinelone_singularity.rules.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to SentinelOne Singularity only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What SentinelOne Singularity costs on actionlake.

Every SentinelOne Singularity action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call SentinelOne Singularity refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 174 SentinelOne Singularity actions
174actions pageeach page of a long list is one call
70reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every SentinelOne Singularity action.

174 actions by area: the id your agent calls, what it does, and its effect.

Agents33

sentinelone_singularity.agents.abort_scanAbort a full disk scanwrite
sentinelone_singularity.agents.applicationsList an agent's installed applicationsread
sentinelone_singularity.agents.approve_uninstallApprove agent uninstall requestsdestructive
sentinelone_singularity.agents.broadcastSend a message to agentswrite
sentinelone_singularity.agents.connectReconnect agents to the networkwrite
sentinelone_singularity.agents.countCount agentsread
sentinelone_singularity.agents.decommissionDecommission agentsdestructive
sentinelone_singularity.agents.disable_agentDisable agentswrite
sentinelone_singularity.agents.disconnectDisconnect agents from the networkwrite
sentinelone_singularity.agents.enable_agentEnable agentswrite
sentinelone_singularity.agents.fetch_filesFetch files from an agentwrite
sentinelone_singularity.agents.fetch_firewall_rulesFetch agent firewall ruleswrite
sentinelone_singularity.agents.fetch_installed_appsRefresh installed applicationswrite
sentinelone_singularity.agents.fetch_logsFetch agent logswrite
sentinelone_singularity.agents.firewall_loggingSet agent firewall loggingwrite
sentinelone_singularity.agents.initiate_scanStart a full disk scanwrite
sentinelone_singularity.agents.listList agentsread
sentinelone_singularity.agents.manage_tagsAdd, remove or override agent tagswrite
sentinelone_singularity.agents.mark_up_to_dateMark agents as up to datewrite
sentinelone_singularity.agents.move_to_siteMove agents to another sitewrite
sentinelone_singularity.agents.passphrasesList agent passphrasesread
sentinelone_singularity.agents.processesList an agent's running processesread
sentinelone_singularity.agents.randomize_uuidRandomise agent UUIDswrite
sentinelone_singularity.agents.reject_uninstallReject agent uninstall requestsdestructive
sentinelone_singularity.agents.reset_local_configReset agents' local configurationwrite
sentinelone_singularity.agents.restart_machineRestart endpointsdestructive
sentinelone_singularity.agents.set_external_idSet agents' external idwrite
sentinelone_singularity.agents.shutdownShut down endpointsdestructive
sentinelone_singularity.agents.start_remote_profilingStart remote profilingwrite
sentinelone_singularity.agents.stop_remote_profilingStop remote profilingwrite
sentinelone_singularity.agents.summaryGet agent summary countsread
sentinelone_singularity.agents.uninstallUninstall agentsdestructive
sentinelone_singularity.agents.update_softwareUpdate agent softwarewrite

Threats24

sentinelone_singularity.threats.add_to_blacklistAdd threat hashes to the blocklistwrite
sentinelone_singularity.threats.add_to_exclusionsAdd threats to the exclusion listwrite
sentinelone_singularity.threats.analysisGet a threat's analysisread
sentinelone_singularity.threats.analyst_verdictSet the analyst verdict on threatswrite
sentinelone_singularity.threats.create_from_iocCreate threats from IOCswrite
sentinelone_singularity.threats.download_from_cloudGet a threat file cloud download linkread
sentinelone_singularity.threats.explore_eventsList a threat's related eventsread
sentinelone_singularity.threats.fetch_fileFetch threat files from endpointswrite
sentinelone_singularity.threats.forensicsGet threat forensicsread
sentinelone_singularity.threats.forensics_detailsGet threat forensics detailsread
sentinelone_singularity.threats.free_text_filtersList threat free-text filtersread
sentinelone_singularity.threats.incidentSet the incident status of threatswrite
sentinelone_singularity.threats.listList threatsread
sentinelone_singularity.threats.mark_as_benignMark threats as benignwrite
sentinelone_singularity.threats.mark_as_resolvedMark threats as resolvedwrite
sentinelone_singularity.threats.mark_as_threatMark threats as threatswrite
sentinelone_singularity.threats.mitigateMitigate threatswrite
sentinelone_singularity.threats.notes_addAdd a note to threatswrite
sentinelone_singularity.threats.notes_deleteDelete a threat notedestructive
sentinelone_singularity.threats.notes_listList a threat's notesread
sentinelone_singularity.threats.notes_updateUpdate a threat notewrite
sentinelone_singularity.threats.seen_on_networkList where a threat was seen on the networkread
sentinelone_singularity.threats.summaryGet threat summary countsread
sentinelone_singularity.threats.timelineGet a threat's timelineread

