Skip to content
actionlake
Start free

Connectors · MSP & PSA

ThreatDown OneView MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ThreatDown OneView and the rest of your systems. It gives your agent 418 ThreatDown OneView actions (242 reads, 134 writes and 42 that wait for a confirmation) and holds the ThreatDown OneView credential itself, so the agent never does. It paces ThreatDown OneView's limits and records every call.

Connect ThreatDown OneView freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "threatdown_oneview.sites.list",  intent: "check which ThreatDown OneView account is connected"}# Get all sites · read · 1 upstream call
  • 418actionsin one signed file
  • 242readlook, never change
  • 134writecreate and update
  • 42wait for a yesdestructive, confirmed first

Set up

Connect ThreatDown OneView in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect ThreatDown OneView.

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idThreatDown OneView client ID: in the OneView console go to Settings > API Integrations and add an OAuth2 application…
    • client_secretThreatDown OneView client secret (shown once when the application is created)
    • scopesYour ThreatDown OneView scopes
    account { op: "connections.requirements", service: "threatdown_oneview" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "threatdown_oneview.sites.list" }# get all sites · read · 1 upstream callcheck { action: "threatdown_oneview.sites.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

ThreatDown OneView at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Setup fields
scopes
Limits we pace to
360 calls a minute, per connection
API covered
ThreatDown (Malwarebytes) OneView (MSP console: sites, subscriptions, usage, cross-site endpoints, detections, jobs, policies) API ThreatDown OneView APIs 1.0.0 (OpenAPI 3.0, 419 operations)api.threatdown.com
Built from
ThreatDown OneView's documentation, read 23 October 2026cloud.malwarebytes.comapi.malwarebytes.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
231 of 242 reads, for up to 5 minutes; a write clears what it affects
Shared entities
4, so ask can line ThreatDown OneView up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in ThreatDown OneView.

418 actions in 40 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 242readlook, never change
  • 134writecreate and update
  • 42destructivewait for a confirmation

  1. Grid

    57

    42 read · 14 write · 1 destructive

    Export action logs · Export action logs asynchronously · Search action logs · Search grouped action logs

  2. Email protection

    53

    31 read · 16 write · 6 destructive

    Search emails · Search incidents · Migrate Email Protection · Migration Eligibility

  3. Endpoints

    23

    16 read · 5 write · 2 destructive

    Search endpoints across accounts · Get endpoint · Delete an endpoint · Export endpoints (Bulk across accounts)

  4. Firewall management

    22

    7 read · 9 write · 6 destructive

    Create a new firewall policy · Get firewall policies · Get firewall policy history · Create a new firewall rule

  5. Content filtering

    18

    11 read · 6 write · 1 destructive

    Create content filtering rule · Get a list of content filtering rules · Search DNS blockPages for accounts · Get list of categories

  6. Jobs

    18

    10 read · 5 write · 3 destructive

    Export jobs · Issue a job · Bulk issue jobs across accounts · Issue quarantine jobs in bulk

  7. Policies V2

    18

    7 read · 8 write · 3 destructive

    Clone policy · Create policy · Get all policies · Get policies of multiple accounts

  8. Subscriptions

    18

    10 read · 7 write · 1 destructive

    Create subscription · Get all subscriptions · Get entitlements · Get usage

32 more areas · 191 actions
  • App block 13
  • Device control 13
  • Case management 12
  • Notifications 10
  • Policies 10
  • Reports 8
  • AI detection response 7
  • Flight recorder 7
  • Groups 7
  • Schedules 7
  • Sites 7
  • Syslog 7
  • Vulnerability management 7
  • Ignore rules 6
  • Suspicious activity 6
  • Usage 6
  • Users 6
  • Detections 5
  • Exclusions 5
  • Vulnerability assessment 5
  • Webhooks 5
  • Assets 4
  • DNS 4
  • Installation tokens 4
  • OS patches 4
  • Preferences 4
  • Remote intrusion detection 4
  • Quarantine 3
  • MDR 2
  • Events 1
  • Info 1
  • Installers 1

