--- title: "SentinelOne Singularity MCP server - actionlake" description: "Give Claude 174 SentinelOne Singularity actions through one MCP server: agents, threats. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/sentinelone-singularity updated: 2026-10-22 --- Connectors · MSP & PSA # SentinelOne Singularity MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to SentinelOne Singularity and the rest of your systems. It gives your agent 174 SentinelOne Singularity actions (73 reads, 79 writes and 22 that wait for a confirmation) and holds the SentinelOne Singularity credential itself, so the agent never does. It paces SentinelOne Singularity's limits and records every call. [Connect SentinelOne Singularity free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "sentinelone_singularity.users.list", intent: "check which SentinelOne Singularity account is connected" } # List console users · read · 1 upstream call ``` - 174 actions in one signed file - 73 read look, never change - 79 write create and update - 22 wait for a yes destructive, confirmed first Set up ## Connect SentinelOne Singularity in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect SentinelOne Singularity. API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_token` SentinelOne API token: console > Settings > Users > Service Users (recommended) or My User > Actions > API Token… - `host` Where your SentinelOne Singularity lives: your host ``` account { op: "connections.requirements", service: "sentinelone_singularity" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "sentinelone_singularity.users.list" } # list console users · read · 1 upstream call check { action: "sentinelone_singularity.users.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` SentinelOne Singularity at a glance **Sign-in** API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_token` **Setup fields** `host` **Limits we pace to** 10 calls a second, per connection **API covered** SentinelOne Management API v2.1, at your SentinelOne Singularity instance's API base URL, which you enter when connecting (path /web/api/v2.1) **Built from** SentinelOne Singularity's documentation, read 22 October 2026[usea1-partners.sentinelone.net](https://usea1-partners.sentinelone.net/api-doc/overview) [GitHub](https://github.com/demisto/content/blob/master/Packs/SentinelOne/Integrations/SentinelOne-V2/SentinelOne-V2.py) [GitHub](https://github.com/rapid7/insightconnect-plugins/blob/master/plugins/sentinelone/komand_sentinelone/util/endpoints.py) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 70 of 73 reads, for up to 2 minutes; a write clears what it affects **Shared entities** 4, so ask can line SentinelOne Singularity up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in SentinelOne Singularity. 174 actions in 27 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **73** read look, never change - **79** write create and update - **22** destructive wait for a confirmation 1. ### Agents 33 6 read · 21 write · 6 destructive List agents · Count agents · Disable agents · Enable agents 2. ### Threats 24 11 read · 12 write · 1 destructive List threats · Create threats from IOCs · List a threat's related events · List threat free-text filters 3. ### Sites 11 3 read · 7 write · 1 destructive List sites · Create a site · Expire a site now · Get a site 4. ### Accounts 10 4 read · 6 write · 0 destructive Create an account · List accounts · Expire an account now · Get an account 5. ### Groups 10 3 read · 6 write · 1 destructive Create a group · List groups · Get a group · Move agents into a group 6. ### Device control 9 3 read · 4 write · 2 destructive Create a device control rule · List device control events · List device control rules · Get device control configuration 7. ### Users 9 4 read · 3 write · 2 destructive List console users · Create a console user · Get a console user · Update a console user 8. ### Firewall 8 2 read · 4 write · 2 destructive List firewall rules · Create a firewall rule · Get firewall control configuration · Update firewall control configuration **19 more areas · 60 actions** - DV **7** - Installed applications **6** - Rules **6** - Blocklist **4** - Exclusions **4** - Remote scripts **4** - Alerts **3** - App management **3** - Hashes **3** - Iocs **3** - System **3** - Unified exclusions **3** - Activities **2** - Roles **2** - Tenant **2** - Unified alerts **2** - Marketplace **1** - Packages **1** - Service users **1** Top actions ## The SentinelOne Singularity API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 22 of SentinelOne Singularity's 22 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `sentinelone_singularity.users.list` List console users | List console users. | read | `identity.user.list` 474 connectors | | `sentinelone_singularity.roles.list` List RBAC roles | List RBAC roles. | read | `identity.role.list` 184 connectors | | `sentinelone_singularity.users.create` Create a console user | Create a console user. | write | `identity.user.create` 262 connectors | | `sentinelone_singularity.users.update` Update a console user | Update a console user. | write | `identity.user.update` 280 connectors | | `sentinelone_singularity.users.delete` Delete a console user | Delete a console user. | destructive | `identity.user.delete` 253 connectors | | `sentinelone_singularity.roles.get` Get an RBAC role | Get an RBAC role. | read | `identity.role.get` 127 connectors | | `sentinelone_singularity.agents.list` List agents | List agents. | read | `device.endpoint.list` 65 connectors | | `sentinelone_singularity.users.me` Get the current user | Get the current user. | read | `identity.current_user.get` 307 connectors | | `sentinelone_singularity.service_users.list` List service users | List service users. | read | `identity.service_account.list` 35 connectors | | `sentinelone_singularity.activities.list` List activities | List activities. | read | `security.audit_log.list` 69 connectors | | `sentinelone_singularity.alerts.list` List alerts | List alerts. | read | `security.alert.list` 22 connectors | | `sentinelone_singularity.rules.create` Create a custom detection rule | Create a custom detection rule. | write | `security.detection_rule.create` 11 connectors | Try it ## Prompts to paste into Claude. Each one names the SentinelOne Singularity actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which SentinelOne Singularity devices have not checked in for a week? calls `sentinelone_singularity.agents.list` 2. Write write Create a console user in SentinelOne Singularity. Show me exactly what you will send before you save it. calls `sentinelone_singularity.users.create` 3. Across systems read Which SentinelOne Singularity companies have invoices in NetSuite, and how many each? calls `sentinelone_singularity.sites.list` `netsuite.views.invoices` Across your systems ## SentinelOne Singularity, joined to the rest of your business. One `ask` fetches from SentinelOne Singularity and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row. - Which SentinelOne Singularity companies have invoices in NetSuite, and how many each? `sentinelone_singularity.sites.list` + `netsuite.views.invoices`, on `crm.company` · [NetSuite](https://actionlake.com/connectors/netsuite) - Which SentinelOne Singularity companies have tickets in HubSpot CRM, and how many each? `sentinelone_singularity.sites.list` + `hubspot_crm.tickets.list`, on `crm.company` · [HubSpot CRM](https://actionlake.com/connectors/hubspot-crm) Also mapped by other connectors `identity.user` **517** `crm.company` **227** `identity.role` **107** `device.endpoint` **69** ask ``` ask { intent: "which SentinelOne Singularity companies have invoices in NetSuite, and how many each", steps: [ { action: "sentinelone_singularity.sites.list", as: "co", input: {}, limit: 100, max_pages: 5 }, { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 }, { join: { left: "co", right: "inv", on: "crm.company", group_by: "co.name", select: ["co.name", "count(inv.id) as invoices"] } } ] } ``` Example. Run it through check first: it validates the steps and prices them, and it is free. Governance for SentinelOne Singularity ## Destructive actions wait for a yes. 22 SentinelOne Singularity actions are destructive. These are all of them: - Delete a console user `sentinelone_singularity.users.delete` - Delete threat intelligence IOCs `sentinelone_singularity.iocs.delete` - Delete custom detection rules `sentinelone_singularity.rules.delete` - Delete a site `sentinelone_singularity.sites.delete` - Delete a group `sentinelone_singularity.groups.delete` - Shut down endpoints `sentinelone_singularity.agents.shutdown` - Delete firewall rules `sentinelone_singularity.firewall.delete` - Uninstall agents `sentinelone_singularity.agents.uninstall` - Remove blocklist entries `sentinelone_singularity.blocklist.delete` - Disable firewall rules `sentinelone_singularity.firewall.disable` - Delete exclusions `sentinelone_singularity.exclusions.delete` - Delete console users in bulk `sentinelone_singularity.users.delete_bulk` - Decommission agents `sentinelone_singularity.agents.decommission` - Delete a threat note `sentinelone_singularity.threats.notes_delete` - Delete device control rules `sentinelone_singularity.device_control.delete` - Restart endpoints `sentinelone_singularity.agents.restart_machine` - Disable device control rules `sentinelone_singularity.device_control.disable` - Run a remote script `sentinelone_singularity.remote_scripts.execute` - Reject agent uninstall requests `sentinelone_singularity.agents.reject_uninstall` - Approve agent uninstall requests `sentinelone_singularity.agents.approve_uninstall` - Delete unified exclusions `sentinelone_singularity.unified_exclusions.delete` - Cancel a Deep Visibility query `sentinelone_singularity.dv.cancel_query` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do sentinelone_singularity.users.delete confirm_policy: **human** Delete a console user? **intent:** the user asked me to delete a console user run suspended · waiting for a named person · key _sentinelone-singularity-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "sentinelone-singularity-agent", allowed_actions: ["sentinelone_singularity.