Connectors · MSP & PSA
ThreatDown Nebula MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ThreatDown Nebula and the rest of your systems. It gives your agent 439 ThreatDown Nebula actions (249 reads, 144 writes and 46 that wait for a confirmation) and holds the ThreatDown Nebula credential itself, so the agent never does. It paces ThreatDown Nebula's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "threatdown_nebula.users.list", intent: "check which ThreatDown Nebula account is connected"}# Get nebula users · read · 1 upstream call- 439actionsin one signed file
- 249readlook, never change
- 144writecreate and update
- 46wait for a yesdestructive, confirmed first
Set up
Connect ThreatDown Nebula in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect ThreatDown Nebula.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idThreatDown client ID: in the Nebula console go to Settings > API Integrations (Integrate) and add an OAuth2…client_secretThreatDown client secret (shown once when the application is created)account_idYour ThreatDown Nebula account idscopesYour ThreatDown Nebula scopes
account { op: "connections.requirements", service: "threatdown_nebula" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "threatdown_nebula.users.list" }# get nebula users · read · 1 upstream callcheck { action: "threatdown_nebula.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
ThreatDown Nebula at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
account_idscopes- Limits we pace to
- 360 calls a minute, per connection
- API covered
- ThreatDown (Malwarebytes) Nebula (endpoint security: endpoints, detections, jobs, policies, EDR, ITDR, email protection) API ThreatDown APIs 1.0.0 (OpenAPI 3.0, 441 operations)
api.threatdown.com - Built from
- ThreatDown Nebula's documentation, read 23 October 2026cloud.malwarebytes.comapi.malwarebytes.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 203 of 249 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 3, so ask can line ThreatDown Nebula up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in ThreatDown Nebula.
439 actions in 45 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 249readlook, never change
- 144writecreate and update
- 46destructivewait for a confirmation
Grid
5541 read · 14 write · 0 destructive
Export action logs · Export action logs asynchronously · Search action logs · Search grouped action logs
Email protection
4829 read · 13 write · 6 destructive
Get daily usage · Get monthly usage · Register account · Enable auto-sync
Itdr
4017 read · 18 write · 5 destructive
Post ITDR Service Respond Action · Post ITDR Config · Get all ITDR Configs · Get all ITDR Config Status
Endpoints
2416 read · 6 write · 2 destructive
Search endpoints · Get endpoint · Delete a machine · Export endpoints
Firewall management
227 read · 9 write · 6 destructive
Create a new firewall policy · Get firewall policies · Get firewall policy history · Create a new firewall rule
Jobs
1710 read · 4 write · 3 destructive
Export jobs · Issue a job · Issue jobs · Search jobs
Content filtering
169 read · 6 write · 1 destructive
Create content filtering rule · Get a list of content filtering rules · Get list of categories · Get DNS Global Exclusions
Policies
156 read · 7 write · 2 destructive
Get all policies · Clone policy · Create policy · Set policy auto-isolation
37 more areas · 202 actions
- App block 13
- Copilot 13
- Case management 12
- Device control 12
- Notifications 10
- Security advisor 9
- Exclusions 8
- Reports 8
- AI detection response 7
- Flight recorder 7
- Vulnerability management 7
- Detections 6
- Groups 6
- Ignore rules 6
- Schedules 6
- Users 5
- Webhooks 5
- Assets 4
- DNS logs 4
- Drive encryption 4
- Installation tokens 4
- MXDR 4
- OS patches 4
- Preferences 4
- Quarantine 4
- Remediation 4
- Remote intrusion detection 4
- XDR 4
- Products 3
- Suspicious activity 3
- Usage 3
- Account 2
- MDR 2
- Sandbox 2
- Events 1
- Installers 1
- Licensing 1
Top actions
The ThreatDown Nebula API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 8 of ThreatDown Nebula's 8 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
threatdown_nebula.users.listGet nebula users | Get nebula users. | read | identity.user.list474 connectors |
threatdown_nebula.users.createCreate user | Create user. | write | identity.user.create262 connectors |
threatdown_nebula.users.updateUpdate user | Update user. | write | identity.user.update280 connectors |
threatdown_nebula.users.deleteDelete a nebula user | Delete a nebula user. | destructive | identity.user.delete253 connectors |
threatdown_nebula.endpoints.searchSearch endpoints | Search endpoints. | read | device.endpoint.search8 connectors |
threatdown_nebula.endpoints.getGet endpoint | Get endpoint. | read | device.endpoint.get57 connectors |
threatdown_nebula.policies.listGet all policies | Get all policies. | read | this connector |
threatdown_nebula.sa.listSuspicious activity of the account | Suspicious activity of the account. | read | this connector |
threatdown_nebula.cve.bulkGet CVE details by ids | Get CVE details by ids. | read | this connector |
threatdown_nebula.cve.exportExport CVE data | Export CVE data. | read | this connector |
threatdown_nebula.dns.exportExport DNS Log data | Export DNS Log data. | read | this connector |
threatdown_nebula.jobs.issueIssue a job | Issue a job. | write | this connector |
Try it
Prompts to paste into Claude.