Top actions

The ThreatDown OneView API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 13 of ThreatDown OneView's 13 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
threatdown_oneview.sites.listGet all sitesGet all sites.readcrm.company.list162 connectors
threatdown_oneview.users.listGet all usersGet all users.readidentity.user.list474 connectors
threatdown_oneview.sites.createCreate new siteCreate new site.writecrm.company.create142 connectors
threatdown_oneview.users.createCreate new userCreate new user.writeidentity.user.create262 connectors
threatdown_oneview.sites.deleteDelete siteDelete site.destructivecrm.company.delete119 connectors
threatdown_oneview.endpoints.search_allSearch endpoints across accountsSearch endpoints across accounts.readdevice.endpoint.search8 connectors
threatdown_oneview.endpoints.getGet endpointGet endpoint.readdevice.endpoint.get57 connectors
threatdown_oneview.policies.listGet all policiesGet all policies.readthis connector
threatdown_oneview.sa.listSuspicious activity of the accountSuspicious activity of the account.readthis connector
threatdown_oneview.sa.openReopen suspicious activities in bulkReopen suspicious activities in bulk.writethis connector
threatdown_oneview.cve.exportExport CVEExport CVE.readthis connector
threatdown_oneview.cve.ignoreIgnore CVEsIgnore CVEs.writethis connector

Try it

Prompts to paste into Claude.

Each one names the ThreatDown OneView actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which ThreatDown OneView devices have not checked in for a week?

    callsthreatdown_oneview.endpoints.search_all

  2. Writewrite

    Create new site in ThreatDown OneView. Show me exactly what you will send before you save it.

    callsthreatdown_oneview.sites.create

  3. Across systemsread

    Which ThreatDown OneView companies have invoices in NetSuite, and how many each?

    callsthreatdown_oneview.sites.listnetsuite.views.invoices

Across your systems

ThreatDown OneView, joined to the rest of your business.

One ask fetches from ThreatDown OneView and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

  • Which ThreatDown OneView companies have invoices in NetSuite, and how many each?

    threatdown_oneview.sites.list + netsuite.views.invoices, on crm.company · NetSuite

  • Which ThreatDown OneView companies have tickets in HubSpot CRM, and how many each?

    threatdown_oneview.sites.list + hubspot_crm.tickets.list, on crm.company · HubSpot CRM

Also mapped by other connectorsidentity.user 517crm.company 227device.endpoint 69security.policy 28
ask
ask {  intent: "which ThreatDown OneView companies have invoices in NetSuite, and how many each",  steps: [    { action: "threatdown_oneview.sites.list", as: "co", input: {}, limit: 100, max_pages: 5 },    { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 },    { join: {        left: "co",        right: "inv",        on: "crm.company",        group_by: "co.name",        select: ["co.name", "count(inv.id) as invoices"]    } }  ]}
Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for ThreatDown OneView

Destructive actions wait for a yes.

42 ThreatDown OneView actions are destructive. The first 10:

  • Delete sitethreatdown_oneview.sites.delete
  • Delete userthreatdown_oneview.users.delete
  • Delete an endpointthreatdown_oneview.endpoints.delete
  • Delete group by its idthreatdown_oneview.groups.delete
  • Delete report by idthreatdown_oneview.reports.delete
  • Delete policythreatdown_oneview.policies.delete
  • Cancel pending jobs across accountsthreatdown_oneview.jobs.delete_bulk
  • Delete a schedulethreatdown_oneview.schedules.delete
  • Delete AI Detection & Response rulethreatdown_oneview.aidr_rules.delete
  • Delete exclusionthreatdown_oneview.exclusions.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dothreatdown_oneview.sites.deleteconfirm_policy: human

Delete site?

intent: the user asked me to delete site

run suspended · waiting for a named person · key threatdown-oneview-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "threatdown-oneview-agent",  allowed_actions: ["threatdown_oneview.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "threatdown_oneview.sites.delete", approver: "[email protected]" },    { match: "threatdown_oneview.users.delete", approver: "[email protected]" },    { match: "threatdown_oneview.endpoints.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to ThreatDown OneView only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What ThreatDown OneView costs on actionlake.

