Skip to content
actionlake
Start free

Connectors · Identity & security

VMware Carbon Black Cloud MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to VMware Carbon Black Cloud and the rest of your systems. It gives your agent 390 VMware Carbon Black Cloud actions (221 reads, 115 writes and 54 that wait for a confirmation) and holds the VMware Carbon Black Cloud credential itself, so the agent never does. It paces VMware Carbon Black Cloud's limits and records every call.

Connect VMware Carbon Black Cloud freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "carbon_black_cloud.users.list_all_users",  intent: "check which VMware Carbon Black Cloud account is connected"}# List All Users · read · 1 upstream call
  • 390actionsin one signed file
  • 221readlook, never change
  • 115writecreate and update
  • 54wait for a yesdestructive, confirmed first

Set up

Connect VMware Carbon Black Cloud in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect VMware Carbon Black Cloud.

    API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • api_idCarbon Black Cloud API ID
    • api_secret_keyCarbon Black Cloud API Secret Key for the same API ID (API Credentials on the key's row)
    • hostWhere your VMware Carbon Black Cloud lives: your host
    • org_keyYour VMware Carbon Black Cloud org key
    account { op: "connections.requirements", service: "carbon_black_cloud" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "carbon_black_cloud.users.list_all_users" }# list all users · read · 1 upstream callcheck { action: "carbon_black_cloud.users.create_user", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

VMware Carbon Black Cloud at a glance

Sign-in
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
api_idapi_secret_key
Setup fields
hostorg_key
Limits we pace to
100 calls a second, per connection
API covered
VMware Carbon Black Cloud (Broadcom) platform, Endpoint Standard, Enterprise EDR, Audit and Remediation, Workload and Container APIs API Carbon Black Cloud REST APIs (Alerts v7, Devices v6, Policy Service v1, Investigate v2, Watchlist Manager v3, Feed Manager v2, Live Query v1, Asset Groups v1, Vulnerability Assessment v1, CIS Benchmarks v1, Containers v1/v1beta), at your VMware Carbon Black Cloud instance's API base URL, which you enter when connecting
Built from
VMware Carbon Black Cloud's documentation, read 23 October 2026documenter.getpostman.comdeveloper.carbonblack.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
221 of 221 reads, for up to 5 minutes; a write clears what it affects
Shared entities
3, so ask can line VMware Carbon Black Cloud up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in VMware Carbon Black Cloud.

390 actions in 71 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 221readlook, never change
  • 115writecreate and update
  • 54destructivewait for a confirmation

  1. Watchlists

    35

    13 read · 11 write · 11 destructive

    Bulk Get Report Ignore Status · Create New Report · Create New Watchlist · Get All Watchlists

  2. Cloud accounts

    17

    7 read · 6 write · 4 destructive

    Add SSM Document · Create Provision Template · Facet Cloud Accounts · Get External ID for AWS Account

  3. Feeds

    15

    7 read · 6 write · 2 destructive

    Convert Legacy Query · Create a New Private Feed · Create a New Reserved Feed · Get all Feeds

  4. Data forwarders

    14

    8 read · 4 write · 2 destructive

    Create Filter on Forwarder · Create Forwarder · Filterable Event Schema · Forwarder Healthcheck

  5. Processes

    12

    7 read · 4 write · 1 destructive

    Get Time Limits for Available Data (v1) · Process Search Suggestions (v2) · Process Search Validation (v2) · Retrieve Results for a Process Detail Search (v2)

  6. Live query

    11

    8 read · 1 write · 2 destructive

    Get Device Summary Facets · Get Device Summary From Results · Get Facets From Live Query Results · Get Live Query Recommendations

  7. Live response

    11

    5 read · 2 write · 4 destructive

    Get All Files Metadata · Get Commands List · Start Session · Disable Live Response

  8. Asset groups

    10

    6 read · 3 write · 1 destructive

    Create Asset Group · Export Asset Groups · Get All Asset Groups · Get Asset Group Stats

