--- title: "Sophos Central MCP server for AI agents - actionlake" description: "Give Claude 415 Sophos Central actions through one MCP server: endpoint, email, mobile. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/sophos-central updated: 2026-10-22 --- Connectors · MSP & PSA # Sophos Central MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Sophos Central and the rest of your systems. It gives your agent 415 Sophos Central actions (199 reads, 147 writes and 69 that wait for a confirmation) and holds the Sophos Central credential itself, so the agent never does. It paces Sophos Central's limits and records every call. [Connect Sophos Central free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "sophos_central.common.list_tenant_users", intent: "check which Sophos Central account is connected" } # List tenant users · read · 1 upstream call ``` - 415 actions in one signed file - 199 read look, never change - 147 write create and update - 69 wait for a yes destructive, confirmed first Set up ## Connect Sophos Central in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Sophos Central. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` Sophos Central API client ID - `client_secret` Sophos Central API client secret (shown once when the credential is created) Found for you at connect: base url, tenant id, whoami id and whoami type. ``` account { op: "connections.requirements", service: "sophos_central" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "sophos_central.common.list_tenant_users" } # list tenant users · read · 1 upstream call check { action: "sophos_central.common.create_tenant_user", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Sophos Central at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Found for you** base url, tenant id, whoami id and whoami type **Limits we pace to** 10 calls a second and 100 a minute, per connection **API covered** Sophos Central — endpoints, alerts, policies, cases, XDR and Live Discover queries, email, firewall, mobile and partner/organization management API Sophos Central REST APIs (developer.sophos.com OpenAPI 3.0 specs, fetched 2026-10-22), at your Sophos Central instance's API base URL, which you enter when connecting **Built from** Sophos Central's documentation, read 22 October 2026[developer.sophos.com](https://developer.sophos.com/assets/specs/whoami-v1.yaml) [developer.sophos.com](https://developer.sophos.com/assets/specs/common-v1.yaml) [developer.sophos.com](https://developer.sophos.com/assets/specs/endpoint-v1.yaml) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 196 of 199 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 9, so ask can line Sophos Central up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Sophos Central. 415 actions in 24 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **199** read look, never change - **147** write create and update - **69** destructive wait for a confirmation 1. ### Endpoint 119 54 read · 49 write · 16 destructive Get policies · List endpoints by tenant ID · Create policy · Get policy 2. ### Email 47 17 read · 21 write · 9 destructive List mailboxes · Add new mailbox · Get mailbox · Update mailbox 3. ### Mobile 45 20 read · 17 write · 8 destructive Create app group · Create custom device property · Create device · Create device group 4. ### Common 36 16 read · 10 write · 10 destructive List tenant users · List tenant user groups · List tenant roles · Create tenant user 5. ### Partner 28 14 read · 8 write · 6 destructive List tenants in partner · Create tenant · Get tenant by ID · Patch tenant by ID 6. ### Firewall 23 8 read · 10 write · 5 destructive List firewalls · Check firmware · Create group · Create MDR threat feed indicators 7. ### Organization 16 9 read · 3 write · 4 destructive Create organization admin · Create organization role · Get admin role assignments · Get organization admins 8. ### Web filtering 16 6 read · 7 write · 3 destructive Add site · Clone profile · Clone site list · Create profile **16 more areas · 85 actions** - DNS protection **15** - Live discover **13** - Cases **9** - XDR query **9** - Detections **7** - Cloud security **6** - Accounts **4** - Business automation **4** - Health check **4** - Switch **3** - Wifi **3** - Licensing **2** - Siem **2** - User activity **2** - Audit **1** - Whoami **1** Top actions ## The Sophos Central API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 47 of Sophos Central's 49 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `sophos_central.common.list_tenant_users` List