Every ThreatDown OneView action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call ThreatDown OneView refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 418 ThreatDown OneView actions
  • 418actions pageeach page of a long list is one call
  • 231reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every ThreatDown OneView action.

418 actions by area: the id your agent calls, what it does, and its effect.

Grid57
  • threatdown_oneview.grid_action_logs.exportExport action logsread
  • threatdown_oneview.grid_action_logs.export_asyncExport action logs asynchronouslywrite
  • threatdown_oneview.grid_action_logs.searchSearch action logsread
  • threatdown_oneview.grid_action_logs.search_groupbySearch grouped action logsread
  • threatdown_oneview.grid_ai_domains.exportExport AI domain activity across accountsread
  • threatdown_oneview.grid_ai_domains.export_asyncExport AI domain activity across accounts asynchronouslywrite
  • and 51 more in this area
Email protection53
  • threatdown_oneview.email_protection.emailsSearch emailsread
  • threatdown_oneview.email_protection.incidentsSearch incidentsread
  • threatdown_oneview.email_protection.migrateMigrate Email Protectionwrite
  • threatdown_oneview.email_protection.migration_eligibilityMigration Eligibilityread
  • threatdown_oneview.email_protection.disableDisable email protection accountdestructive
  • threatdown_oneview.email_protection.registerRegister email protection accountwrite
  • and 47 more in this area
Endpoints23
  • threatdown_oneview.endpoints.deleteDelete an endpointdestructive
  • threatdown_oneview.endpoints.exportExport endpoints (Bulk across accounts)read
  • threatdown_oneview.endpoints.getGet endpointread
  • threatdown_oneview.endpoints.search_allSearch endpoints across accountsread
  • threatdown_oneview.endpoints.delete_bulkDelete multiple endpoints across accountsdestructive
  • threatdown_oneview.endpoints.export_asyncExport endpoints asynchronouslywrite
  • and 17 more in this area
Firewall management22
  • threatdown_oneview.firewall_policies.createCreate a new firewall policywrite
  • threatdown_oneview.firewall_policies.listGet firewall policiesread
  • threatdown_oneview.firewall_policies_history.listGet firewall policy historyread
  • threatdown_oneview.firewall_rules.createCreate a new firewall rulewrite
  • threatdown_oneview.firewall_policies.deleteDelete a firewall policydestructive
  • threatdown_oneview.firewall_policies.getGet a firewall policyread
  • and 16 more in this area
Content filtering18
  • threatdown_oneview.content_filtering.createCreate content filtering rulewrite
  • threatdown_oneview.content_filtering.search_allGet a list of content filtering rulesread
  • threatdown_oneview.content_filtering_blockpage.search_allSearch DNS blockPages for accountsread
  • threatdown_oneview.content_filtering_categories.listGet list of categoriesread
  • threatdown_oneview.content_filtering.deleteDelete content filtering ruledestructive
  • threatdown_oneview.content_filtering.enableEnable/Disable content filtering rulewrite
  • and 12 more in this area
Jobs18
  • threatdown_oneview.jobs.exportExport jobsread
  • threatdown_oneview.jobs.issueIssue a jobwrite
  • threatdown_oneview.jobs.issue_bulkBulk issue jobs across accountswrite
  • threatdown_oneview.jobs.issue_quarantine_bulkIssue quarantine jobs in bulkwrite
  • threatdown_oneview.jobs.delete_bulkCancel pending jobs across accountsdestructive
  • threatdown_oneview.jobs.getGet details about a jobread
  • and 12 more in this area
Policies V218
  • threatdown_oneview.v2_policies.cloneClone policywrite
  • threatdown_oneview.v2_policies.createCreate policywrite
  • threatdown_oneview.v2_policies.listGet all policiesread
  • threatdown_oneview.v2_policies.search_allGet policies of multiple accountsread
  • threatdown_oneview.v2_policies.deleteDelete policydestructive
  • threatdown_oneview.v2_policies.getGet policy by idread
  • and 12 more in this area
Subscriptions18
  • threatdown_oneview.sites_subscriptions.createCreate subscriptionwrite
  • threatdown_oneview.sites_subscriptions_all.listGet all subscriptionsread