63 more areas · 265 actions
  • Cis benchmark sets 10
  • Vulnerabilities 10
  • Grants 9
  • Alerts 8
  • Container setup 8
  • Device vulnerabilities 8
  • Enriched events 8
  • Cis compliance 7
  • Sensor updates 7
  • Auth events 6
  • Container scopes 6
  • Data collection 6
  • Host based firewall 6
  • Reputation overrides 6
  • Threats 6
  • Usb approvals 6
  • Binaries 5
  • Compute resources 5
  • Container overview 5
  • Container vulnerabilities 5
  • Devices 5
  • Live query templates 5
  • Observations 5
  • Policies 5
  • Usb blocks 5
  • Usb devices 5
  • Users 5
  • Appliances 4
  • Cis bundles 4
  • Container policies 4
  • Container templates 4
  • Cve 4
  • Jobs 4
  • Policy rules 4
  • Alert notes 3
  • Asset group members 3
  • Asset group queries 3
  • Audit logs 3
  • Bypass rules 3
  • Container inventory 3
  • Container scan logs 3
  • Core prevention 3
  • Feed search 3
  • Grouped alerts 3
  • Policy rule configs 3
  • Process events 3
  • Threat tags 3
  • Alert workflow 2
  • Auth event details 2
  • Auth event facets 2
  • Cis devices 2
  • Cis settings 2
  • Container rules 2
  • Observation details 2
  • Observation facets 2
  • Process watchlist 2
  • Recommendations 2
  • Differential analysis 1
  • Scripts 1
  • Sensor lifecycle 1
  • Threat hunts 1
  • Threat metadata 1
  • Usb products 1

Top actions

The VMware Carbon Black Cloud API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 13 of VMware Carbon Black Cloud's 13 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
carbon_black_cloud.users.list_all_usersList All UsersList All Users.readidentity.user.list474 connectors
carbon_black_cloud.policies.get_policy_summaryGet Policy SummaryGet Policy Summary.readsecurity.policy.list36 connectors
carbon_black_cloud.users.create_userCreate UserCreate User.writeidentity.user.create262 connectors
carbon_black_cloud.policies.create_policyCreate PolicyCreate Policy.writesecurity.policy.create25 connectors
carbon_black_cloud.users.delete_userDelete UserDelete User.destructiveidentity.user.delete253 connectors
carbon_black_cloud.devices.search_devicesSearch DevicesSearch Devices.readdevice.endpoint.search8 connectors
carbon_black_cloud.devices.specific_device_informationSpecific Device InformationSpecific Device Information.readdevice.endpoint.get57 connectors
carbon_black_cloud.alerts.get_alert_detailsGet Alert DetailsGet Alert Details.readsecurity.alert.get21 connectors
carbon_black_cloud.alerts.find_alerts_ungroupedFind alerts - UngroupedFind alerts - Ungrouped.readsecurity.alert.search6 connectors
carbon_black_cloud.feeds.get_reportsGet ReportsGet Reports.readthis connector
carbon_black_cloud.feeds.get_all_feedsGet all FeedsGet all Feeds.readthis connector
carbon_black_cloud.alerts.export_alertsExport AlertsExport Alerts.writethis connector

Try it

Prompts to paste into Claude.

Each one names the VMware Carbon Black Cloud actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which VMware Carbon Black Cloud devices have not checked in for a week?

    callscarbon_black_cloud.devices.search_devices

  2. Writewrite

    Create User in VMware Carbon Black Cloud. Show me exactly what you will send before you save it.

    callscarbon_black_cloud.users.create_user

Governance for VMware Carbon Black Cloud

Destructive actions wait for a yes.

54 VMware Carbon Black Cloud actions are destructive. The first 10:

  • Delete Usercarbon_black_cloud.users.delete_user
  • Delete Policycarbon_black_cloud.policies.delete_policy
  • Delete Feedcarbon_black_cloud.feeds.delete_feed
  • Delete reportcarbon_black_cloud.feeds.delete_report
  • Delete Profilecarbon_black_cloud.grants.delete_profile
  • Device Actionscarbon_black_cloud.devices.device_actions
  • Delete a Tagcarbon_black_cloud.threat_tags.delete_a_tag
  • Remove Reportcarbon_black_cloud.watchlists.remove_report
  • Delete a Notecarbon_black_cloud.alert_notes.delete_a_note
  • Delete Filecarbon_black_cloud.live_response.delete_file

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

docarbon_black_cloud.users.delete_userconfirm_policy: human

Delete User?

intent: the user asked me to delete User

run suspended · waiting for a named person · key carbon-black-cloud-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "carbon-black-cloud-agent",  allowed_actions: ["carbon_black_cloud.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "carbon_black_cloud.users.delete_user", approver: "[email protected]" },    { match: "carbon_black_cloud.policies.delete_policy", approver: "[email protected]" },    { match: "carbon_black_cloud.feeds.delete_feed", approver: "[email protected]" }  ]}
Illustrative. Scoped to VMware Carbon Black Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What VMware Carbon Black Cloud costs on actionlake.