Each one names the ThreatDown Nebula actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which ThreatDown Nebula devices have not checked in for a week?
calls
threatdown_nebula.endpoints.search - Writewrite
Create user in ThreatDown Nebula. Show me exactly what you will send before you save it.
calls
threatdown_nebula.users.create
Governance for ThreatDown Nebula
Destructive actions wait for a yes.
46 ThreatDown Nebula actions are destructive. The first 10:
- Delete a nebula user
threatdown_nebula.users.delete - Delete a machine
threatdown_nebula.endpoints.delete - Delete group by id
threatdown_nebula.groups.delete - Delete report by id
threatdown_nebula.reports.delete - Delete policy
threatdown_nebula.policies.delete - Delete ITDR Predefined Identity Tag
threatdown_nebula.itdr_tags.delete - Cancel pending jobs
threatdown_nebula.jobs_bulk.delete - Delete a schedule
threatdown_nebula.schedules.delete - Delete AIDR rule
threatdown_nebula.aidr_rules.delete - Delete exclusion by id
threatdown_nebula.exclusions.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete a nebula user?
intent: the user asked me to delete a nebula user
account { op: "keys.create", name: "threatdown-nebula-agent", allowed_actions: ["threatdown_nebula.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "threatdown_nebula.users.delete", approver: "[email protected]" }, { match: "threatdown_nebula.endpoints.delete", approver: "[email protected]" }, { match: "threatdown_nebula.groups.delete", approver: "[email protected]" } ]}Cost
What ThreatDown Nebula costs on actionlake.
Every ThreatDown Nebula action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call ThreatDown Nebula refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 439 ThreatDown Nebula actions
- 439actions pageeach page of a long list is one call
- 203reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every ThreatDown Nebula action.
439 actions by area: the id your agent calls, what it does, and its effect.
Grid55
threatdown_nebula.grid_action_logs.exportExport action logsreadthreatdown_nebula.grid_action_logs.export_asyncExport action logs asynchronouslywritethreatdown_nebula.grid_action_logs.searchSearch action logsreadthreatdown_nebula.grid_action_logs.search_groupbySearch grouped action logsreadthreatdown_nebula.grid_ai_domains.exportExport AI domain activityreadthreatdown_nebula.grid_ai_domains.export_asyncExport AI domain activity (async)write- and 49 more in this area
Email protection48
threatdown_nebula.email_protection_account.daily_usageGet daily usagereadthreatdown_nebula.email_protection_account.monthly_usageGet monthly usagereadthreatdown_nebula.email_protection_account.registerRegister accountwritethreatdown_nebula.email_protection_account_auto_sync.createEnable auto-syncwritethreatdown_nebula.email_protection_account.disableDelete accountdestructivethreatdown_nebula.email_protection_account_911_mailbox.deleteDelete 911 mailboxdestructive- and 42 more in this area
Itdr40
threatdown_nebula.itdr.respond_service_actionPost ITDR Service Respond Actionwritethreatdown_nebula.itdr_config.createPost ITDR Configwritethreatdown_nebula.itdr_config_all.listGet all ITDR Configsreadthreatdown_nebula.itdr_config_status.listGet all ITDR Config Statusreadthreatdown_nebula.itdr_config.deleteDelete ITDR Configdestructivethreatdown_nebula.itdr_config_identity_protection_setting.getGet ITDR Identity Protection Settingread- and 34 more in this area
Endpoints24
threatdown_nebula.endpoints.deleteDelete a machinedestructivethreatdown_nebula.endpoints.exportExport endpointsreadthreatdown_nebula.endpoints.getGet endpointreadthreatdown_nebula.endpoints.searchSearch endpointsreadthreatdown_nebula.endpoints.delete_bulkDelete multiple machinesdestructivethreatdown_nebula.endpoints.export_asyncExport endpoints asynchronouslywrite- and 18 more in this area