  • threatdown_oneview.subscriptions.listGet entitlementsread
  • threatdown_oneview.subscriptions_quantity.listGet usageread
  • threatdown_oneview.sites_subscriptions.deleteDelete a subscriptiondestructive
  • threatdown_oneview.sites_subscriptions.getGet subscriptionread
  • and 12 more in this area
App block13
  • threatdown_oneview.app_block_activity.exportExport app block activityread
  • threatdown_oneview.app_block_activity.export_asyncExport app block activity asynchronouslywrite
  • threatdown_oneview.app_block_activity.searchSearch app block activityread
  • threatdown_oneview.app_block_activity.search_groupbySearch app block activity groupbyread
  • threatdown_oneview.app_block_rules.createCreate App Block Rulewrite
  • threatdown_oneview.app_block_rules.deleteDelete App Block Ruledestructive
  • and 7 more in this area
Device control13
  • threatdown_oneview.devicecontrol.exportExport device control eventsread
  • threatdown_oneview.devicecontrol.export_asyncExport device control events asynchronouslywrite
  • threatdown_oneview.devicecontrol.searchSearch device control events across accountsread
  • threatdown_oneview.devicecontrol.search_groupbyGroup device control events across accountsread
  • threatdown_oneview.devicecontrol.getGet detection control event by IDread
  • threatdown_oneview.devicecontrol_exclusions.createCreate a device exclusionwrite
  • and 7 more in this area
Case management12
  • threatdown_oneview.casemgmt_cases.actionPerform an action on caseswrite
  • threatdown_oneview.casemgmt_cases.requestsPost Cases Requestswrite
  • threatdown_oneview.casemgmt_cases.searchSearch Casesread
  • threatdown_oneview.casemgmt_cases_comments.createPost cases commentswrite
  • threatdown_oneview.casemgmt_cases.favoritePut Cases favoritewrite
  • threatdown_oneview.casemgmt_cases_comments.listGet cases commentsread
  • and 6 more in this area
Notifications10
  • threatdown_oneview.notifications_subscriptions.change_ownerChange notification ownerwrite
  • threatdown_oneview.notifications_subscriptions.createCreate notificationwrite
  • threatdown_oneview.notifications_subscriptions.getGet notificationread
  • threatdown_oneview.notifications_subscriptions.listGet all notificationsread
  • threatdown_oneview.notifications_subscriptions.deleteDelete notificationdestructive
  • threatdown_oneview.notifications_subscriptions.updateUpdate notificationwrite
  • and 4 more in this area
Policies10
  • threatdown_oneview.policies.createCreate new policywrite
  • threatdown_oneview.policies.defaultSet defaultwrite
  • threatdown_oneview.policies.listGet all policiesread
  • threatdown_oneview.policies_secret.createSet policy tamper protection passwordwrite
  • threatdown_oneview.policies.deleteDelete policydestructive
  • threatdown_oneview.policies.getGet policyread
  • and 4 more in this area
Reports8
  • threatdown_oneview.reports.change_ownerChange reports ownerwrite
  • threatdown_oneview.reports.createCreate reportwrite
  • threatdown_oneview.reports.generateGenerate reportwrite
  • threatdown_oneview.reports.listGet all reportsread
  • threatdown_oneview.reports.deleteDelete report by iddestructive
  • threatdown_oneview.reports.delete_bulkDelete reports bulkdestructive
  • and 2 more in this area
AI detection response7
  • threatdown_oneview.aidr_metadata.listGet AI Detection & Response metadataread
  • threatdown_oneview.aidr_rules.createCreate AI Detection & Response rulewrite
  • threatdown_oneview.aidr_rules.listList AI Detection & Response rulesread
  • threatdown_oneview.aidr_tools.searchSearch AI toolsread
  • threatdown_oneview.aidr_rules.deleteDelete AI Detection & Response ruledestructive
  • threatdown_oneview.aidr_rules.getGet AI Detection & Response ruleread
  • and 1 more in this area
Flight recorder7
  • threatdown_oneview.flight_recorder.chartSearch occurrence of suspicious activityread
  • threatdown_oneview.flight_recorder.process_graphSearch the process graphread
  • threatdown_oneview.flight_recorder.processesSearch a list of processesread
  • threatdown_oneview.flight_recorder.raw_eventsSearch a list of raw eventsread