Every VMware Carbon Black Cloud action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call VMware Carbon Black Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 390 VMware Carbon Black Cloud actions
  • 390actions pageeach page of a long list is one call
  • 221reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every VMware Carbon Black Cloud action.

390 actions by area: the id your agent calls, what it does, and its effect.

Watchlists35
  • carbon_black_cloud.watchlists.bulk_get_report_ignore_statusBulk Get Report Ignore Statusread
  • carbon_black_cloud.watchlists.create_new_reportCreate New Reportwrite
  • carbon_black_cloud.watchlists.create_new_watchlistCreate New Watchlistwrite
  • carbon_black_cloud.watchlists.get_all_watchlistsGet All Watchlistsread
  • carbon_black_cloud.watchlists.add_iocs_to_reportAdd IOCs to Reportwrite
  • carbon_black_cloud.watchlists.bulk_ignore_report_and_iocsBulk Ignore Report and IOCswrite
  • and 29 more in this area
Cloud accounts17
  • carbon_black_cloud.cloud_accounts.add_ssm_documentAdd SSM Documentwrite
  • carbon_black_cloud.cloud_accounts.create_provision_templateCreate Provision Templatewrite
  • carbon_black_cloud.cloud_accounts.facet_cloud_accountsFacet Cloud Accountsread
  • carbon_black_cloud.cloud_accounts.get_external_id_for_aws_accountGet External ID for AWS Accountread
  • carbon_black_cloud.cloud_accounts.bulk_delete_cloud_accountBulk Delete Cloud Accountdestructive
  • carbon_black_cloud.cloud_accounts.delete_cloud_accountDelete Cloud Accountdestructive
  • and 11 more in this area
Feeds15
  • carbon_black_cloud.feeds.convert_legacy_queryConvert Legacy Queryread
  • carbon_black_cloud.feeds.create_a_new_private_feedCreate a New Private Feedwrite
  • carbon_black_cloud.feeds.create_a_new_reserved_feedCreate a New Reserved Feedwrite
  • carbon_black_cloud.feeds.get_all_feedsGet all Feedsread
  • carbon_black_cloud.feeds.delete_feedDelete Feeddestructive
  • carbon_black_cloud.feeds.delete_reportDelete reportdestructive
  • and 9 more in this area
Data forwarders14
  • carbon_black_cloud.data_forwarders.create_filter_on_forwarderCreate Filter on Forwarderwrite
  • carbon_black_cloud.data_forwarders.create_forwarderCreate Forwarderwrite
  • carbon_black_cloud.data_forwarders.filterable_event_schemaFilterable Event Schemaread
  • carbon_black_cloud.data_forwarders.forwarder_healthcheckForwarder Healthcheckread
  • carbon_black_cloud.data_forwarders.delete_filter_on_forwarderDelete Filter on Forwarderdestructive
  • carbon_black_cloud.data_forwarders.delete_forwarderDelete Forwarderdestructive
  • and 8 more in this area
Processes12
  • carbon_black_cloud.processes.get_time_limits_for_available_data_v1Get Time Limits for Available Data (v1)read
  • carbon_black_cloud.processes.process_search_suggestions_v2Process Search Suggestions (v2)read
  • carbon_black_cloud.processes.process_search_validation_v2Process Search Validation (v2)read
  • carbon_black_cloud.processes.retrieve_results_for_a_process_detail_search_v2Retrieve Results for a Process Detail Search (v2)read
  • carbon_black_cloud.processes.cancel_a_process_search_v1Cancel a Process Search (v1)destructive
  • carbon_black_cloud.processes.retrieve_results_for_a_process_facets_search_v2Retrieve Results for a Process Facets Search (v2)read
  • and 6 more in this area
Live query11
  • carbon_black_cloud.live_query.get_device_summary_facetsGet Device Summary Facetsread
  • carbon_black_cloud.live_query.get_device_summary_from_resultsGet Device Summary From Resultsread
  • carbon_black_cloud.live_query.get_facets_from_live_query_resultsGet Facets From Live Query Resultsread
  • carbon_black_cloud.live_query.get_live_query_recommendationsGet Live Query Recommendationsread