Firewall management22
threatdown_nebula.firewall_policies.createCreate a new firewall policywritethreatdown_nebula.firewall_policies.listGet firewall policiesreadthreatdown_nebula.firewall_policies_history.listGet firewall policy historyreadthreatdown_nebula.firewall_rules.createCreate a new firewall rulewritethreatdown_nebula.firewall_policies.deleteDelete a firewall policydestructivethreatdown_nebula.firewall_policies.getGet a firewall policyread- and 16 more in this area
Jobs17
threatdown_nebula.jobs.exportExport jobsreadthreatdown_nebula.jobs.issueIssue a jobwritethreatdown_nebula.jobs.issue_bulkIssue jobswritethreatdown_nebula.jobs.searchSearch jobsreadthreatdown_nebula.jobs.getGet details about a jobreadthreatdown_nebula.jobs.search_groupbySearch jobs groupByread- and 11 more in this area
Content filtering16
threatdown_nebula.content_filtering.createCreate content filtering rulewritethreatdown_nebula.content_filtering.searchGet a list of content filtering rulesreadthreatdown_nebula.content_filtering_categories.listGet list of categoriesreadthreatdown_nebula.content_filtering_exclusions.listGet DNS Global Exclusionsreadthreatdown_nebula.content_filtering.deleteDelete content filtering ruledestructivethreatdown_nebula.content_filtering.enableEnable/Disable content filtering rulewrite- and 10 more in this area
Policies15
threatdown_nebula.policies.cloneClone policywritethreatdown_nebula.policies.createCreate policywritethreatdown_nebula.policies.listGet all policiesreadthreatdown_nebula.policies_auto_isolation.createSet policy auto-isolationwritethreatdown_nebula.policies.deleteDelete policydestructivethreatdown_nebula.policies.getGet policy by idread- and 9 more in this area
App block13
threatdown_nebula.app_block_activity.exportExport app block activityreadthreatdown_nebula.app_block_activity.export_asyncExport app block activity asynchronouslywritethreatdown_nebula.app_block_activity.searchSearch app block activityreadthreatdown_nebula.app_block_activity.search_groupbySearch app block activity groupbyreadthreatdown_nebula.app_block_rules.createCreate App Block Rulewritethreatdown_nebula.app_block_rules.deleteDelete App Block Ruledestructive- and 7 more in this area
Copilot13
threatdown_nebula.copilot_chats.createCreate Copilot chatwritethreatdown_nebula.copilot_chats.feedbackPost Copilot chat feedbackwritethreatdown_nebula.copilot_chats.listGet Copilot chatsreadthreatdown_nebula.copilot_chats.messagePost message to Copilot chatwritethreatdown_nebula.copilot_chats.deleteDelete Copilot chat by IDdestructivethreatdown_nebula.copilot_chats.getGet Copilot chat by IDread- and 7 more in this area
Case management12
threatdown_nebula.casemgmt_cases.actionPost cases Actionwritethreatdown_nebula.casemgmt_cases.requestsPost cases Requestswritethreatdown_nebula.casemgmt_cases.searchPost cases searchwritethreatdown_nebula.casemgmt_cases_comments.createPost cases commentswritethreatdown_nebula.casemgmt_cases.favoritePut cases favoritewritethreatdown_nebula.casemgmt_cases_comments.listGet cases commentsread- and 6 more in this area
Device control12
threatdown_nebula.devicecontrol.exportExport device control eventsreadthreatdown_nebula.devicecontrol.export_asyncExport device control events asynchronouslywritethreatdown_nebula.devicecontrol.searchSearch device control eventsreadthreatdown_nebula.devicecontrol.search_groupbySearch device control events groupByreadthreatdown_nebula.devicecontrol.getGet device control event by IDreadthreatdown_nebula.devicecontrol_exclusions.bulkCreate device exclusions in bulkwrite- and 6 more in this area
Notifications10