  • threatdown_oneview.flight_recorder.recapSearch suspicious activityread
  • threatdown_oneview.flight_recorder.searchSearch the flight recorder with advanced queriesread
  • and 1 more in this area
Groups7
  • threatdown_oneview.groups.assign_machinesAssign endpoints to a group across accountswrite
  • threatdown_oneview.groups.createCreate groupwrite
  • threatdown_oneview.groups.listGet all groupsread
  • threatdown_oneview.groups.search_allFilter groups across accountsread
  • threatdown_oneview.groups.deleteDelete group by its iddestructive
  • threatdown_oneview.groups.getGet group by idread
  • and 1 more in this area
Schedules7
  • threatdown_oneview.schedules.createCreate schedulewrite
  • threatdown_oneview.schedules.getGet schedule by idread
  • threatdown_oneview.schedules.listGet schedulesread
  • threatdown_oneview.schedules.search_allGet schedules of multiple accountsread
  • threatdown_oneview.schedules.deleteDelete a scheduledestructive
  • threatdown_oneview.schedules.groupsAdd groups for schedulewrite
  • and 1 more in this area
Sites7
  • threatdown_oneview.sites.createCreate new sitewrite
  • threatdown_oneview.sites.getGet site by IDread
  • threatdown_oneview.sites.listGet all sitesread
  • threatdown_oneview.sites.updateUpdate sitewrite
  • threatdown_oneview.sites.deleteDelete sitedestructive
  • threatdown_oneview.sites_nebula_accounts.getGet site by nebula account IDread
  • and 1 more in this area
Syslog7
  • threatdown_oneview.syslog.createCreate new syslog config record.write
  • threatdown_oneview.syslog.listGet syslog config records.read
  • threatdown_oneview.syslog.search_allSearch syslog configs by multiple accounts.read
  • threatdown_oneview.syslog_machines.assignAssign syslog config machines.write
  • threatdown_oneview.syslog.getGet syslog config record by id.read
  • threatdown_oneview.syslog.updateUpdate syslog config.write
  • and 1 more in this area
Vulnerability management7
  • threatdown_oneview.cve.exportExport CVEread
  • threatdown_oneview.cve.export_asyncExport CVE asynchronouslywrite
  • threatdown_oneview.cve.get_bulkGet CVE detailsread
  • threatdown_oneview.cve.ignoreIgnore CVEswrite
  • threatdown_oneview.cve.getGet CVE details by idread
  • threatdown_oneview.cve.searchSearch CVEread
  • and 1 more in this area
Ignore rules6
  • threatdown_oneview.assets_ignore_rules.createCreate asset ignore rulewrite
  • threatdown_oneview.assets_ignore_rules.getGet asset ignore ruleread
  • threatdown_oneview.assets_ignore_rules.listList asset ignore rulesread
  • threatdown_oneview.assets_ignore_rules.updateUpdate asset ignore rulewrite
  • threatdown_oneview.assets_ignore_rules.deleteDelete asset ignore ruledestructive
  • threatdown_oneview.assets_ignore_rules.delete_bulkDelete asset ignore rules in bulkdestructive
Suspicious activity6
  • threatdown_oneview.sa.closeClose suspicious activities in bulkwrite
  • threatdown_oneview.sa.detailsSuspicious activity detailsread
  • threatdown_oneview.sa.listSuspicious activity of the accountread
  • threatdown_oneview.sa.openReopen suspicious activities in bulkwrite
  • threatdown_oneview.sa.remediateRemediate suspicious activities in bulkwrite
  • threatdown_oneview.sa_process_graph.getSuspicious activity process graphread
Usage6
  • threatdown_oneview.usage.histogramSearch usage histogramread
  • threatdown_oneview.usage_changelogs.searchGet entitlement history for an endpointread
  • threatdown_oneview.usage_logs.searchSearch logs of usageread
  • threatdown_oneview.usage_logs.summarySearch summary of usageread
  • threatdown_oneview.usage_logs_summary.exportExport usage dataread
  • threatdown_oneview.usage_two_tier_logs_summary.exportTwo tier usage summary exportread
Users6
  • threatdown_oneview.users.createCreate new userwrite
  • threatdown_oneview.users.getGet user by IDread
  • threatdown_oneview.users.listGet all usersread
  • threatdown_oneview.users.updateUpdate userwrite
  • threatdown_oneview.users.deleteDelete userdestructive
  • threatdown_oneview.users.resend_inviteResend user invitewrite
Detections5