  • carbon_black_cloud.live_query.delete_query_runDelete Query Rundestructive
  • carbon_black_cloud.live_query.get_query_detailsGet Query Detailsread
  • and 5 more in this area
Live response11
  • carbon_black_cloud.live_response.disable_live_responseDisable Live Responsewrite
  • carbon_black_cloud.live_response.get_all_files_metadataGet All Files Metadataread
  • carbon_black_cloud.live_response.get_commands_listGet Commands Listread
  • carbon_black_cloud.live_response.start_sessionStart Sessionwrite
  • carbon_black_cloud.live_response.cancel_commandRetrieve Command Copydestructive
  • carbon_black_cloud.live_response.close_sessionClose Sessiondestructive
  • and 5 more in this area
Asset groups10
  • carbon_black_cloud.asset_groups.create_asset_groupCreate Asset Groupwrite
  • carbon_black_cloud.asset_groups.export_asset_groupsExport Asset Groupswrite
  • carbon_black_cloud.asset_groups.get_all_asset_groupsGet All Asset Groupsread
  • carbon_black_cloud.asset_groups.get_asset_group_statsGet Asset Group Statsread
  • carbon_black_cloud.asset_groups.delete_asset_groupDelete Asset Groupdestructive
  • carbon_black_cloud.asset_groups.get_asset_group_by_idGet Asset Group by IDread
  • and 4 more in this area
Cis benchmark sets10
  • carbon_black_cloud.cis_benchmark_sets.clone_a_benchmark_setClone a Benchmark Setwrite
  • carbon_black_cloud.cis_benchmark_sets.get_all_benchmark_set_sectionsGet All Benchmark Set Sectionsread
  • carbon_black_cloud.cis_benchmark_sets.search_benchmark_setsSearch Benchmark Setsread
  • carbon_black_cloud.cis_benchmark_sets.search_rules_in_a_benchmark_setSearch Rules in a Benchmark Setread
  • carbon_black_cloud.cis_benchmark_sets.delete_benchmark_setDelete Benchmark Setdestructive
  • carbon_black_cloud.cis_benchmark_sets.execute_action_on_a_benchmark_set_enable_disable_reassessExecute Action on a Benchmark Set - Enable, Disable, Reassesswrite
  • and 4 more in this area
Vulnerabilities10
  • carbon_black_cloud.vulnerabilities.export_asset_view_with_vulnerability_summaryExport Asset View with Vulnerability Summarywrite
  • carbon_black_cloud.vulnerabilities.export_asset_view_with_vulnerability_summary_for_vcenterExport Asset View with Vulnerability Summary for vCenterwrite
  • carbon_black_cloud.vulnerabilities.get_a_vulnerability_list_for_a_vcenter_server_in_csv_formatGet a Vulnerability List for a vCenter Server in CSV Formatwrite
  • carbon_black_cloud.vulnerabilities.get_a_vulnerability_list_in_csv_formatGet a Vulnerability List in CSV Formatwrite
  • carbon_black_cloud.vulnerabilities.get_asset_view_with_vulnerability_summaryGet Asset View with Vulnerability Summaryread
  • carbon_black_cloud.vulnerabilities.get_asset_view_with_vulnerability_summary_for_vcenterGet Asset View with Vulnerability Summary for vCenterread
  • and 4 more in this area
Grants9
  • carbon_black_cloud.grants.bulk_fetch_grantsBulk Fetch Grantsread
  • carbon_black_cloud.grants.create_grant_for_a_principalCreate Grant for a Principalwrite
  • carbon_black_cloud.grants.create_profile_in_principal_s_grantCreate Profile in Principal’s Grantwrite
  • carbon_black_cloud.grants.get_permitted_rolesGet Permitted Rolesread
  • carbon_black_cloud.grants.delete_grant_for_a_principalDelete Grant for a Principaldestructive
  • carbon_black_cloud.grants.delete_profileDelete Profiledestructive
  • and 3 more in this area
Alerts8
  • carbon_black_cloud.alerts.export_alertsExport Alertswrite
  • carbon_black_cloud.alerts.facet_alerts_ungroupedFacet alerts - ungroupedread
  • carbon_black_cloud.alerts.find_alerts_ungroupedFind alerts - Ungroupedread
  • carbon_black_cloud.alerts.get_alert_detailsGet Alert Detailsread
  • carbon_black_cloud.alerts.get_alert_histogramGet alert histogramread
  • carbon_black_cloud.alerts.get_alert_historyGet Alert Historyread
