---
title: "ThreatDown OneView MCP server for AI agents - actionlake"
description: "Give Claude 418 ThreatDown OneView actions through one MCP server: grid, email protection. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/threatdown-oneview
updated: 2026-10-23
---

Connectors · MSP & PSA

# ThreatDown OneView MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to ThreatDown OneView and the rest of your systems. It gives your agent 418 ThreatDown OneView actions (242 reads, 134 writes and 42 that wait for a confirmation) and holds the ThreatDown OneView credential itself, so the agent never does. It paces ThreatDown OneView's limits and records every call.

[Connect ThreatDown OneView free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "threatdown_oneview.sites.list",
  intent: "check which ThreatDown OneView account is connected"
}
# Get all sites · read · 1 upstream call
```

- 418 actions in one signed file
- 242 read look, never change
- 134 write create and update
- 42 wait for a yes destructive, confirmed first

Set up

## Connect ThreatDown OneView in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect ThreatDown OneView.
   OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `client_id` ThreatDown OneView client ID: in the OneView console go to Settings > API Integrations and add an OAuth2 application…
   - `client_secret` ThreatDown OneView client secret (shown once when the application is created)
   - `scopes` Your ThreatDown OneView scopes
   ```
   account { op: "connections.requirements", service: "threatdown_oneview" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "threatdown_oneview.sites.list" }
   # get all sites · read · 1 upstream call
   check { action: "threatdown_oneview.sites.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

ThreatDown OneView at a glance

**Sign-in**

OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.

**You provide**

`client_id` `client_secret`

**Setup fields**

`scopes`

**Limits we pace to**

360 calls a minute, per connection

**API covered**

ThreatDown (Malwarebytes) OneView (MSP console: sites, subscriptions, usage, cross-site endpoints, detections, jobs, policies) API ThreatDown OneView APIs 1.0.0 (OpenAPI 3.0, 419 operations)`api.threatdown.com`

**Built from**

ThreatDown OneView's documentation, read 23 October 2026[cloud.malwarebytes.com](https://cloud.malwarebytes.com/api/v2/oneview/docs) [api.malwarebytes.com](https://api.malwarebytes.com/oneview/v1/docs)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

231 of 242 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

4, so ask can line ThreatDown OneView up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in ThreatDown OneView.

418 actions in 40 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **242** read look, never change
- **134** write create and update
- **42** destructive wait for a confirmation

1. ### Grid
   57
   42 read · 14 write · 1 destructive
   Export action logs · Export action logs asynchronously · Search action logs · Search grouped action logs
2. ### Email protection
   53
   31 read · 16 write · 6 destructive
   Search emails · Search incidents · Migrate Email Protection · Migration Eligibility
3. ### Endpoints
   23
   16 read · 5 write · 2 destructive
   Search endpoints across accounts · Get endpoint · Delete an endpoint · Export endpoints (Bulk across accounts)
4. ### Firewall management
   22
   7 read · 9 write · 6 destructive
   Create a new firewall policy · Get firewall policies · Get firewall policy history · Create a new firewall rule
5. ### Content filtering
   18
   11 read · 6 write · 1 destructive
   Create content filtering rule · Get a list of content filtering rules · Search DNS blockPages for accounts · Get list of categories
6. ### Jobs
   18
   10 read · 5 write · 3 destructive
   Export jobs · Issue a job · Bulk issue jobs across accounts · Issue quarantine jobs in bulk
7. ### Policies V2
   18
   7 read · 8 write · 3 destructive
   Clone policy · Create policy · Get all policies · Get policies of multiple accounts
8. ### Subscriptions
   18
   10 read · 7 write · 1 destructive
   Create subscription · Get all subscriptions · Get entitlements · Get usage

**32 more areas · 191 actions**

- App block **13**
- Device control **13**
- Case management **12**
- Notifications **10**
- Policies **10**
- Reports **8**
- AI detection response **7**
- Flight recorder **7**
- Groups **7**
- Schedules **7**
- Sites **7**
- Syslog **7**
- Vulnerability management **7**
- Ignore rules **6**
- Suspicious activity **6**
- Usage **6**
- Users **6**
- Detections **5**
- Exclusions **5**
- Vulnerability assessment **5**
- Webhooks **5**
- Assets **4**
- DNS **4**
- Installation tokens **4**
- OS patches **4**
- Preferences **4**
- Remote intrusion detection **4**
- Quarantine **3**
- MDR **2**
- Events **1**
- Info **1**
- Installers **1**