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "sentinelone_singularity.users.delete", approver: "lead@example.com" }, { match: "sentinelone_singularity.iocs.delete", approver: "lead@example.com" }, { match: "sentinelone_singularity.rules.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to SentinelOne Singularity only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What SentinelOne Singularity costs on actionlake. Every SentinelOne Singularity action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call SentinelOne Singularity refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 174 SentinelOne Singularity actions - 174 actions page each page of a long list is one call - 70 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every SentinelOne Singularity action. 174 actions by area: the id your agent calls, what it does, and its effect. **Agents 33** - `sentinelone_singularity.agents.abort_scan` Abort a full disk scan write - `sentinelone_singularity.agents.applications` List an agent's installed applications read - `sentinelone_singularity.agents.approve_uninstall` Approve agent uninstall requests destructive - `sentinelone_singularity.agents.broadcast` Send a message to agents write - `sentinelone_singularity.agents.connect` Reconnect agents to the network write - `sentinelone_singularity.agents.count` Count agents read - `sentinelone_singularity.agents.decommission` Decommission agents destructive - `sentinelone_singularity.agents.disable_agent` Disable agents write - `sentinelone_singularity.agents.disconnect` Disconnect agents from the network write - `sentinelone_singularity.agents.enable_agent` Enable agents write - `sentinelone_singularity.agents.fetch_files` Fetch files from an agent write - `sentinelone_singularity.agents.fetch_firewall_rules` Fetch agent firewall rules write - `sentinelone_singularity.agents.fetch_installed_apps` Refresh installed applications write - `sentinelone_singularity.agents.fetch_logs` Fetch agent logs write - `sentinelone_singularity.agents.firewall_logging` Set agent firewall logging write - `sentinelone_singularity.agents.initiate_scan` Start a full disk scan write - `sentinelone_singularity.agents.list` List agents read - `sentinelone_singularity.agents.manage_tags` Add, remove or override agent tags write - `sentinelone_singularity.agents.mark_up_to_date` Mark agents as up to date write - `sentinelone_singularity.agents.move_to_site` Move agents to another site write - `sentinelone_singularity.agents.passphrases` List agent passphrases read - `sentinelone_singularity.agents.processes` List an agent's running processes read - `sentinelone_singularity.agents.randomize_uuid` Randomise agent UUIDs write - `sentinelone_singularity.agents.reject_uninstall` Reject agent uninstall requests destructive - `sentinelone_singularity.agents.reset_local_config` Reset agents' local configuration write - `sentinelone_singularity.agents.restart_machine` Restart endpoints destructive - `sentinelone_singularity.agents.set_external_id` Set agents' external id write - `sentinelone_singularity.agents.shutdown` Shut down endpoints destructive - `sentinelone_singularity.agents.start_remote_profiling` Start remote profiling write - `sentinelone_singularity.agents.stop_remote_profiling` Stop remote profiling write - `sentinelone_singularity.agents.summary` Get agent summary counts read - `sentinelone_singularity.agents.uninstall` Uninstall agents destructive - `sentinelone_singularity.agents.update_software` Update agent software write **Threats 24** - `sentinelone_singularity.threats.add_to_blacklist` Add threat hashes to the blocklist write - `sentinelone_singularity.threats.add_to_exclusions` Add threats to the exclusion list write - `sentinelone_singularity.threats.analysis` Get a threat's analysis read - `sentinelone_singularity.threats.analyst_verdict` Set the analyst verdict on threats write - `sentinelone_singularity.threats.create_from_ioc` Create threats from IOCs write - `sentinelone_singularity.threats.download_from_cloud` Get a threat file cloud download link read - `sentinelone_singularity.threats.explore_events` List a threat's related events read - `sentinelone_singularity.threats.fetch_file` Fetch threat files from endpoints write - `sentinelone_singularity.threats.forensics` Get threat forensics read - `sentinelone_singularity.threats.forensics_details` Get threat forensics details read - `sentinelone_singularity.threats.free_text_filters` List threat free-text filters read - `sentinelone_singularity.threats.incident` Set the incident status of threats write - `sentinelone_singularity.threats.list` List threats read - `sentinelone_singularity.threats.mark_as_benign` Mark threats as benign write - `sentinelone_singularity.threats.mark_as_resolved` Mark threats as resolved write - `sentinelone_singularity.threats.mark_as_threat` Mark threats as threats write - `sentinelone_singularity.threats.mitigate` Mitigate threats write - `sentinelone_singularity.threats.notes_add` Add a note to threats write - `sentinelone_singularity.threats.notes_delete` Delete a threat note destructive - `sentinelone_singularity.threats.notes_list` List a threat's notes read - `sentinelone_singularity.threats.notes_update` Update a threat note write - `sentinelone_singularity.threats.seen_on_network` List where a threat was seen on the network read - `sentinelone_singularity.threats.summary` Get threat summary counts read - `sentinelone_singularity.threats.timeline` Get a threat's timeline read **Sites 11** - `sentinelone_singularity.sites.create` Create a site write - `sentinelone_singularity.sites.delete` Delete a site destructive - `sentinelone_singularity.sites.expire_now` Expire a site now write - `sentinelone_singularity.sites.get` Get a site read - `sentinelone_singularity.sites.list` List sites read - `sentinelone_singularity.sites.policy_get` Get a site policy read - `sentinelone_singularity.sites.policy_revert` Revert a site policy to inherited write - `sentinelone_singularity.sites.policy_update` Update a site policy write - `sentinelone_singularity.sites.reactivate` Reactivate a site write - `sentinelone_singularity.sites.regenerate_key` Regenerate a site token write - `sentinelone_singularity.sites.update` Update a site write **Accounts 10** - `sentinelone_singularity.accounts.create` Create an account write - `sentinelone_singularity.accounts.expire_now` Expire an account now write - `sentinelone_singularity.accounts.get` Get an account read - `sentinelone_singularity.accounts.list` List accounts read - `sentinelone_singularity.accounts.name_available` Check account name availability read - `sentinelone_singularity.accounts.policy_get` Get an account policy read - `sentinelone_singularity.accounts.policy_revert` Revert an account policy to inherited write - `sentinelone_singularity.accounts.policy_update` Update an account policy write - `sentinelone_singularity.accounts.reactivate` Reactivate an account write - `sentinelone_singularity.accounts.update` Update an account write **Groups 10** - `sentinelone_singularity.groups.create` Create a group write - `sentinelone_singularity.groups.delete` Delete a group destructive - `sentinelone_singularity.groups.get` Get a group read - `sentinelone_singularity.groups.list` List groups read - `sentinelone_singularity.groups.move_agents` Move agents into a group write - `sentinelone_singularity.groups.policy_get` Get a group policy read - `sentinelone_singularity.groups.policy_revert` Revert a group policy to inherited write - `sentinelone_singularity.groups.policy_update` Update a group policy write - `sentinelone_singularity.groups.regenerate_key` Regenerate a group token write - `sentinelone_singularity.groups.update` Update a group write **Device control 9** - `sentinelone_singularity.device_control.configuration_get` Get device control configuration read - `sentinelone_singularity.device_control.configuration_update` Update device control configuration write - `sentinelone_singularity.device_control.create` Create a device control rule write - `sentinelone_singularity.device_control.delete` Delete device control rules destructive - `sentinelone_singularity.device_control.disable` Disable device control rules destructive - `sentinelone_singularity.device_control.enable` Enable device control rules write - `sentinelone_singularity.device_control.events` List device control events read - `sentinelone_singularity.device_control.list` List device control rules read - `sentinelone_singularity.device_control.update` Update a device control rule write **Users 9** - `sentinelone_singularity.users.create` Create a console user write - `sentinelone_singularity.users.delete` Delete a console user destructive - `sentinelone_singularity.users.delete_bulk` Delete console users in bulk destructive - `sentinelone_singularity.users.elevate` Elevate the session for protected actions write - `sentinelone_singularity.users.get` Get a console user read - `sentinelone_singularity.users.list` List console users read - `sentinelone_singularity.users.me` Get the current user read - `sentinelone_singularity.users.update` Update a console user write - `sentinelone_singularity.users.viewer_auth_check` Check viewer authorisation read **Firewall 8** - `sentinelone_singularity.firewall.configuration_get` Get firewall control configuration read - `sentinelone_singularity.firewall.configuration_update` Update firewall control configuration write - `sentinelone_singularity.firewall.create` Create a firewall rule write - `sentinelone_singularity.firewall.delete` Delete firewall rules destructive - `sentinelone_singularity.firewall.disable` Disable firewall rules destructive - `sentinelone_singularity.firewall.enable` Enable firewall rules write - `sentinelone_singularity.firewall.list` List firewall rules read - `sentinelone_singularity.firewall.update` Update a firewall rule write **DV 7** - `sentinelone_singularity.dv.cancel_query` Cancel a Deep Visibility query destructive - `sentinelone_singularity.dv.events` List Deep Visibility events read - `sentinelone_singularity.dv.events_by_type` List Deep Visibility events of one type read - `sentinelone_singularity.dv.init_query` Start a Deep Visibility query write - `sentinelone_singularity.dv.power_query` Run a PowerQuery write - `sentinelone_singularity.dv.power_query_ping` Poll a PowerQuery read - `sentinelone_singularity.dv.query_status` Get a Deep Visibility query's status read **Installed applications 6** - `sentinelone_singularity.installed_applications.app_cves` List CVEs of one installed application read - `sentinelone_singularity.installed_applications.cves` List CVEs on installed applications read - `sentinelone_singularity.installed_applications.filters_count` Count installed applications per filter value read - `sentinelone_singularity.installed_applications.free_text_filters` List installed-application free-text filters read - `sentinelone_singularity.installed_applications.list` List installed applications read - `sentinelone_singularity.installed_applications.risk_levels_count` Count installed applications by risk level read **Rules 6** - `sentinelone_singularity.rules.create` Create a custom detection rule write - `sentinelone_singularity.rules.delete` Delete custom detection rules destructive - `sentinelone_singularity.rules.disable` Disable custom detection rules write - `sentinelone_singularity.rules.enable` Enable custom detection rules write - `sentinelone_singularity.rules.list` List custom detection rules read - `sentinelone_singularity.rules.update` Update a custom detection rule write **Blocklist 4** - `sentinelone_singularity.blocklist.create` Add blocklist entries write - `sentinelone_singularity.blocklist.delete` Remove blocklist entries destructive - `sentinelone_singularity.blocklist.list` List blocklist entries read - `sentinelone_singularity.blocklist.update` Update a blocklist entry write **Exclusions 4** - `sentinelone_singularity.exclusions.create` Create exclusions write - `sentinelone_singularity.exclusions.delete` Delete exclusions destructive - `sentinelone_singularity.exclusions.list` List exclusions read - `sentinelone_singularity.exclusions.update` Update an exclusion write **Remote scripts 4** - `sentinelone_singularity.remote_scripts.execute` Run a remote script destructive - `sentinelone_singularity.remote_scripts.fetch_results` Get remote script result download links read - `sentinelone_singularity.remote_scripts.list` List remote scripts read - `sentinelone_singularity.remote_scripts.status` List remote script task status read **Alerts 3** - `sentinelone_singularity.alerts.analyst_verdict` Set the analyst verdict on alerts write - `sentinelone_singularity.alerts.incident` Set the incident status of alerts write - `sentinelone_singularity.alerts.list` List alerts read **App management 3** - `sentinelone_singularity.app_management.inventory` List application inventory read - `sentinelone_singularity.app_management.inventory_endpoints` List endpoints running an application read - `sentinelone_singularity.app_management.risks` List application risks (CVEs) read **Hashes 3** - `sentinelone_singularity.hashes.classification` Get a hash's classification read - `sentinelone_singularity.hashes.reputation` Get a hash's reputation read - `sentinelone_singularity.hashes.verdict` Get a hash's verdict read **Iocs 3** - `sentinelone_singularity.iocs.create` Create threat intelligence IOCs write - `sentinelone_singularity.iocs.delete` Delete threat intelligence IOCs destructive - `sentinelone_singularity.iocs.list` List threat intelligence IOCs read **System 3** - `sentinelone_singularity.system.configuration_get` Get system configuration read - `sentinelone_singularity.system.info` Get system info read - `sentinelone_singularity.system.status` Get system status read **Unified exclusions 3** - `sentinelone_singularity.unified_exclusions.create` Create a unified