  • and 2 more in this area
Container setup8
  • carbon_black_cloud.container_setup.create_custom_resourceCreate Custom Resourcewrite
  • carbon_black_cloud.container_setup.get_cli_installation_commandGet CLI Installation Commandread
  • carbon_black_cloud.container_setup.get_download_links_for_cliGet Download Links for CLIread
  • carbon_black_cloud.container_setup.get_full_operator_compatibilityGet Full Operator Compatibilityread
  • carbon_black_cloud.container_setup.check_status_of_a_custom_resourceCheck Status of a Custom Resourceread
  • carbon_black_cloud.container_setup.get_operator_compatibilityGet Operator Compatibilityread
  • and 2 more in this area
Device vulnerabilities8
  • carbon_black_cloud.device_vulnerabilities.get_a_vulnerability_list_for_specific_device_in_csv_formatGet a Vulnerability List for Specific Device in CSV Formatwrite
  • carbon_black_cloud.device_vulnerabilities.get_a_vulnerability_list_for_specific_vcenter_device_in_csv_formatGet a Vulnerability List for Specific vCenter Device in CSV Formatwrite
  • carbon_black_cloud.device_vulnerabilities.get_specific_device_vulnerability_listGet Specific Device Vulnerability Listread
  • carbon_black_cloud.device_vulnerabilities.get_specific_device_vulnerability_summaryGet Specific Device Vulnerability Summaryread
  • carbon_black_cloud.device_vulnerabilities.get_specific_vcenter_device_vulnerability_listGet Specific vCenter Device Vulnerability Listread
  • carbon_black_cloud.device_vulnerabilities.get_specific_vcenter_device_vulnerability_summaryGet Specific vCenter Device Vulnerability Summaryread
  • and 2 more in this area
Enriched events8
  • carbon_black_cloud.enriched_events.request_details_for_enriched_events_v2Request Details for Enriched Events (v2)write
  • carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_event_aggregation_search_v1Retrieve Results for an Enriched Event Aggregation Search (v1)read
  • carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_event_detail_search_v2Retrieve Results for an Enriched Event Detail Search (v2)read
  • carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_events_facet_search_v2Retrieve Results for an Enriched Events Facet Search (v2)read
  • carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_events_search_v2Retrieve Results for an Enriched Events Search (v2)read
  • carbon_black_cloud.enriched_events.start_a_facet_search_on_enriched_events_v2Start a Facet Search on Enriched Events (v2)write
  • and 2 more in this area
Cis compliance7
  • carbon_black_cloud.cis_compliance.export_compliance_information_for_devicesExport Compliance Information for Deviceswrite
  • carbon_black_cloud.cis_compliance.export_rule_compliance_summariesExport Rule Compliance Summarieswrite
  • carbon_black_cloud.cis_compliance.search_compliance_information_for_devicesSearch Compliance Information for Devicesread
  • carbon_black_cloud.cis_compliance.search_compliance_results_for_a_deviceSearch Compliance Results for a Deviceread
  • carbon_black_cloud.cis_compliance.search_compliance_summaries_for_a_benchmark_setSearch Compliance Summaries for a Benchmark Setread
  • carbon_black_cloud.cis_compliance.search_device_rule_resultsSearch Device Rule Resultsread
  • and 1 more in this area
Sensor updates7
  • carbon_black_cloud.sensor_updates.create_sensor_update_jobCreate Sensor Update Jobwrite
  • carbon_black_cloud.sensor_updates.export_sensors_in_sensor_update_jobExport Sensors in Sensor Update Jobwrite
  • carbon_black_cloud.sensor_updates.search_sensor_update_jobsSearch Sensor Update Jobsread
  • carbon_black_cloud.sensor_updates.search_sensors_in_sensor_update_jobSearch Sensors in Sensor Update Jobread
  • carbon_black_cloud.sensor_updates.get_sensor_update_jobGet Sensor Update Jobread
