Skip to content
actionlake
Start free

Connectors · MSP & PSA

Sophos Central MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Sophos Central and the rest of your systems. It gives your agent 415 Sophos Central actions (199 reads, 147 writes and 69 that wait for a confirmation) and holds the Sophos Central credential itself, so the agent never does. It paces Sophos Central's limits and records every call.

Connect Sophos Central freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "sophos_central.common.list_tenant_users",  intent: "check which Sophos Central account is connected"}# List tenant users · read · 1 upstream call
  • 415actionsin one signed file
  • 199readlook, never change
  • 147writecreate and update
  • 69wait for a yesdestructive, confirmed first

Set up

Connect Sophos Central in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Sophos Central.

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idSophos Central API client ID
    • client_secretSophos Central API client secret (shown once when the credential is created)

    Found for you at connect: base url, tenant id, whoami id and whoami type.

    account { op: "connections.requirements", service: "sophos_central" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "sophos_central.common.list_tenant_users" }# list tenant users · read · 1 upstream callcheck { action: "sophos_central.common.create_tenant_user", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Sophos Central at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Found for you
base url, tenant id, whoami id and whoami type
Limits we pace to
10 calls a second and 100 a minute, per connection
API covered
Sophos Central — endpoints, alerts, policies, cases, XDR and Live Discover queries, email, firewall, mobile and partner/organization management API Sophos Central REST APIs (developer.sophos.com OpenAPI 3.0 specs, fetched 2026-10-22), at your Sophos Central instance's API base URL, which you enter when connecting
Built from
Sophos Central's documentation, read 22 October 2026developer.sophos.comdeveloper.sophos.comdeveloper.sophos.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
196 of 199 reads, for up to 5 minutes; a write clears what it affects
Shared entities
9, so ask can line Sophos Central up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Sophos Central.

415 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 199readlook, never change
  • 147writecreate and update
  • 69destructivewait for a confirmation

  1. Endpoint

    119

    54 read · 49 write · 16 destructive

    Get policies · List endpoints by tenant ID · Create policy · Get policy

  2. Email

    47

    17 read · 21 write · 9 destructive

    List mailboxes · Add new mailbox · Get mailbox · Update mailbox

  3. Mobile

    45

    20 read · 17 write · 8 destructive

    Create app group · Create custom device property · Create device · Create device group

  4. Common

    36

    16 read · 10 write · 10 destructive

    List tenant users · List tenant user groups · List tenant roles · Create tenant user

  5. Partner

    28

    14 read · 8 write · 6 destructive

    List tenants in partner · Create tenant · Get tenant by ID · Patch tenant by ID

  6. Firewall

    23

    8 read · 10 write · 5 destructive

    List firewalls · Check firmware · Create group · Create MDR threat feed indicators

  7. Organization

    16

    9 read · 3 write · 4 destructive

    Create organization admin · Create organization role · Get admin role assignments · Get organization admins

  8. Web filtering

    16

    6 read · 7 write · 3 destructive

    Add site · Clone profile · Clone site list · Create profile

16 more areas · 85 actions
  • DNS protection 15
  • Live discover 13
  • Cases 9
  • XDR query 9
  • Detections 7
  • Cloud security 6
  • Accounts 4
  • Business automation 4
  • Health check 4
  • Switch 3
  • Wifi 3
  • Licensing 2
  • Siem 2
  • User activity 2
  • Audit 1
  • Whoami 1

Top actions

The Sophos Central API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 47 of Sophos Central's 49 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
sophos_central.common.list_tenant_usersList tenant usersQuery users.readidentity.user.list474 connectors
sophos_central.common.list_tenant_user_groupsList tenant user groupsQuery groups.readidentity.group.list262 connectors
sophos_central.common.list_tenant_rolesList tenant rolesList all roles.readidentity.role.list184 connectors
sophos_central.common.create_tenant_userCreate tenant userAdd new user.writeidentity.user.create262 connectors
sophos_central.common.create_tenant_user_groupCreate tenant user groupAdd new group.writeidentity.group.create205 connectors
sophos_central.common.create_tenant_roleCreate tenant roleCreate new role.writeidentity.role.create105 connectors
sophos_central.common.delete_tenant_user_by_idDelete tenant user by IDDelete user.destructiveidentity.user.delete253 connectors
sophos_central.endpoint.get_policiesGet policiesGet policies.readsecurity.policy.list36 connectors
sophos_central.endpoint.list_endpoints_by_tenant_idList endpoints by tenant IDQuery endpoints.readdevice.endpoint.list65 connectors
sophos_central.email.list_mailboxesList mailboxesQuery Mailboxes.readcomm.mailbox.list18 connectors
sophos_central.endpoint.create_policyCreate policyCreate policy.writesecurity.policy.create25 connectors
sophos_central.common.get_alertsGet alertsQuery alerts.readsecurity.alert.list22 connectors

Try it

Prompts to paste into Claude.