tenant users | Query users. | read | `identity.user.list` 474 connectors | | `sophos_central.common.list_tenant_user_groups` List tenant user groups | Query groups. | read | `identity.group.list` 262 connectors | | `sophos_central.common.list_tenant_roles` List tenant roles | List all roles. | read | `identity.role.list` 184 connectors | | `sophos_central.common.create_tenant_user` Create tenant user | Add new user. | write | `identity.user.create` 262 connectors | | `sophos_central.common.create_tenant_user_group` Create tenant user group | Add new group. | write | `identity.group.create` 205 connectors | | `sophos_central.common.create_tenant_role` Create tenant role | Create new role. | write | `identity.role.create` 105 connectors | | `sophos_central.common.delete_tenant_user_by_id` Delete tenant user by ID | Delete user. | destructive | `identity.user.delete` 253 connectors | | `sophos_central.endpoint.get_policies` Get policies | Get policies. | read | `security.policy.list` 36 connectors | | `sophos_central.endpoint.list_endpoints_by_tenant_id` List endpoints by tenant ID | Query endpoints. | read | `device.endpoint.list` 65 connectors | | `sophos_central.email.list_mailboxes` List mailboxes | Query Mailboxes. | read | `comm.mailbox.list` 18 connectors | | `sophos_central.endpoint.create_policy` Create policy | Create policy. | write | `security.policy.create` 25 connectors | | `sophos_central.common.get_alerts` Get alerts | Query alerts. | read | `security.alert.list` 22 connectors | Try it ## Prompts to paste into Claude. Each one names the Sophos Central actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Sophos Central alerts are open right now? Group them by service. calls `sophos_central.common.get_alerts` 2. Write write Create tenant user in Sophos Central. Show me exactly what you will send before you save it. calls `sophos_central.common.create_tenant_user` 3. Across systems read Which Sophos Central companies have invoices in NetSuite, and how many each? calls `sophos_central.partner.list_tenants_in_partner` `netsuite.views.invoices` Across your systems ## Sophos Central, joined to the rest of your business. One `ask` fetches from Sophos Central and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row. - Which Sophos Central companies have invoices in NetSuite, and how many each? `sophos_central.partner.list_tenants_in_partner` + `netsuite.views.invoices`, on `crm.company` · [NetSuite](https://actionlake.com/connectors/netsuite) - Which Sophos Central companies have tickets in HubSpot CRM, and how many each? `sophos_central.partner.list_tenants_in_partner` + `hubspot_crm.tickets.list`, on `crm.company` · [HubSpot CRM](https://actionlake.com/connectors/hubspot-crm) Also mapped by other connectors `identity.user` **517** `identity.group` **239** `crm.company` **227** `identity.role` **107** `device.endpoint` **69** `platform.tenant` **67** `monitoring.alert` **56** `security.policy` **28** ask ``` ask { intent: "which Sophos Central companies have invoices in NetSuite, and how many each", steps: [ { action: "sophos_central.partner.list_tenants_in_partner", as: "co", input: {}, limit: 100, max_pages: 5 }, { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 }, { join: { left: "co", right: "inv", on: "crm.company", group_by: "co.name", select: ["co.name", "count(inv.id) as invoices"] } } ] } ``` Example. Run it through check first: it validates the steps and prices them, and it is free. Governance for Sophos Central ## Destructive actions wait for a yes. 69 Sophos Central actions are destructive. The first 10: - Delete tenant user by ID `sophos_central.common.delete_tenant_user_by_id` - Delete tenant user group by ID `sophos_central.common.delete_tenant_user_group_by_id` - Delete tenant role by ID `sophos_central.common.delete_tenant_role_by_id` - Delete policy `sophos_central.endpoint.delete_policy` - Delete endpoint by ID `sophos_central.endpoint.delete_endpoint_by_id` - Delete mailbox `sophos_central.email.delete_mailbox` - Delete case `sophos_central.cases.delete_case` - Delete tenant endpoint group by ID `sophos_central.endpoint.delete_tenant_endpoint_group_by_id` - Clawback message `sophos_central.email.clawback_message` - Delete mailboxes `sophos_central.email.delete_mailboxes` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do sophos_central.common.delete_tenant_user_by_id confirm_policy: **human** Delete tenant user by ID? **intent:** the user asked me to delete tenant user by ID run suspended · waiting for a named person · key _sophos-central-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "sophos-central-agent", allowed_actions: ["sophos_central.