Sites11

sentinelone_singularity.sites.createCreate a sitewrite
sentinelone_singularity.sites.deleteDelete a sitedestructive
sentinelone_singularity.sites.expire_nowExpire a site nowwrite
sentinelone_singularity.sites.getGet a siteread
sentinelone_singularity.sites.listList sitesread
sentinelone_singularity.sites.policy_getGet a site policyread
sentinelone_singularity.sites.policy_revertRevert a site policy to inheritedwrite
sentinelone_singularity.sites.policy_updateUpdate a site policywrite
sentinelone_singularity.sites.reactivateReactivate a sitewrite
sentinelone_singularity.sites.regenerate_keyRegenerate a site tokenwrite
sentinelone_singularity.sites.updateUpdate a sitewrite

Accounts10

sentinelone_singularity.accounts.createCreate an accountwrite
sentinelone_singularity.accounts.expire_nowExpire an account nowwrite
sentinelone_singularity.accounts.getGet an accountread
sentinelone_singularity.accounts.listList accountsread
sentinelone_singularity.accounts.name_availableCheck account name availabilityread
sentinelone_singularity.accounts.policy_getGet an account policyread
sentinelone_singularity.accounts.policy_revertRevert an account policy to inheritedwrite
sentinelone_singularity.accounts.policy_updateUpdate an account policywrite
sentinelone_singularity.accounts.reactivateReactivate an accountwrite
sentinelone_singularity.accounts.updateUpdate an accountwrite

Groups10

sentinelone_singularity.groups.createCreate a groupwrite
sentinelone_singularity.groups.deleteDelete a groupdestructive
sentinelone_singularity.groups.getGet a groupread
sentinelone_singularity.groups.listList groupsread
sentinelone_singularity.groups.move_agentsMove agents into a groupwrite
sentinelone_singularity.groups.policy_getGet a group policyread
sentinelone_singularity.groups.policy_revertRevert a group policy to inheritedwrite
sentinelone_singularity.groups.policy_updateUpdate a group policywrite
sentinelone_singularity.groups.regenerate_keyRegenerate a group tokenwrite
sentinelone_singularity.groups.updateUpdate a groupwrite

Device control9

sentinelone_singularity.device_control.configuration_getGet device control configurationread
sentinelone_singularity.device_control.configuration_updateUpdate device control configurationwrite
sentinelone_singularity.device_control.createCreate a device control rulewrite
sentinelone_singularity.device_control.deleteDelete device control rulesdestructive
sentinelone_singularity.device_control.disableDisable device control rulesdestructive
sentinelone_singularity.device_control.enableEnable device control ruleswrite
sentinelone_singularity.device_control.eventsList device control eventsread
sentinelone_singularity.device_control.listList device control rulesread
sentinelone_singularity.device_control.updateUpdate a device control rulewrite