Each one names the Sophos Central actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which Sophos Central alerts are open right now? Group them by service.

    callssophos_central.common.get_alerts

  2. Writewrite

    Create tenant user in Sophos Central. Show me exactly what you will send before you save it.

    callssophos_central.common.create_tenant_user

  3. Across systemsread

    Which Sophos Central companies have invoices in NetSuite, and how many each?

    callssophos_central.partner.list_tenants_in_partnernetsuite.views.invoices

Across your systems

Sophos Central, joined to the rest of your business.

One ask fetches from Sophos Central and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

  • Which Sophos Central companies have invoices in NetSuite, and how many each?

    sophos_central.partner.list_tenants_in_partner + netsuite.views.invoices, on crm.company · NetSuite

  • Which Sophos Central companies have tickets in HubSpot CRM, and how many each?

    sophos_central.partner.list_tenants_in_partner + hubspot_crm.tickets.list, on crm.company · HubSpot CRM

Also mapped by other connectorsidentity.user 517identity.group 239crm.company 227identity.role 107device.endpoint 69platform.tenant 67monitoring.alert 56security.policy 28
ask
ask {  intent: "which Sophos Central companies have invoices in NetSuite, and how many each",  steps: [    { action: "sophos_central.partner.list_tenants_in_partner", as: "co", input: {}, limit: 100, max_pages: 5 },    { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "co",        right: "inv",        on: "crm.company",        group_by: "co.name",        select: ["co.name", "count(inv.id) as invoices"]    } }  ]}
Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for Sophos Central

Destructive actions wait for a yes.

69 Sophos Central actions are destructive. The first 10:

  • Delete tenant user by IDsophos_central.common.delete_tenant_user_by_id
  • Delete tenant user group by IDsophos_central.common.delete_tenant_user_group_by_id
  • Delete tenant role by IDsophos_central.common.delete_tenant_role_by_id
  • Delete policysophos_central.endpoint.delete_policy
  • Delete endpoint by IDsophos_central.endpoint.delete_endpoint_by_id
  • Delete mailboxsophos_central.email.delete_mailbox
  • Delete casesophos_central.cases.delete_case
  • Delete tenant endpoint group by IDsophos_central.endpoint.delete_tenant_endpoint_group_by_id
  • Clawback messagesophos_central.email.clawback_message
  • Delete mailboxessophos_central.email.delete_mailboxes

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dosophos_central.common.delete_tenant_user_by_idconfirm_policy: human

Delete tenant user by ID?

intent: the user asked me to delete tenant user by ID

run suspended · waiting for a named person · key sophos-central-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "sophos-central-agent",  allowed_actions: ["sophos_central.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "sophos_central.common.delete_tenant_user_by_id", approver: "[email protected]" },    { match: "sophos_central.common.delete_tenant_user_group_by_id", approver: "[email protected]" },    { match: "sophos_central.common.delete_tenant_role_by_id", approver: "[email protected]" }  ]}
Illustrative. Scoped to Sophos Central only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Sophos Central costs on actionlake.

Every Sophos Central action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Sophos Central refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 415 Sophos Central actions
  • 415actions pageeach page of a long list is one call
  • 196reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Sophos Central action.

415 actions by area: the id your agent calls, what it does, and its effect.