threatdown_nebula.notifications_subscriptions.change_ownerChange notification ownerwritethreatdown_nebula.notifications_subscriptions.createCreate notificationwritethreatdown_nebula.notifications_subscriptions.getGet notificationreadthreatdown_nebula.notifications_subscriptions.listGet all notificationsreadthreatdown_nebula.notifications_subscriptions.deleteDelete notificationdestructivethreatdown_nebula.notifications_subscriptions.updateUpdate notificationwrite- and 4 more in this area
Security advisor9
threatdown_nebula.sam_assets.softwareIssue bulk software update jobswritethreatdown_nebula.sam_details.listList SAM issuesreadthreatdown_nebula.sam_dns_categories.listGet supported DNS categoriesreadthreatdown_nebula.sam_jobs.statusGet list of ongoing SAM jobsreadthreatdown_nebula.sam_details.getList SAM issues by categoryreadthreatdown_nebula.sam_policy_details.getGet Policy protection featuresread- and 3 more in this area
Exclusions8
threatdown_nebula.exclusions.createCreate exclusionwritethreatdown_nebula.exclusions.evaluatesEvaluate exclusions riskwritethreatdown_nebula.exclusions.getGet exclusion by idreadthreatdown_nebula.exclusions.listGet exclusionsreadthreatdown_nebula.exclusions.deleteDelete exclusion by iddestructivethreatdown_nebula.exclusions.delete_bulkDelete exclusions in bulkdestructive- and 2 more in this area
Reports8
threatdown_nebula.reports.change_ownerChange reports ownerwritethreatdown_nebula.reports.createCreate reportwritethreatdown_nebula.reports.generateGenerate reportwritethreatdown_nebula.reports.listGet all reportsreadthreatdown_nebula.reports.deleteDelete report by iddestructivethreatdown_nebula.reports.delete_bulkDelete reports bulkdestructive- and 2 more in this area
AI detection response7
threatdown_nebula.aidr_metadata.listGet AIDR metadatareadthreatdown_nebula.aidr_rules.createCreate AIDR rulewritethreatdown_nebula.aidr_rules.listList AIDR rulesreadthreatdown_nebula.aidr_tools.searchSearch AI toolsreadthreatdown_nebula.aidr_rules.deleteDelete AIDR ruledestructivethreatdown_nebula.aidr_rules.getGet AIDR rule by IDread- and 1 more in this area
Flight recorder7
threatdown_nebula.flight_recorder.chartSearch occurrence of suspicious activityreadthreatdown_nebula.flight_recorder.process_graphSearch the process graphreadthreatdown_nebula.flight_recorder.processesSearch a list of processesreadthreatdown_nebula.flight_recorder.raw_eventsSearch a list of raw eventsreadthreatdown_nebula.flight_recorder.recapSearch suspicious activityreadthreatdown_nebula.flight_recorder.searchSearch the flight recorder with advanced queries.read- and 1 more in this area
Vulnerability management7
threatdown_nebula.cve.bulkGet CVE details by idsreadthreatdown_nebula.cve.exportExport CVE datareadthreatdown_nebula.cve.export_asyncExport CVE data asynchronouslywritethreatdown_nebula.cve.ignoreIgnore CVEswritethreatdown_nebula.cve.getGet CVE details by idreadthreatdown_nebula.cve.searchSearch CVEread- and 1 more in this area
Detections6
threatdown_nebula.detections.exportExport detectionsreadthreatdown_nebula.detections.export_asyncExport detections asynchronouslywritethreatdown_nebula.detections.searchSearch detectionsreadthreatdown_nebula.detections.search_groupbySearch detections groupByreadthreatdown_nebula.detections.getGet detection by IDreadthreatdown_nebula.detections.submit_fpSubmit false positive requestwrite
Groups6
threatdown_nebula.groups.createCreate groupwritethreatdown_nebula.groups.getGet group by idreadthreatdown_nebula.groups.listGet all groupsreadthreatdown_nebula.groups.machinesAssign endpoints to a groupwritethreatdown_nebula.groups.deleteDelete group by iddestructivethreatdown_nebula.groups.updateUpdate groupwrite
Ignore rules6
threatdown_nebula.assets_ignore_rules.createCreate asset ignore rulewritethreatdown_nebula.assets_ignore_rules.getGet asset ignore rule detailsreadthreatdown_nebula.assets_ignore_rules.listGet asset ignore rulesreadthreatdown_nebula.assets_ignore_rules.updateUpdate asset ignore rulewritethreatdown_nebula.assets_ignore_rules.deleteDelete asset ignore ruledestructivethreatdown_nebula.assets_ignore_rules.delete_bulkBulk delete asset ignore rulesdestructive