Users9

sentinelone_singularity.users.createCreate a console userwrite
sentinelone_singularity.users.deleteDelete a console userdestructive
sentinelone_singularity.users.delete_bulkDelete console users in bulkdestructive
sentinelone_singularity.users.elevateElevate the session for protected actionswrite
sentinelone_singularity.users.getGet a console userread
sentinelone_singularity.users.listList console usersread
sentinelone_singularity.users.meGet the current userread
sentinelone_singularity.users.updateUpdate a console userwrite
sentinelone_singularity.users.viewer_auth_checkCheck viewer authorisationread

Firewall8

sentinelone_singularity.firewall.configuration_getGet firewall control configurationread
sentinelone_singularity.firewall.configuration_updateUpdate firewall control configurationwrite
sentinelone_singularity.firewall.createCreate a firewall rulewrite
sentinelone_singularity.firewall.deleteDelete firewall rulesdestructive
sentinelone_singularity.firewall.disableDisable firewall rulesdestructive
sentinelone_singularity.firewall.enableEnable firewall ruleswrite
sentinelone_singularity.firewall.listList firewall rulesread
sentinelone_singularity.firewall.updateUpdate a firewall rulewrite

DV7

sentinelone_singularity.dv.cancel_queryCancel a Deep Visibility querydestructive
sentinelone_singularity.dv.eventsList Deep Visibility eventsread
sentinelone_singularity.dv.events_by_typeList Deep Visibility events of one typeread
sentinelone_singularity.dv.init_queryStart a Deep Visibility querywrite
sentinelone_singularity.dv.power_queryRun a PowerQuerywrite
sentinelone_singularity.dv.power_query_pingPoll a PowerQueryread
sentinelone_singularity.dv.query_statusGet a Deep Visibility query's statusread

Installed applications6

sentinelone_singularity.installed_applications.app_cvesList CVEs of one installed applicationread
sentinelone_singularity.installed_applications.cvesList CVEs on installed applicationsread
sentinelone_singularity.installed_applications.filters_countCount installed applications per filter valueread
sentinelone_singularity.installed_applications.free_text_filtersList installed-application free-text filtersread
sentinelone_singularity.installed_applications.listList installed applicationsread
sentinelone_singularity.installed_applications.risk_levels_countCount installed applications by risk levelread

Rules6

sentinelone_singularity.rules.createCreate a custom detection rulewrite
sentinelone_singularity.rules.deleteDelete custom detection rulesdestructive
sentinelone_singularity.rules.disableDisable custom detection ruleswrite
sentinelone_singularity.rules.enableEnable custom detection ruleswrite
sentinelone_singularity.rules.listList custom detection rulesread
sentinelone_singularity.rules.updateUpdate a custom detection rulewrite

Blocklist4

sentinelone_singularity.blocklist.createAdd blocklist entrieswrite
sentinelone_singularity.blocklist.deleteRemove blocklist entriesdestructive
sentinelone_singularity.blocklist.listList blocklist entriesread
sentinelone_singularity.blocklist.updateUpdate a blocklist entrywrite

Exclusions4

sentinelone_singularity.exclusions.createCreate exclusionswrite
sentinelone_singularity.exclusions.deleteDelete exclusionsdestructive
sentinelone_singularity.exclusions.listList exclusionsread
sentinelone_singularity.exclusions.updateUpdate an exclusionwrite

Remote scripts4

sentinelone_singularity.remote_scripts.executeRun a remote scriptdestructive
sentinelone_singularity.remote_scripts.fetch_resultsGet remote script result download linksread
sentinelone_singularity.remote_scripts.listList remote scriptsread
sentinelone_singularity.remote_scripts.statusList remote script task statusread

Alerts3

sentinelone_singularity.alerts.analyst_verdictSet the analyst verdict on alertswrite
sentinelone_singularity.alerts.incidentSet the incident status of alertswrite
sentinelone_singularity.alerts.listList alertsread

App management3

sentinelone_singularity.app_management.inventoryList application inventoryread
sentinelone_singularity.app_management.inventory_endpointsList endpoints running an applicationread
sentinelone_singularity.app_management.risksList application risks (CVEs)read