Endpoint119
  • sophos_central.endpoint.create_policyCreate policywrite
  • sophos_central.endpoint.get_policiesGet policiesread
  • sophos_central.endpoint.get_policyGet policyread
  • sophos_central.endpoint.list_endpoints_by_tenant_idList endpoints by tenant IDread
  • sophos_central.endpoint.add_exploit_mitigation_applicationAdd exploit mitigation applicationwrite
  • sophos_central.endpoint.add_intrusion_preventionAdd intrusion preventionwrite
  • and 113 more in this area
Email47
  • sophos_central.email.add_new_mailboxAdd new mailboxwrite
  • sophos_central.email.get_mailboxGet mailboxread
  • sophos_central.email.list_mailboxesList mailboxesread
  • sophos_central.email.update_mailboxUpdate mailboxwrite
  • sophos_central.email.add_mailboxes_in_bulkAdd mailboxes in bulkwrite
  • sophos_central.email.bulk_sender_privilege_requestBulk sender privilege requestwrite
  • and 41 more in this area
Mobile45
  • sophos_central.mobile.create_app_groupCreate app groupwrite
  • sophos_central.mobile.create_custom_device_propertyCreate custom device propertywrite
  • sophos_central.mobile.create_deviceCreate devicewrite
  • sophos_central.mobile.create_device_groupCreate device groupwrite
  • sophos_central.mobile.create_get_log_actionCreate get log actionwrite
  • sophos_central.mobile.create_ixm_auto_enrollment_settingsCreate IXM auto enrollment settingswrite
  • and 39 more in this area
Common36
  • sophos_central.common.create_tenant_userCreate tenant userwrite
  • sophos_central.common.list_tenant_rolesList tenant rolesread
  • sophos_central.common.list_tenant_user_groupsList tenant user groupsread
  • sophos_central.common.list_tenant_usersList tenant usersread
  • sophos_central.common.add_multiple_users_to_groupAdd multiple users to groupwrite
  • sophos_central.common.add_user_to_multiple_groupsAdd user to multiple groupswrite
  • and 30 more in this area
Partner28
  • sophos_central.partner.create_tenantCreate tenantwrite
  • sophos_central.partner.get_tenant_by_idGet tenant by IDread
  • sophos_central.partner.list_tenants_in_partnerList tenants in partnerread
  • sophos_central.partner.patch_tenant_by_idPatch tenant by IDwrite
  • sophos_central.partner.cancel_pending_amendmentCancel pending amendmentdestructive
  • sophos_central.partner.create_admin_role_assignmentCreate admin role assignmentdestructive
  • and 22 more in this area
Firewall23
  • sophos_central.firewall.check_firmwareCheck firmwareread
  • sophos_central.firewall.create_groupCreate groupwrite
  • sophos_central.firewall.create_mdr_threat_feed_indicatorsCreate MDR threat feed indicatorswrite
  • sophos_central.firewall.list_firewallsList firewallsread
  • sophos_central.firewall.cancel_upgradesCancel upgradesdestructive
  • sophos_central.firewall.complete_firewall_config_import_uploadComplete firewall config import uploadwrite
  • and 17 more in this area
Organization16
  • sophos_central.organization.create_organization_adminCreate organization adminwrite
  • sophos_central.organization.create_organization_roleCreate organization rolewrite
  • sophos_central.organization.get_admin_role_assignmentsGet admin role assignmentsread
  • sophos_central.organization.get_organization_adminsGet organization adminsread
  • sophos_central.organization.create_admin_role_assignmentCreate admin role assignmentdestructive
  • sophos_central.organization.delete_organization_admin_by_idDelete organization admin by IDdestructive
  • and 10 more in this area
Web filtering16
  • sophos_central.web_filtering.add_siteAdd sitewrite
  • sophos_central.web_filtering.clone_profileClone profilewrite
  • sophos_central.web_filtering.clone_site_listClone site listwrite
  • sophos_central.web_filtering.create_profileCreate profilewrite
  • sophos_central.web_filtering.create_site_listCreate site listwrite
  • sophos_central.web_filtering.delete_profileDelete profiledestructive
  • and 10 more in this area
DNS protection15
  • sophos_central.dns_protection.create_custom_domains_listCreate custom domains listwrite
  • sophos_central.dns_protection.create_locationCreate locationwrite
  • sophos_central.dns_protection.create_policyCreate policywrite
  • sophos_central.dns_protection.get_all_custom_domains_listsGet all custom domains listsread
  • sophos_central.dns_protection.delete_custom_domains_list_by_idDelete custom domains list by IDdestructive
  • sophos_central.dns_protection.delete_locationDelete locationdestructive
  • and 9 more in this area
Live discover13
  • sophos_central.live_discover.create_enrichment_pivotCreate enrichment pivotwrite
  • sophos_central.live_discover.get_endpoint_execution_statusGet endpoint execution statusread
  • sophos_central.live_discover.get_enrichment_pivotsGet enrichment pivotsread
  • sophos_central.live_discover.get_execution_results_by_idGet execution results by IDread
  • sophos_central.live_discover.delete_enrichment_pivotDelete enrichment pivotdestructive
  • sophos_central.live_discover.get_categoryGet categoryread
  • and 7 more in this area
Cases9
  • sophos_central.cases.create_caseCreate casewrite
  • sophos_central.cases.get_case_by_idGet case by IDread
  • sophos_central.cases.get_casesGet casesread
  • sophos_central.cases.update_caseUpdate casewrite
  • sophos_central.cases.delete_caseDelete casedestructive
  • sophos_central.cases.get_case_detection_by_idGet case detection by IDread
  • and 3 more in this area
XDR query9
  • sophos_central.xdr_query.get_query_resultsGet query resultsread
  • sophos_central.xdr_query.get_query_runsGet query runsread
  • sophos_central.xdr_query.list_categoriesList categoriesread
  • sophos_central.xdr_query.list_queriesList queriesread
  • sophos_central.xdr_query.cancel_query_runCancel query rundestructive
  • sophos_central.xdr_query.get_categoryGet categoryread
  • and 3 more in this area
Detections7
  • sophos_central.detections.get_detections_resultsGet detections resultsread
  • sophos_central.detections.get_group_resultsGet group resultsread
  • sophos_central.detections.start_detections_runStart detections runwrite
  • sophos_central.detections.start_group_runStart group runwrite
  • sophos_central.detections.get_detections_countGet detections countread
  • sophos_central.detections.get_detections_runGet detections runread
  • and 1 more in this area
Cloud security6
  • sophos_central.cloud_security.create_profileCreate profilewrite
  • sophos_central.cloud_security.get_profileGet profileread
  • sophos_central.cloud_security.list_default_contentsList default contentsread
  • sophos_central.cloud_security.list_profilesList profilesread
  • sophos_central.cloud_security.delete_profilesDelete profilesdestructive
  • sophos_central.cloud_security.update_profile_nameUpdate profile namewrite
Accounts4
  • sophos_central.accounts.create_tokenCreate tokenwrite
  • sophos_central.accounts.list_tokens_by_tenant_idList tokens by tenant IDread
  • sophos_central.accounts.revoke_tokenRevoke tokendestructive
  • sophos_central.accounts.update_tokenUpdate tokenwrite
Business automation4
  • sophos_central.business_automation.get_partner_level_infoGet partner level inforead
  • sophos_central.business_automation.get_pricing_infoGet pricing inforead
  • sophos_central.business_automation.get_quoteGet quoteread
  • sophos_central.business_automation.list_quotesList quotesread
Health check4
  • sophos_central.health_check.get_account_health_checkGet account health checkread
  • sophos_central.health_check.get_historical_scoresGet historical scoresread
  • sophos_central.health_check.get_regional_scoresGet regional scoresread
  • sophos_central.health_check.post_snoozePost snoozewrite
Switch3
  • sophos_central.switch.get_mac_filter_settingsGet mac filter settingsread
  • sophos_central.switch.get_tasksGet tasksread
  • sophos_central.switch.update_mac_filter_settingsUpdate mac filter settingswrite
Wifi3
  • sophos_central.wifi.get_mac_filter_settingsGet mac filter settingsread
  • sophos_central.wifi.get_tasksGet tasksread
  • sophos_central.wifi.update_mac_filter_settingsUpdate mac filter settingswrite
Licensing2
  • sophos_central.licensing.get_firewallsGet firewallsread
  • sophos_central.licensing.get_licenses_with_usageGet licenses with usageread
Siem2
  • sophos_central.siem.get_alertsGet alertsread
  • sophos_central.siem.get_eventsGet eventsread
User activity2
  • sophos_central.user_activity.create_attestationCreate attestationwrite
  • sophos_central.user_activity.get_attestation_by_idGet attestation by IDread
Audit1
  • sophos_central.audit.get_audit_eventsGet audit eventsread
Whoami1
  • sophos_central.whoami.whoamiWhoamiread