exclusion write - `sentinelone_singularity.unified_exclusions.delete` Delete unified exclusions destructive - `sentinelone_singularity.unified_exclusions.list` List unified exclusions read **Activities 2** - `sentinelone_singularity.activities.list` List activities read - `sentinelone_singularity.activities.types` List activity types read **Roles 2** - `sentinelone_singularity.roles.get` Get an RBAC role read - `sentinelone_singularity.roles.list` List RBAC roles read **Tenant 2** - `sentinelone_singularity.tenant.policy_get` Get the global policy read - `sentinelone_singularity.tenant.policy_update` Update the global policy write **Unified alerts 2** - `sentinelone_singularity.unified_alerts.graphql` Query unified alerts (GraphQL) read - `sentinelone_singularity.unified_alerts.graphql_mutate` Change unified alerts (GraphQL mutation) write **Marketplace 1** - `sentinelone_singularity.marketplace.applications` List installed marketplace applications read **Packages 1** - `sentinelone_singularity.packages.list` List agent installation packages read **Service users 1** - `sentinelone_singularity.service_users.list` List service users read Questions ## The SentinelOne Singularity MCP server, answered. **Is there a SentinelOne Singularity MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 174 SentinelOne Singularity actions across agents, threats, sites and accounts, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by SentinelOne Singularity. **What do I need to connect SentinelOne Singularity?** SentinelOne API token: console > Settings > Users > Service Users (recommended) or My User > Actions > API Token…. Plus your host. The free call account { op: "connections.requirements", service: "sentinelone_singularity" } lists exactly what to paste. **Can an AI agent delete or change things in SentinelOne Singularity?** Only if its key allows it, and only with an explicit confirmation. 22 SentinelOne Singularity actions are destructive, including delete a console user, delete threat intelligence IOCs and delete custom detection rules. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my SentinelOne Singularity API limit?** actionlake paces every call to the limits in the SentinelOne Singularity service file: 10 calls a second per connection. Repeated reads are answered from cache (70 SentinelOne Singularity actions can be), which never reaches SentinelOne Singularity. **What does a SentinelOne Singularity action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (174 SentinelOne Singularity actions page). Cache hits, searches, dry runs and calls SentinelOne Singularity refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which SentinelOne Singularity API does it cover?** The SentinelOne Management API v2.1 at your SentinelOne Singularity instance's API base URL, which you enter when connecting (path /web/api/v2.1). It is built from SentinelOne Singularity's documentation as read on 22 October 2026. 174 actions in 27 areas, each one in the signed service file (version 1.0.0). **Can I combine SentinelOne Singularity with my other systems?** Yes. ask joins SentinelOne Singularity to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. SentinelOne Singularity maps crm.company, which 227 other connectors also map. **Does actionlake keep my SentinelOne Singularity data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 2 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your SentinelOne Singularity credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like SentinelOne Singularity Shares the most action names with - [Domotz 10](https://actionlake.com/connectors/domotz) - [Jamf Pro 9](https://actionlake.com/connectors/jamf-pro) - [Action1 8](https://actionlake.com/connectors/action1) - [TP-Link Omada Open API 8](https://actionlake.com/connectors/tp-link-omada-open-api) - [Cato Networks SASE 7](https://actionlake.com/connectors/cato-networks-sase) - [ExtremeCloud IQ 6](https://actionlake.com/connectors/extremecloud-iq) Joins with, on shared entities - [Microsoft 365 Users 3](https://actionlake.com/connectors/microsoft-365-users) - [Genesys Cloud CX 3](https://actionlake.com/connectors/genesys-cloud-cx) - [ERPNext (Frappe) 3](https://actionlake.com/connectors/erpnext-frappe) - [Microsoft Dynamics 365 3](https://actionlake.com/connectors/microsoft-dynamics-365) - [Okta 3](https://actionlake.com/connectors/okta) - [JumpCloud 3](https://actionlake.com/connectors/jumpcloud) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by SentinelOne Singularity; the name is the vendor's own. Counts are from the SentinelOne Singularity service file, version 1.0.0. ## Give your agent SentinelOne Singularity today. [Connect SentinelOne Singularity free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/sentinelone-singularity More: https://actionlake.com/llms.txt