  • threatdown_oneview.detections.exportExport detectionsread
  • threatdown_oneview.detections.export_asyncExport detections asynchronouslywrite
  • threatdown_oneview.detections.searchSearch detections across accountsread
  • threatdown_oneview.detections.submit_fpSubmit false positivewrite
  • threatdown_oneview.detections.getGet detection by IDread
Exclusions5
  • threatdown_oneview.exclusions.createCreate exclusionwrite
  • threatdown_oneview.exclusions.getGet one exclusionsread
  • threatdown_oneview.exclusions.listGet all exclusionsread
  • threatdown_oneview.exclusions.updateUpdate one exclusionswrite
  • threatdown_oneview.exclusions.deleteDelete exclusiondestructive
Vulnerability assessment5
  • threatdown_oneview.vulnerability_assessment.detailsGet vulnerability assessment detailsread
  • threatdown_oneview.vulnerability_assessment.summaryGet vulnerability assessment summaryread
  • threatdown_oneview.vulnerability_assessment_cve_stats.searchGet vulnerability assessment CVE statisticsread
  • threatdown_oneview.vulnerability_assessment_report.searchGet vulnerability assessment reportread
  • threatdown_oneview.vulnerability_assessment_software_stats.searchGet vulnerability assessment software statisticsread
Webhooks5
  • threatdown_oneview.webhooks_subscriptions.createCreate webhook subscriptionwrite
  • threatdown_oneview.webhooks_subscriptions.getGet webhook subscriptionread
  • threatdown_oneview.webhooks_subscriptions.listGet all webhook subscriptionsread
  • threatdown_oneview.webhooks_subscriptions.updateUpdate a subscriptionwrite
  • threatdown_oneview.webhooks_subscriptions.deleteDelete webhook subscriptiondestructive
Assets4
  • threatdown_oneview.assets_software.exportExport assets softwareread
  • threatdown_oneview.assets_software.export_asyncExport assets software asynchronouslywrite
  • threatdown_oneview.assets_software.searchSearch assets softwareread
  • threatdown_oneview.assets_software.search_groupbySearch assets software groupByread
DNS4
  • threatdown_oneview.dns.exportExport DNS dataread
  • threatdown_oneview.dns.export_asyncExport DNS Logs asynchronouslywrite
  • threatdown_oneview.dns.searchSearch DNS Logsread
  • threatdown_oneview.dns.search_groupbySearch DNS Logs groupByread
Installation tokens4
  • threatdown_oneview.installation_token.createGenerate an installation tokenwrite
  • threatdown_oneview.installation_token.deleteRevoke installation tokendestructive
  • threatdown_oneview.installation_token.search_allGet installation tokens across multiple accountsread
  • threatdown_oneview.installation_token.sendSend installation tokenswrite
OS patches4
  • threatdown_oneview.os_patches.exportExport OS Patchesread
  • threatdown_oneview.os_patches.export_asyncExport OS Patches asynchronouslywrite
  • threatdown_oneview.os_patches.searchSearch OS Patchesread
  • threatdown_oneview.os_patches.search_groupbySearch OS Patches groupByread
Preferences4
  • threatdown_oneview.preferences_account_logo.getGet account logo preferencesread
  • threatdown_oneview.preferences_account_logo.updatePut account logo preferenceswrite
  • threatdown_oneview.preferences_notifications.getGet notifications preferencesread
  • threatdown_oneview.preferences_notifications.updatePut notifications preferenceswrite
Remote intrusion detection4
  • threatdown_oneview.rid_rules.exportExport RID rulesread
  • threatdown_oneview.rid_rules.export_asyncExport RID rules asynchronouslywrite
  • threatdown_oneview.rid_rules.searchSearch RID rulesread
  • threatdown_oneview.rid_rules.search_groupbySearch grouped RIDread
Quarantine3
  • threatdown_oneview.quarantine.exportExport quarantineread
  • threatdown_oneview.quarantine.listGet all quarantineread
  • threatdown_oneview.quarantine.searchSearch quarantineread
MDR2
  • threatdown_oneview.sites_mdr.createSet site MDR settingswrite
  • threatdown_oneview.sites_mdr.getGet site MDR settingsread
Events1
  • threatdown_oneview.events.listRetrieve eventsread
Info1
  • threatdown_oneview.account.getAccount inforead
Installers1
  • threatdown_oneview.installers.getRetrieve installers's linksread