This index shows a sample of each area. All 415 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Sophos Central MCP server, answered.

Is there a Sophos Central MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 415 Sophos Central actions across endpoint, email, mobile and common, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Sophos Central.

What do I need to connect Sophos Central?

Sophos Central API client ID and Sophos Central API client secret (shown once when the credential is created). actionlake finds base url, tenant id, whoami id and whoami type for you when you connect. The free call account { op: "connections.requirements", service: "sophos_central" } lists exactly what to paste.

Can an AI agent delete or change things in Sophos Central?

Only if its key allows it, and only with an explicit confirmation. 69 Sophos Central actions are destructive, including delete tenant user by ID, delete tenant user group by ID and delete tenant role by ID. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Sophos Central API limit?

actionlake paces every call to the limits in the Sophos Central service file: 10 calls a second and 100 a minute per connection. Repeated reads are answered from cache (196 Sophos Central actions can be), which never reaches Sophos Central.

What does a Sophos Central action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (415 Sophos Central actions page). Cache hits, searches, dry runs and calls Sophos Central refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Sophos Central API does it cover?

The Sophos Central — endpoints, alerts, policies, cases, XDR and Live Discover queries, email, firewall, mobile and partner/organization management API Sophos Central REST APIs (developer.sophos.com OpenAPI 3.0 specs, fetched 2026-10-22) at your Sophos Central instance's API base URL, which you enter when connecting. It is built from Sophos Central's documentation as read on 22 October 2026. 415 actions in 24 areas, each one in the signed service file (version 1.0.0).

Can I combine Sophos Central with my other systems?

Yes. ask joins Sophos Central to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. Sophos Central maps crm.company, which 227 other connectors also map.

Does actionlake keep my Sophos Central data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Sophos Central credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Sophos Central

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Sophos Central; the name is the vendor's own. Counts are from the Sophos Central service file, version 1.0.0.

Give your agent Sophos Central today.

Connect Sophos Central freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.