Top actions

## The ThreatDown OneView API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 13 of ThreatDown OneView's 13 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `threatdown_oneview.sites.list` Get all sites | Get all sites. | read | `crm.company.list` 162 connectors |
| `threatdown_oneview.users.list` Get all users | Get all users. | read | `identity.user.list` 474 connectors |
| `threatdown_oneview.sites.create` Create new site | Create new site. | write | `crm.company.create` 142 connectors |
| `threatdown_oneview.users.create` Create new user | Create new user. | write | `identity.user.create` 262 connectors |
| `threatdown_oneview.sites.delete` Delete site | Delete site. | destructive | `crm.company.delete` 119 connectors |
| `threatdown_oneview.endpoints.search_all` Search endpoints across accounts | Search endpoints across accounts. | read | `device.endpoint.search` 8 connectors |
| `threatdown_oneview.endpoints.get` Get endpoint | Get endpoint. | read | `device.endpoint.get` 57 connectors |
| `threatdown_oneview.policies.list` Get all policies | Get all policies. | read | this connector |
| `threatdown_oneview.sa.list` Suspicious activity of the account | Suspicious activity of the account. | read | this connector |
| `threatdown_oneview.sa.open` Reopen suspicious activities in bulk | Reopen suspicious activities in bulk. | write | this connector |
| `threatdown_oneview.cve.export` Export CVE | Export CVE. | read | this connector |
| `threatdown_oneview.cve.ignore` Ignore CVEs | Ignore CVEs. | write | this connector |

Try it

## Prompts to paste into Claude.

Each one names the ThreatDown OneView actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which ThreatDown OneView devices have not checked in for a week?
   calls `threatdown_oneview.endpoints.search_all`
2. Write write
   Create new site in ThreatDown OneView. Show me exactly what you will send before you save it.
   calls `threatdown_oneview.sites.create`
3. Across systems read
   Which ThreatDown OneView companies have invoices in NetSuite, and how many each?
   calls `threatdown_oneview.sites.list` `netsuite.views.invoices`

Across your systems

## ThreatDown OneView, joined to the rest of your business.

One `ask` fetches from ThreatDown OneView and another system, joins the rows on the same customer on our side, and hands your agent the answer, not every row.

- Which ThreatDown OneView companies have invoices in NetSuite, and how many each?
  `threatdown_oneview.sites.list` + `netsuite.views.invoices`, on `crm.company` · [NetSuite](https://actionlake.com/connectors/netsuite)
- Which ThreatDown OneView companies have tickets in HubSpot CRM, and how many each?
  `threatdown_oneview.sites.list` + `hubspot_crm.tickets.list`, on `crm.company` · [HubSpot CRM](https://actionlake.com/connectors/hubspot-crm)

Also mapped by other connectors `identity.user` **517** `crm.company` **227** `device.endpoint` **69** `security.policy` **28**

ask

```
ask {
  intent: "which ThreatDown OneView companies have invoices in NetSuite, and how many each",
  steps: [
    { action: "threatdown_oneview.sites.list", as: "co", input: {}, limit: 100, max_pages: 5 },
    { action: "netsuite.views.invoices", as: "inv", input: {}, limit: 100, max_pages: 5 },
    { join: {
        left: "co",
        right: "inv",
        on: "crm.company",
        group_by: "co.name",
        select: ["co.name", "count(inv.id) as invoices"]
    } }
  ]
}
```

Example. Run it through check first: it validates the steps and prices them, and it is free.

Governance for ThreatDown OneView

## Destructive actions wait for a yes.

42 ThreatDown OneView actions are destructive. The first 10:

- Delete site `threatdown_oneview.sites.delete`
- Delete user `threatdown_oneview.users.delete`
- Delete an endpoint `threatdown_oneview.endpoints.delete`
- Delete group by its id `threatdown_oneview.groups.delete`
- Delete report by id `threatdown_oneview.reports.delete`
- Delete policy `threatdown_oneview.policies.delete`
- Cancel pending jobs across accounts `threatdown_oneview.jobs.delete_bulk`
- Delete a schedule `threatdown_oneview.schedules.delete`
- Delete AI Detection & Response rule `threatdown_oneview.aidr_rules.delete`
- Delete exclusion `threatdown_oneview.exclusions.delete`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do threatdown_oneview.sites.delete confirm_policy: **human**

Delete site?