Hashes3

sentinelone_singularity.hashes.classificationGet a hash's classificationread
sentinelone_singularity.hashes.reputationGet a hash's reputationread
sentinelone_singularity.hashes.verdictGet a hash's verdictread

Iocs3

sentinelone_singularity.iocs.createCreate threat intelligence IOCswrite
sentinelone_singularity.iocs.deleteDelete threat intelligence IOCsdestructive
sentinelone_singularity.iocs.listList threat intelligence IOCsread

System3

sentinelone_singularity.system.configuration_getGet system configurationread
sentinelone_singularity.system.infoGet system inforead
sentinelone_singularity.system.statusGet system statusread

Unified exclusions3

sentinelone_singularity.unified_exclusions.createCreate a unified exclusionwrite
sentinelone_singularity.unified_exclusions.deleteDelete unified exclusionsdestructive
sentinelone_singularity.unified_exclusions.listList unified exclusionsread

Activities2

sentinelone_singularity.activities.listList activitiesread
sentinelone_singularity.activities.typesList activity typesread

Roles2

sentinelone_singularity.roles.getGet an RBAC roleread
sentinelone_singularity.roles.listList RBAC rolesread

Tenant2

sentinelone_singularity.tenant.policy_getGet the global policyread
sentinelone_singularity.tenant.policy_updateUpdate the global policywrite

Unified alerts2

sentinelone_singularity.unified_alerts.graphqlQuery unified alerts (GraphQL)read
sentinelone_singularity.unified_alerts.graphql_mutateChange unified alerts (GraphQL mutation)write

Marketplace1

sentinelone_singularity.marketplace.applicationsList installed marketplace applicationsread

Packages1

sentinelone_singularity.packages.listList agent installation packagesread

Service users1

sentinelone_singularity.service_users.listList service usersread

Questions

The SentinelOne Singularity MCP server, answered.

Is there a SentinelOne Singularity MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 174 SentinelOne Singularity actions across agents, threats, sites and accounts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by SentinelOne Singularity.

What do I need to connect SentinelOne Singularity?

SentinelOne API token: console > Settings > Users > Service Users (recommended) or My User > Actions > API Token…. Plus your host. The free call account { op: "connections.requirements", service: "sentinelone_singularity" } lists exactly what to paste.

Can an AI agent delete or change things in SentinelOne Singularity?

Only if its key allows it, and only with an explicit confirmation. 22 SentinelOne Singularity actions are destructive, including delete a console user, delete threat intelligence IOCs and delete custom detection rules. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my SentinelOne Singularity API limit?

actionlake paces every call to the limits in the SentinelOne Singularity service file: 10 calls a second per connection. Repeated reads are answered from cache (70 SentinelOne Singularity actions can be), which never reaches SentinelOne Singularity.

What does a SentinelOne Singularity action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (174 SentinelOne Singularity actions page). Cache hits, searches, dry runs and calls SentinelOne Singularity refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which SentinelOne Singularity API does it cover?

The SentinelOne Management API v2.1 at your SentinelOne Singularity instance's API base URL, which you enter when connecting (path /web/api/v2.1). It is built from SentinelOne Singularity's documentation as read on 22 October 2026. 174 actions in 27 areas, each one in the signed service file (version 1.0.0).

Can I combine SentinelOne Singularity with my other systems?

Yes. ask joins SentinelOne Singularity to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. SentinelOne Singularity maps crm.company, which 227 other connectors also map.

Does actionlake keep my SentinelOne Singularity data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 2 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your SentinelOne Singularity credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent SentinelOne Singularity today.

Connect SentinelOne Singularity free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

SentinelOne Singularity MCP server for AI agents.

Connect SentinelOne Singularity in three steps.

Add actionlake to Claude.

Connect SentinelOne Singularity.

Make the first call. Check before a write.

What an AI agent can do in SentinelOne Singularity.

Agents

Threats

Sites

Accounts

Groups

Device control

Users

Firewall