Schedules6
threatdown_nebula.schedules.createCreate schedulewritethreatdown_nebula.schedules.getGet schedule by idreadthreatdown_nebula.schedules.groupsAdd groups for schedulewritethreatdown_nebula.schedules.listGet schedulesreadthreatdown_nebula.schedules.deleteDelete a scheduledestructivethreatdown_nebula.schedules.updateUpdate schedulewrite
Users5
threatdown_nebula.users.createCreate userwritethreatdown_nebula.users.getGet one userreadthreatdown_nebula.users.listGet nebula usersreadthreatdown_nebula.users.updateUpdate userwritethreatdown_nebula.users.deleteDelete a nebula userdestructive
Webhooks5
threatdown_nebula.webhooks_subscriptions.createCreate subscriptionwritethreatdown_nebula.webhooks_subscriptions.getGet a subscriptionreadthreatdown_nebula.webhooks_subscriptions.listGet all subscriptionsreadthreatdown_nebula.webhooks_subscriptions.updateUpdate a subscriptionwritethreatdown_nebula.webhooks_subscriptions.deleteDelete subscriptiondestructive
Assets4
threatdown_nebula.assets_software.exportExport assets softwarereadthreatdown_nebula.assets_software.export_asyncExport assets software asynchronouslywritethreatdown_nebula.assets_software.searchSearch assets softwarereadthreatdown_nebula.assets_software.search_groupbySearch assets software groupByread
DNS logs4
threatdown_nebula.dns.exportExport DNS Log datareadthreatdown_nebula.dns.export_asyncExport DNS Log data asynchronouslywritethreatdown_nebula.dns.searchSearch DNS Logsreadthreatdown_nebula.dns.search_groupbySearch DNS Logs groupByread
Drive encryption4
threatdown_nebula.drive_encryption.exportExport drive encryption datareadthreatdown_nebula.drive_encryption.groupbySearch drive encryption grouped by a fieldreadthreatdown_nebula.drive_encryption.searchSearch drive encryptionreadthreatdown_nebula.drive_encryption_summary.getGet drive encryption summaryread
Installation tokens4
threatdown_nebula.installation_token.createGenerate an installation tokenswritethreatdown_nebula.installation_token.deleteRevoke installation tokendestructivethreatdown_nebula.installation_token.listGet installation tokensreadthreatdown_nebula.installation_token.sendSend installation tokenswrite
MXDR4
threatdown_nebula.mxdr_config.createPost MXDR Configwritethreatdown_nebula.mxdr_config.deleteDelete MXDR Configdestructivethreatdown_nebula.mxdr_config_all.listGet all MXDR Configsreadthreatdown_nebula.mxdr_config_status.listGet all MXDR Config Statusread
OS patches4
threatdown_nebula.os_patches.exportExport OS Patchesreadthreatdown_nebula.os_patches.export_asyncExport OS Patches asynchronouslywritethreatdown_nebula.os_patches.searchSearch OS Patchesreadthreatdown_nebula.os_patches.search_groupbySearch OS Patches groupByread
Preferences4
threatdown_nebula.preferences_notifications.getGet notifications preferencesreadthreatdown_nebula.preferences_notifications.updateUpdate notifications preferenceswritethreatdown_nebula.preferences_threatdown_ai.getGet ThreatDown AI preferencesreadthreatdown_nebula.preferences_threatdown_ai.updateUpdate ThreatDown AI preferenceswrite
Quarantine4
threatdown_nebula.quarantine.actionBulk quarantine actionwritethreatdown_nebula.quarantine.exportExport quarantinesreadthreatdown_nebula.quarantine.listGet all quarantined itemsreadthreatdown_nebula.quarantine.searchSearch quarantinesread
Remediation4
threatdown_nebula.remediation.exportExport remediation Itemsreadthreatdown_nebula.remediation.searchSearch remediation Itemsreadthreatdown_nebula.remediation_remediate.createBulk remediation actionwritethreatdown_nebula.remediation_remediate.deleteMark remediation items as safedestructive
Remote intrusion detection4