**intent:** the user asked me to delete site

run suspended · waiting for a named person · key _threatdown-oneview-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "threatdown-oneview-agent",
  allowed_actions: ["threatdown_oneview.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "threatdown_oneview.sites.delete", approver: "lead@example.com" },
    { match: "threatdown_oneview.users.delete", approver: "lead@example.com" },
    { match: "threatdown_oneview.endpoints.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to ThreatDown OneView only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What ThreatDown OneView costs on actionlake.

Every ThreatDown OneView action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call ThreatDown OneView refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 418 ThreatDown OneView actions
- 418 actions page each page of a long list is one call
- 231 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every ThreatDown OneView action.

418 actions by area: the id your agent calls, what it does, and its effect.

**Grid 57**

- `threatdown_oneview.grid_action_logs.export` Export action logs read
- `threatdown_oneview.grid_action_logs.export_async` Export action logs asynchronously write
- `threatdown_oneview.grid_action_logs.search` Search action logs read
- `threatdown_oneview.grid_action_logs.search_groupby` Search grouped action logs read
- `threatdown_oneview.grid_ai_domains.export` Export AI domain activity across accounts read
- `threatdown_oneview.grid_ai_domains.export_async` Export AI domain activity across accounts asynchronously write
- and 51 more in this area

**Email protection 53**

- `threatdown_oneview.email_protection.emails` Search emails read
- `threatdown_oneview.email_protection.incidents` Search incidents read
- `threatdown_oneview.email_protection.migrate` Migrate Email Protection write
- `threatdown_oneview.email_protection.migration_eligibility` Migration Eligibility read
- `threatdown_oneview.email_protection.disable` Disable email protection account destructive
- `threatdown_oneview.email_protection.register` Register email protection account write
- and 47 more in this area

**Endpoints 23**

- `threatdown_oneview.endpoints.delete` Delete an endpoint destructive
- `threatdown_oneview.endpoints.export` Export endpoints (Bulk across accounts) read
- `threatdown_oneview.endpoints.get` Get endpoint read
- `threatdown_oneview.endpoints.search_all` Search endpoints across accounts read
- `threatdown_oneview.endpoints.delete_bulk` Delete multiple endpoints across accounts destructive
- `threatdown_oneview.endpoints.export_async` Export endpoints asynchronously write
- and 17 more in this area

**Firewall management 22**

- `threatdown_oneview.firewall_policies.create` Create a new firewall policy write
- `threatdown_oneview.firewall_policies.list` Get firewall policies read
- `threatdown_oneview.firewall_policies_history.list` Get firewall policy history read
- `threatdown_oneview.firewall_rules.create` Create a new firewall rule write
- `threatdown_oneview.firewall_policies.delete` Delete a firewall policy destructive
- `threatdown_oneview.firewall_policies.get` Get a firewall policy read
- and 16 more in this area

**Content filtering 18**

- `threatdown_oneview.content_filtering.create` Create content filtering rule write
- `threatdown_oneview.content_filtering.search_all` Get a list of content filtering rules read
- `threatdown_oneview.content_filtering_blockpage.search_all` Search DNS blockPages for accounts read
- `threatdown_oneview.content_filtering_categories.list` Get list of categories read
- `threatdown_oneview.content_filtering.delete` Delete content filtering rule destructive
- `threatdown_oneview.content_filtering.enable` Enable/Disable content filtering rule write
- and 12 more in this area

**Jobs 18**

- `threatdown_oneview.jobs.export` Export jobs read
- `threatdown_oneview.jobs.issue` Issue a job write
- `threatdown_oneview.jobs.issue_bulk` Bulk issue jobs across accounts write
- `threatdown_oneview.jobs.issue_quarantine_bulk` Issue quarantine jobs in bulk write
- `threatdown_oneview.jobs.delete_bulk` Cancel pending jobs across accounts destructive
- `threatdown_oneview.jobs.get` Get details about a job read
- and 12 more in this area