This index shows a sample of each area. All 418 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The ThreatDown OneView MCP server, answered.

Is there a ThreatDown OneView MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 418 ThreatDown OneView actions across grid, email protection, endpoints and firewall management, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ThreatDown OneView.

What do I need to connect ThreatDown OneView?

ThreatDown OneView client ID: in the OneView console go to Settings > API Integrations and add an OAuth2 application… and ThreatDown OneView client secret (shown once when the application is created). Plus your scopes. The free call account { op: "connections.requirements", service: "threatdown_oneview" } lists exactly what to paste.

Can an AI agent delete or change things in ThreatDown OneView?

Only if its key allows it, and only with an explicit confirmation. 42 ThreatDown OneView actions are destructive, including delete site, delete user and delete an endpoint. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my ThreatDown OneView API limit?

actionlake paces every call to the limits in the ThreatDown OneView service file: 360 calls a minute per connection. Repeated reads are answered from cache (231 ThreatDown OneView actions can be), which never reaches ThreatDown OneView.

What does a ThreatDown OneView action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (418 ThreatDown OneView actions page). Cache hits, searches, dry runs and calls ThreatDown OneView refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which ThreatDown OneView API does it cover?

The ThreatDown (Malwarebytes) OneView (MSP console: sites, subscriptions, usage, cross-site endpoints, detections, jobs, policies) API ThreatDown OneView APIs 1.0.0 (OpenAPI 3.0, 419 operations) at api.threatdown.com. It is built from ThreatDown OneView's documentation as read on 23 October 2026. 418 actions in 40 areas, each one in the signed service file (version 1.0.0).

Can I combine ThreatDown OneView with my other systems?

Yes. ask joins ThreatDown OneView to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. ThreatDown OneView maps crm.company, which 227 other connectors also map.

Does actionlake keep my ThreatDown OneView data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ThreatDown OneView credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like ThreatDown OneView

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by ThreatDown OneView; the name is the vendor's own. Counts are from the ThreatDown OneView service file, version 1.0.0.

Give your agent ThreatDown OneView today.

Connect ThreatDown OneView freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.