threatdown_nebula.rid_rules.exportExport RID rulesreadthreatdown_nebula.rid_rules.export_asyncExport RID rules asynchronouslywritethreatdown_nebula.rid_rules.searchSearch RID rulesreadthreatdown_nebula.rid_rules.search_groupbySearch grouped RIDread
XDR4
threatdown_nebula.xdr_alerts.actionSet alert action takenwritethreatdown_nebula.xdr_alerts.action_bulkSet alert action taken in bulkwritethreatdown_nebula.xdr_alerts.getGet alert detailsreadthreatdown_nebula.xdr_alerts.statusSet alert statuswrite
Products3
threatdown_nebula.products.searchSearch productsreadthreatdown_nebula.products_categories.listGet categoriesreadthreatdown_nebula.products_vendors.searchSearch vendorsread
Suspicious activity3
threatdown_nebula.sa.detailsSuspicious activity detailsreadthreatdown_nebula.sa.listSuspicious activity of the accountreadthreatdown_nebula.sa_process_graph.getSuspicious activity process graphread
Usage3
threatdown_nebula.usage.histogramSearch usage histogramreadthreatdown_nebula.usage_logs.searchSearch logs of usagereadthreatdown_nebula.usage_logs.summarySearch summary of usageread
Account2
threatdown_nebula.account.getGet account detailsreadthreatdown_nebula.account_ad_structure.getGet account AD structureread
MDR2
threatdown_nebula.mdr_config.createConfigure managed settingswritethreatdown_nebula.mdr_config.listGet managed settingsread
Sandbox2
threatdown_nebula.sandbox.uploadUpload file to the sandboxwritethreatdown_nebula.sandbox_submissions.searchSearch the sandbox submission resultsread
Events1
threatdown_nebula.events.listRetrieve eventsread
Installers1
threatdown_nebula.installers.getRetrieve installers's linksread
Licensing1
threatdown_nebula.license.amendAmend a licensewrite
This index shows a sample of each area. All 439 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The ThreatDown Nebula MCP server, answered.
Is there a ThreatDown Nebula MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 439 ThreatDown Nebula actions across grid, email protection, itdr and endpoints, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ThreatDown Nebula.
What do I need to connect ThreatDown Nebula?
ThreatDown client ID: in the Nebula console go to Settings > API Integrations (Integrate) and add an OAuth2… and ThreatDown client secret (shown once when the application is created). Plus your account id and your scopes. The free call account { op: "connections.requirements", service: "threatdown_nebula" } lists exactly what to paste.
Can an AI agent delete or change things in ThreatDown Nebula?
Only if its key allows it, and only with an explicit confirmation. 46 ThreatDown Nebula actions are destructive, including delete a nebula user, delete a machine and delete group by id. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my ThreatDown Nebula API limit?
actionlake paces every call to the limits in the ThreatDown Nebula service file: 360 calls a minute per connection. Repeated reads are answered from cache (203 ThreatDown Nebula actions can be), which never reaches ThreatDown Nebula.
What does a ThreatDown Nebula action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (439 ThreatDown Nebula actions page). Cache hits, searches, dry runs and calls ThreatDown Nebula refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which ThreatDown Nebula API does it cover?
The ThreatDown (Malwarebytes) Nebula (endpoint security: endpoints, detections, jobs, policies, EDR, ITDR, email protection) API ThreatDown APIs 1.0.0 (OpenAPI 3.0, 441 operations) at api.threatdown.com. It is built from ThreatDown Nebula's documentation as read on 23 October 2026. 439 actions in 45 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my ThreatDown Nebula data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ThreatDown Nebula credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent ThreatDown Nebula today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