**Policies V2 18**

- `threatdown_oneview.v2_policies.clone` Clone policy write
- `threatdown_oneview.v2_policies.create` Create policy write
- `threatdown_oneview.v2_policies.list` Get all policies read
- `threatdown_oneview.v2_policies.search_all` Get policies of multiple accounts read
- `threatdown_oneview.v2_policies.delete` Delete policy destructive
- `threatdown_oneview.v2_policies.get` Get policy by id read
- and 12 more in this area

**Subscriptions 18**

- `threatdown_oneview.sites_subscriptions.create` Create subscription write
- `threatdown_oneview.sites_subscriptions_all.list` Get all subscriptions read
- `threatdown_oneview.subscriptions.list` Get entitlements read
- `threatdown_oneview.subscriptions_quantity.list` Get usage read
- `threatdown_oneview.sites_subscriptions.delete` Delete a subscription destructive
- `threatdown_oneview.sites_subscriptions.get` Get subscription read
- and 12 more in this area

**App block 13**

- `threatdown_oneview.app_block_activity.export` Export app block activity read
- `threatdown_oneview.app_block_activity.export_async` Export app block activity asynchronously write
- `threatdown_oneview.app_block_activity.search` Search app block activity read
- `threatdown_oneview.app_block_activity.search_groupby` Search app block activity groupby read
- `threatdown_oneview.app_block_rules.create` Create App Block Rule write
- `threatdown_oneview.app_block_rules.delete` Delete App Block Rule destructive
- and 7 more in this area

**Device control 13**

- `threatdown_oneview.devicecontrol.export` Export device control events read
- `threatdown_oneview.devicecontrol.export_async` Export device control events asynchronously write
- `threatdown_oneview.devicecontrol.search` Search device control events across accounts read
- `threatdown_oneview.devicecontrol.search_groupby` Group device control events across accounts read
- `threatdown_oneview.devicecontrol.get` Get detection control event by ID read
- `threatdown_oneview.devicecontrol_exclusions.create` Create a device exclusion write
- and 7 more in this area

**Case management 12**

- `threatdown_oneview.casemgmt_cases.action` Perform an action on cases write
- `threatdown_oneview.casemgmt_cases.requests` Post Cases Requests write
- `threatdown_oneview.casemgmt_cases.search` Search Cases read
- `threatdown_oneview.casemgmt_cases_comments.create` Post cases comments write
- `threatdown_oneview.casemgmt_cases.favorite` Put Cases favorite write
- `threatdown_oneview.casemgmt_cases_comments.list` Get cases comments read
- and 6 more in this area

**Notifications 10**

- `threatdown_oneview.notifications_subscriptions.change_owner` Change notification owner write
- `threatdown_oneview.notifications_subscriptions.create` Create notification write
- `threatdown_oneview.notifications_subscriptions.get` Get notification read
- `threatdown_oneview.notifications_subscriptions.list` Get all notifications read
- `threatdown_oneview.notifications_subscriptions.delete` Delete notification destructive
- `threatdown_oneview.notifications_subscriptions.update` Update notification write
- and 4 more in this area

**Policies 10**

- `threatdown_oneview.policies.create` Create new policy write
- `threatdown_oneview.policies.default` Set default write
- `threatdown_oneview.policies.list` Get all policies read
- `threatdown_oneview.policies_secret.create` Set policy tamper protection password write
- `threatdown_oneview.policies.delete` Delete policy destructive
- `threatdown_oneview.policies.get` Get policy read
- and 4 more in this area

**Reports 8**

- `threatdown_oneview.reports.change_owner` Change reports owner write
- `threatdown_oneview.reports.create` Create report write
- `threatdown_oneview.reports.generate` Generate report write
- `threatdown_oneview.reports.list` Get all reports read
- `threatdown_oneview.reports.delete` Delete report by id destructive
- `threatdown_oneview.reports.delete_bulk` Delete reports bulk destructive
- and 2 more in this area

**AI detection response 7**

- `threatdown_oneview.aidr_metadata.list` Get AI Detection & Response metadata read
- `threatdown_oneview.aidr_rules.create` Create AI Detection & Response rule write
- `threatdown_oneview.aidr_rules.list` List AI Detection & Response rules read
- `threatdown_oneview.aidr_tools.search` Search AI tools read
- `threatdown_oneview.aidr_rules.delete` Delete AI Detection & Response rule destructive
- `threatdown_oneview.aidr_rules.get` Get AI Detection & Response rule read
- and 1 more in this area