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "sophos_central.common.delete_tenant_user_by_id", approver: "lead@example.com" }, { match: "sophos_central.common.delete_tenant_user_group_by_id", approver: "lead@example.com" }, { match: "sophos_central.common.delete_tenant_role_by_id", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Sophos Central only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Sophos Central costs on actionlake. Every Sophos Central action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Sophos Central refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 415 Sophos Central actions - 415 actions page each page of a long list is one call - 196 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Sophos Central action. 415 actions by area: the id your agent calls, what it does, and its effect. **Endpoint 119** - `sophos_central.endpoint.create_policy` Create policy write - `sophos_central.endpoint.get_policies` Get policies read - `sophos_central.endpoint.get_policy` Get policy read - `sophos_central.endpoint.list_endpoints_by_tenant_id` List endpoints by tenant ID read - `sophos_central.endpoint.add_exploit_mitigation_application` Add exploit mitigation application write - `sophos_central.endpoint.add_intrusion_prevention` Add intrusion prevention write - and 113 more in this area **Email 47** - `sophos_central.email.add_new_mailbox` Add new mailbox write - `sophos_central.email.get_mailbox` Get mailbox read - `sophos_central.email.list_mailboxes` List mailboxes read - `sophos_central.email.update_mailbox` Update mailbox write - `sophos_central.email.add_mailboxes_in_bulk` Add mailboxes in bulk write - `sophos_central.email.bulk_sender_privilege_request` Bulk sender privilege request write - and 41 more in this area **Mobile 45** - `sophos_central.mobile.create_app_group` Create app group write - `sophos_central.mobile.create_custom_device_property` Create custom device property write - `sophos_central.mobile.create_device` Create device write - `sophos_central.mobile.create_device_group` Create device group write - `sophos_central.mobile.create_get_log_action` Create get log action write - `sophos_central.mobile.create_ixm_auto_enrollment_settings` Create IXM auto enrollment settings write - and 39 more in this area **Common 36** - `sophos_central.common.create_tenant_user` Create tenant user write - `sophos_central.common.list_tenant_roles` List tenant roles read - `sophos_central.common.list_tenant_user_groups` List tenant user groups read - `sophos_central.common.list_tenant_users` List tenant users read - `sophos_central.common.add_multiple_users_to_group` Add multiple users to group write - `sophos_central.common.add_user_to_multiple_groups` Add user to multiple groups write - and 30 more in this area **Partner 28** - `sophos_central.partner.create_tenant` Create tenant write - `sophos_central.partner.get_tenant_by_id` Get tenant by ID read - `sophos_central.partner.list_tenants_in_partner` List tenants in partner read - `sophos_central.partner.patch_tenant_by_id` Patch tenant by ID write - `sophos_central.partner.cancel_pending_amendment` Cancel pending amendment destructive - `sophos_central.partner.create_admin_role_assignment` Create admin role assignment destructive - and 22 more in this area **Firewall 23** - `sophos_central.firewall.check_firmware` Check firmware read - `sophos_central.firewall.create_group` Create group write - `sophos_central.firewall.create_mdr_threat_feed_indicators` Create MDR threat feed indicators write - `sophos_central.firewall.list_firewalls` List firewalls read - `sophos_central.firewall.cancel_upgrades` Cancel upgrades destructive - `sophos_central.firewall.complete_firewall_config_import_upload` Complete firewall config import upload write - and 17 more in this area **Organization 16** - `sophos_central.organization.create_organization_admin` Create organization admin write - `sophos_central.organization.create_organization_role` Create organization role write - `sophos_central.organization.get_admin_role_assignments` Get admin role assignments read - `sophos_central.organization.get_organization_admins` Get organization admins read - `sophos_central.organization.create_admin_role_assignment` Create admin role assignment destructive - `sophos_central.organization.delete_organization_admin_by_id` Delete organization admin by ID destructive - and 10 more in this area **Web