**Flight recorder 7**

- `threatdown_oneview.flight_recorder.chart` Search occurrence of suspicious activity read
- `threatdown_oneview.flight_recorder.process_graph` Search the process graph read
- `threatdown_oneview.flight_recorder.processes` Search a list of processes read
- `threatdown_oneview.flight_recorder.raw_events` Search a list of raw events read
- `threatdown_oneview.flight_recorder.recap` Search suspicious activity read
- `threatdown_oneview.flight_recorder.search` Search the flight recorder with advanced queries read
- and 1 more in this area

**Groups 7**

- `threatdown_oneview.groups.assign_machines` Assign endpoints to a group across accounts write
- `threatdown_oneview.groups.create` Create group write
- `threatdown_oneview.groups.list` Get all groups read
- `threatdown_oneview.groups.search_all` Filter groups across accounts read
- `threatdown_oneview.groups.delete` Delete group by its id destructive
- `threatdown_oneview.groups.get` Get group by id read
- and 1 more in this area

**Schedules 7**

- `threatdown_oneview.schedules.create` Create schedule write
- `threatdown_oneview.schedules.get` Get schedule by id read
- `threatdown_oneview.schedules.list` Get schedules read
- `threatdown_oneview.schedules.search_all` Get schedules of multiple accounts read
- `threatdown_oneview.schedules.delete` Delete a schedule destructive
- `threatdown_oneview.schedules.groups` Add groups for schedule write
- and 1 more in this area

**Sites 7**

- `threatdown_oneview.sites.create` Create new site write
- `threatdown_oneview.sites.get` Get site by ID read
- `threatdown_oneview.sites.list` Get all sites read
- `threatdown_oneview.sites.update` Update site write
- `threatdown_oneview.sites.delete` Delete site destructive
- `threatdown_oneview.sites_nebula_accounts.get` Get site by nebula account ID read
- and 1 more in this area

**Syslog 7**

- `threatdown_oneview.syslog.create` Create new syslog config record. write
- `threatdown_oneview.syslog.list` Get syslog config records. read
- `threatdown_oneview.syslog.search_all` Search syslog configs by multiple accounts. read
- `threatdown_oneview.syslog_machines.assign` Assign syslog config machines. write
- `threatdown_oneview.syslog.get` Get syslog config record by id. read
- `threatdown_oneview.syslog.update` Update syslog config. write
- and 1 more in this area

**Vulnerability management 7**

- `threatdown_oneview.cve.export` Export CVE read
- `threatdown_oneview.cve.export_async` Export CVE asynchronously write
- `threatdown_oneview.cve.get_bulk` Get CVE details read
- `threatdown_oneview.cve.ignore` Ignore CVEs write
- `threatdown_oneview.cve.get` Get CVE details by id read
- `threatdown_oneview.cve.search` Search CVE read
- and 1 more in this area

**Ignore rules 6**

- `threatdown_oneview.assets_ignore_rules.create` Create asset ignore rule write
- `threatdown_oneview.assets_ignore_rules.get` Get asset ignore rule read
- `threatdown_oneview.assets_ignore_rules.list` List asset ignore rules read
- `threatdown_oneview.assets_ignore_rules.update` Update asset ignore rule write
- `threatdown_oneview.assets_ignore_rules.delete` Delete asset ignore rule destructive
- `threatdown_oneview.assets_ignore_rules.delete_bulk` Delete asset ignore rules in bulk destructive

**Suspicious activity 6**

- `threatdown_oneview.sa.close` Close suspicious activities in bulk write
- `threatdown_oneview.sa.details` Suspicious activity details read
- `threatdown_oneview.sa.list` Suspicious activity of the account read
- `threatdown_oneview.sa.open` Reopen suspicious activities in bulk write
- `threatdown_oneview.sa.remediate` Remediate suspicious activities in bulk write
- `threatdown_oneview.sa_process_graph.get` Suspicious activity process graph read