filtering 16** - `sophos_central.web_filtering.add_site` Add site write - `sophos_central.web_filtering.clone_profile` Clone profile write - `sophos_central.web_filtering.clone_site_list` Clone site list write - `sophos_central.web_filtering.create_profile` Create profile write - `sophos_central.web_filtering.create_site_list` Create site list write - `sophos_central.web_filtering.delete_profile` Delete profile destructive - and 10 more in this area **DNS protection 15** - `sophos_central.dns_protection.create_custom_domains_list` Create custom domains list write - `sophos_central.dns_protection.create_location` Create location write - `sophos_central.dns_protection.create_policy` Create policy write - `sophos_central.dns_protection.get_all_custom_domains_lists` Get all custom domains lists read - `sophos_central.dns_protection.delete_custom_domains_list_by_id` Delete custom domains list by ID destructive - `sophos_central.dns_protection.delete_location` Delete location destructive - and 9 more in this area **Live discover 13** - `sophos_central.live_discover.create_enrichment_pivot` Create enrichment pivot write - `sophos_central.live_discover.get_endpoint_execution_status` Get endpoint execution status read - `sophos_central.live_discover.get_enrichment_pivots` Get enrichment pivots read - `sophos_central.live_discover.get_execution_results_by_id` Get execution results by ID read - `sophos_central.live_discover.delete_enrichment_pivot` Delete enrichment pivot destructive - `sophos_central.live_discover.get_category` Get category read - and 7 more in this area **Cases 9** - `sophos_central.cases.create_case` Create case write - `sophos_central.cases.get_case_by_id` Get case by ID read - `sophos_central.cases.get_cases` Get cases read - `sophos_central.cases.update_case` Update case write - `sophos_central.cases.delete_case` Delete case destructive - `sophos_central.cases.get_case_detection_by_id` Get case detection by ID read - and 3 more in this area **XDR query 9** - `sophos_central.xdr_query.get_query_results` Get query results read - `sophos_central.xdr_query.get_query_runs` Get query runs read - `sophos_central.xdr_query.list_categories` List categories read - `sophos_central.xdr_query.list_queries` List queries read - `sophos_central.xdr_query.cancel_query_run` Cancel query run destructive - `sophos_central.xdr_query.get_category` Get category read - and 3 more in this area **Detections 7** - `sophos_central.detections.get_detections_results` Get detections results read - `sophos_central.detections.get_group_results` Get group results read - `sophos_central.detections.start_detections_run` Start detections run write - `sophos_central.detections.start_group_run` Start group run write - `sophos_central.detections.get_detections_count` Get detections count read - `sophos_central.detections.get_detections_run` Get detections run read - and 1 more in this area **Cloud security 6** - `sophos_central.cloud_security.create_profile` Create profile write - `sophos_central.cloud_security.get_profile` Get profile read - `sophos_central.cloud_security.list_default_contents` List default contents read - `sophos_central.cloud_security.list_profiles` List profiles read - `sophos_central.cloud_security.delete_profiles` Delete profiles destructive - `sophos_central.cloud_security.update_profile_name` Update profile name write **Accounts 4** - `sophos_central.accounts.create_token` Create token write - `sophos_central.accounts.list_tokens_by_tenant_id` List tokens by tenant ID read - `sophos_central.accounts.revoke_token` Revoke token destructive - `sophos_central.accounts.update_token` Update token write **Business automation 4** - `sophos_central.business_automation.get_partner_level_info` Get partner level info read - `sophos_central.business_automation.get_pricing_info` Get pricing info read - `sophos_central.business_automation.get_quote` Get quote read - `sophos_central.business_automation.list_quotes` List quotes read **Health check 4** - `sophos_central.health_check.get_account_health_check` Get account health check read - `sophos_central.health_check.get_historical_scores` Get historical scores read - `sophos_central.health_check.get_regional_scores` Get regional scores read - `sophos_central.health_check.post_snooze` Post snooze write **Switch 3** - `sophos_central.switch.get_mac_filter_settings` Get mac filter settings read - `sophos_central.switch.get_tasks` Get tasks read - `sophos_central.switch.update_mac_filter_settings` Update mac filter settings write **Wifi 