**Usage 6**

- `threatdown_oneview.usage.histogram` Search usage histogram read
- `threatdown_oneview.usage_changelogs.search` Get entitlement history for an endpoint read
- `threatdown_oneview.usage_logs.search` Search logs of usage read
- `threatdown_oneview.usage_logs.summary` Search summary of usage read
- `threatdown_oneview.usage_logs_summary.export` Export usage data read
- `threatdown_oneview.usage_two_tier_logs_summary.export` Two tier usage summary export read

**Users 6**

- `threatdown_oneview.users.create` Create new user write
- `threatdown_oneview.users.get` Get user by ID read
- `threatdown_oneview.users.list` Get all users read
- `threatdown_oneview.users.update` Update user write
- `threatdown_oneview.users.delete` Delete user destructive
- `threatdown_oneview.users.resend_invite` Resend user invite write

**Detections 5**

- `threatdown_oneview.detections.export` Export detections read
- `threatdown_oneview.detections.export_async` Export detections asynchronously write
- `threatdown_oneview.detections.search` Search detections across accounts read
- `threatdown_oneview.detections.submit_fp` Submit false positive write
- `threatdown_oneview.detections.get` Get detection by ID read

**Exclusions 5**

- `threatdown_oneview.exclusions.create` Create exclusion write
- `threatdown_oneview.exclusions.get` Get one exclusions read
- `threatdown_oneview.exclusions.list` Get all exclusions read
- `threatdown_oneview.exclusions.update` Update one exclusions write
- `threatdown_oneview.exclusions.delete` Delete exclusion destructive

**Vulnerability assessment 5**

- `threatdown_oneview.vulnerability_assessment.details` Get vulnerability assessment details read
- `threatdown_oneview.vulnerability_assessment.summary` Get vulnerability assessment summary read
- `threatdown_oneview.vulnerability_assessment_cve_stats.search` Get vulnerability assessment CVE statistics read
- `threatdown_oneview.vulnerability_assessment_report.search` Get vulnerability assessment report read
- `threatdown_oneview.vulnerability_assessment_software_stats.search` Get vulnerability assessment software statistics read

**Webhooks 5**

- `threatdown_oneview.webhooks_subscriptions.create` Create webhook subscription write
- `threatdown_oneview.webhooks_subscriptions.get` Get webhook subscription read
- `threatdown_oneview.webhooks_subscriptions.list` Get all webhook subscriptions read
- `threatdown_oneview.webhooks_subscriptions.update` Update a subscription write
- `threatdown_oneview.webhooks_subscriptions.delete` Delete webhook subscription destructive

**Assets 4**

- `threatdown_oneview.assets_software.export` Export assets software read
- `threatdown_oneview.assets_software.export_async` Export assets software asynchronously write
- `threatdown_oneview.assets_software.search` Search assets software read
- `threatdown_oneview.assets_software.search_groupby` Search assets software groupBy read

**DNS 4**

- `threatdown_oneview.dns.export` Export DNS data read
- `threatdown_oneview.dns.export_async` Export DNS Logs asynchronously write
- `threatdown_oneview.dns.search` Search DNS Logs read
- `threatdown_oneview.dns.search_groupby` Search DNS Logs groupBy read

**Installation tokens 4**

- `threatdown_oneview.installation_token.create` Generate an installation token write
- `threatdown_oneview.installation_token.delete` Revoke installation token destructive
- `threatdown_oneview.installation_token.search_all` Get installation tokens across multiple accounts read
- `threatdown_oneview.installation_token.send` Send installation tokens write

**OS patches 4**

- `threatdown_oneview.os_patches.export` Export OS Patches read
- `threatdown_oneview.os_patches.export_async` Export OS Patches asynchronously write
- `threatdown_oneview.os_patches.search` Search OS Patches read
- `threatdown_oneview.os_patches.search_groupby` Search OS Patches groupBy read

**Preferences 4**

- `threatdown_oneview.preferences_account_logo.get` Get account logo preferences read
- `threatdown_oneview.preferences_account_logo.update` Put account logo preferences write
- `threatdown_oneview.preferences_notifications.get` Get notifications preferences read
- `threatdown_oneview.preferences_notifications.update` Put notifications preferences write

**Remote intrusion detection 4**

- `threatdown_oneview.rid_rules.export` Export RID rules read
- `threatdown_oneview.rid_rules.export_async` Export RID rules asynchronously write
- `threatdown_oneview.rid_rules.search` Search RID rules read
- `threatdown_oneview.rid_rules.search_groupby` Search grouped RID read

**Quarantine 3**

- `threatdown_oneview.quarantine.export` Export quarantine read
- `threatdown_oneview.quarantine.list` Get all quarantine read
- `threatdown_oneview.quarantine.search` Search quarantine read

**MDR 2**

- `threatdown_oneview.sites_mdr.create` Set site MDR settings write
- `threatdown_oneview.sites_mdr.get` Get site MDR settings read

**Events 1**

- `threatdown_oneview.events.list` Retrieve events read

**Info 1**

- `threatdown_oneview.account.get` Account info read

**Installers 1**

- `threatdown_oneview.installers.get` Retrieve installers's links read

This index shows a sample of each area. All 418 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The ThreatDown OneView MCP server, answered.

**Is there a ThreatDown OneView MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 418 ThreatDown OneView actions across grid, email protection, endpoints and firewall management, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by ThreatDown OneView.

**What do I need to connect ThreatDown OneView?**

ThreatDown OneView client ID: in the OneView console go to Settings > API Integrations and add an OAuth2 application… and ThreatDown OneView client secret (shown once when the application is created). Plus your scopes. The free call account { op: "connections.requirements", service: "threatdown_oneview" } lists exactly what to paste.

**Can an AI agent delete or change things in ThreatDown OneView?**

Only if its key allows it, and only with an explicit confirmation. 42 ThreatDown OneView actions are destructive, including delete site, delete user and delete an endpoint. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my ThreatDown OneView API limit?**

actionlake paces every call to the limits in the ThreatDown OneView service file: 360 calls a minute per connection. Repeated reads are answered from cache (231 ThreatDown OneView actions can be), which never reaches ThreatDown OneView.

**What does a ThreatDown OneView action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (418 ThreatDown OneView actions page). Cache hits, searches, dry runs and calls ThreatDown OneView refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which ThreatDown OneView API does it cover?**

The ThreatDown (Malwarebytes) OneView (MSP console: sites, subscriptions, usage, cross-site endpoints, detections, jobs, policies) API ThreatDown OneView APIs 1.0.0 (OpenAPI 3.0, 419 operations) at api.threatdown.com. It is built from ThreatDown OneView's documentation as read on 23 October 2026. 418 actions in 40 areas, each one in the signed service file (version 1.0.0).

**Can I combine ThreatDown OneView with my other systems?**

Yes. ask joins ThreatDown OneView to NetSuite or HubSpot CRM on the same customer and returns the answer rather than every row. ThreatDown OneView maps crm.company, which 227 other connectors also map.

**Does actionlake keep my ThreatDown OneView data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your ThreatDown OneView credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like ThreatDown OneView

Shares the most action names with

- [Acronis Cyber Protect Cloud 12](https://actionlake.com/connectors/acronis-cyber-protect-cloud)
- [MSP360 Managed Backup 11](https://actionlake.com/connectors/msp360-managed-backup)
- [Veeam Service Provider Console 11](https://actionlake.com/connectors/veeam-service-provider-console)
- [Proofpoint Essentials 10](https://actionlake.com/connectors/proofpoint-essentials)
- [TP-Link Omada Open API 10](https://actionlake.com/connectors/tp-link-omada-open-api)
- [ThreatDown Nebula 8](https://actionlake.com/connectors/threatdown-nebula)

Joins with, on shared entities

- [VMware Carbon Black Cloud 3](https://actionlake.com/connectors/vmware-carbon-black-cloud)
- [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users)
- [Salesforce Sales Cloud 2](https://actionlake.com/connectors/salesforce-sales-cloud)
- [Xero 2](https://actionlake.com/connectors/xero)
- [ServiceNow 2](https://actionlake.com/connectors/servicenow)
- [Genesys Cloud CX 2](https://actionlake.com/connectors/genesys-cloud-cx)

Browse

- [All MSP & PSA connectors](https://actionlake.com/connectors/category/msp-and-psa)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by ThreatDown OneView; the name is the vendor's own. Counts are from the ThreatDown OneView service file, version 1.0.0.

## Give your agent ThreatDown OneView today.

[Connect ThreatDown OneView free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/threatdown-oneview
More: https://actionlake.com/llms.txt