3** - `sophos_central.wifi.get_mac_filter_settings` Get mac filter settings read - `sophos_central.wifi.get_tasks` Get tasks read - `sophos_central.wifi.update_mac_filter_settings` Update mac filter settings write **Licensing 2** - `sophos_central.licensing.get_firewalls` Get firewalls read - `sophos_central.licensing.get_licenses_with_usage` Get licenses with usage read **Siem 2** - `sophos_central.siem.get_alerts` Get alerts read - `sophos_central.siem.get_events` Get events read **User activity 2** - `sophos_central.user_activity.create_attestation` Create attestation write - `sophos_central.user_activity.get_attestation_by_id` Get attestation by ID read **Audit 1** - `sophos_central.audit.get_audit_events` Get audit events read **Whoami 1** - `sophos_central.whoami.whoami` Whoami read This index shows a sample of each area. All 415 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Sophos Central MCP server, answered. **Is there a Sophos Central MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 415 Sophos Central actions across endpoint, email, mobile and common, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Sophos Central. **What do I need to connect Sophos Central?** Sophos Central API client ID and Sophos Central API client secret (shown once when the credential is created). actionlake finds base url, tenant id, whoami id and whoami type for you when you connect. The free call account { op: "connections.requirements", service: "sophos_central" } lists exactly what to paste. **Can an AI agent delete or change things in Sophos Central?** Only if its key allows it, and only with an explicit confirmation. 69 Sophos Central actions are destructive, including delete tenant user by ID, delete tenant user group by ID and delete tenant role by ID. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Sophos Central API limit?** actionlake paces every call to the limits in the Sophos Central service file: 10 calls a second and 100 a minute per connection. Repeated reads are answered from cache (196 Sophos Central actions can be), which never reaches Sophos Central. **What does a Sophos Central action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (415 Sophos Central actions page). Cache hits, searches, dry runs and calls Sophos Central refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Sophos Central API does it cover?** The Sophos Central — endpoints, alerts, policies, cases, XDR and Live Discover queries, email, firewall, mobile and partner/organization management API Sophos Central REST APIs (developer.sophos.com OpenAPI 3.0 specs, fetched 2026-10-22) at your Sophos Central instance's API base URL, which you enter when connecting. It is built from Sophos Central's documentation as read on 22 October 2026. 415 actions in 24 areas, each one in the signed service file (version 1.0.0). **Can I combine Sophos Central with my other systems?** Yes. ask joins Sophos Central to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. Sophos Central maps crm.company, which 227 other connectors also map. **Does actionlake keep my Sophos Central data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Sophos Central credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Sophos Central Shares the most action names with - [ESET Connect 18](https://actionlake.com/connectors/eset-connect) - [Imperva Cloud Application Security 17](https://actionlake.com/connectors/imperva-cloud-application-security) - [Commvault Cloud 15](https://actionlake.com/connectors/commvault-cloud) - [Wazuh 14](https://actionlake.com/connectors/wazuh) - [Action1 13](https://actionlake.com/connectors/action1) - [Cato Networks SASE 12](https://actionlake.com/connectors/cato-networks-sase) Joins with, on shared entities - [Microsoft 365 Users 5](https://actionlake.com/connectors/microsoft-365-users) - [Cloudflare 5](https://actionlake.com/connectors/cloudflare) - [JumpCloud 5](https://actionlake.com/connectors/jumpcloud) - [Outreach 5](https://actionlake.com/connectors/outreach) - [Google Workspace Directory 5](https://actionlake.com/connectors/google-workspace-directory) - [Palo Alto Networks Cortex XDR 5](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) Browse - [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Sophos Central; the name is the vendor's own. Counts are from the Sophos Central service file, version 1.0.0. ## Give your agent Sophos Central today. [Connect Sophos Central free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/sophos-central More: https://actionlake.com/llms.txt