  • carbon_black_cloud.sensor_updates.stop_sensor_update_jobStop Sensor Update Jobdestructive
  • and 1 more in this area
Auth events6
  • carbon_black_cloud.auth_events.get_auth_events_descriptionsGet Auth Events Descriptionsread
  • carbon_black_cloud.auth_events.get_auth_events_search_group_resultsGet Auth Events Search Group Resultsread
  • carbon_black_cloud.auth_events.get_auth_events_search_job_resultsGet Auth Events Search Job Resultsread
  • carbon_black_cloud.auth_events.get_auth_events_search_suggestionsGet Auth Events Search Suggestionsread
  • carbon_black_cloud.auth_events.get_auth_events_search_validationGet Auth Events Search Validationread
  • carbon_black_cloud.auth_events.start_auth_events_search_jobStart Auth Events Search Jobwrite
Container scopes6
  • carbon_black_cloud.container_scopes.create_or_update_scopeCreate or Update Scopewrite
  • carbon_black_cloud.container_scopes.get_all_scopesGet All Scopesread
  • carbon_black_cloud.container_scopes.get_all_scopes_with_policiesGet All Scopes With Policiesread
  • carbon_black_cloud.container_scopes.get_scope_with_policyGet Scope With Policyread
  • carbon_black_cloud.container_scopes.delete_scopeDelete Scopedestructive
  • carbon_black_cloud.container_scopes.get_specified_scopeGet Specified Scoperead
Data collection6
  • carbon_black_cloud.data_collection.get_data_collection_rule_configsGet Data Collection Rule Configsread
  • carbon_black_cloud.data_collection.get_data_collection_rule_configs_organizationGet Data Collection Rule Configs - Organizationread
  • carbon_black_cloud.data_collection.update_data_collection_rule_configsUpdate Data Collection Rule Configswrite
  • carbon_black_cloud.data_collection.update_data_collection_rule_configs_organizationUpdate Data Collection Rule Configs - Organizationwrite
  • carbon_black_cloud.data_collection.delete_data_collection_rule_configsDelete Data Collection Rule Configsdestructive
  • carbon_black_cloud.data_collection.delete_specific_data_collection_rule_configDelete Specific Data Collection Rule Configdestructive
Host based firewall6
  • carbon_black_cloud.host_based_firewall.copy_host_based_firewall_rule_configCopy Host-Based Firewall Rule Configwrite
  • carbon_black_cloud.host_based_firewall.export_host_based_firewall_rulesExport Host-Based Firewall Rulesread
  • carbon_black_cloud.host_based_firewall.get_host_based_firewall_rule_configsGet Host-Based Firewall Rule Configsread
  • carbon_black_cloud.host_based_firewall.update_host_based_firewall_rule_configsUpdate Host-Based Firewall Rule Configswrite
  • carbon_black_cloud.host_based_firewall.delete_host_based_firewall_rule_configsDelete Host-Based Firewall Rule Configsdestructive
  • carbon_black_cloud.host_based_firewall.delete_specific_host_based_firewall_rule_configDelete Specific Host-Based Firewall Rule Configdestructive
Reputation overrides6
  • carbon_black_cloud.reputation_overrides.configure_reputation_overrideConfigure Reputation Overridewrite
  • carbon_black_cloud.reputation_overrides.export_reputation_overridesExport Reputation Overrideswrite
  • carbon_black_cloud.reputation_overrides.get_reputation_overrideGet Reputation Overrideread
  • carbon_black_cloud.reputation_overrides.search_reputation_overridesSearch Reputation Overridesread
  • carbon_black_cloud.reputation_overrides.bulk_delete_reputation_overridesBulk Delete Reputation Overridesdestructive
  • carbon_black_cloud.reputation_overrides.delete_reputation_overrideDelete Reputation Overridedestructive
Threats6
  • carbon_black_cloud.threats.create_a_threat_level_noteCreate a threat-level notewrite
  • carbon_black_cloud.threats.get_history_of_a_threat_idGet History of a Threat IDread
  • carbon_black_cloud.threats.get_notes_for_a_threatGet notes for a threatread
  • carbon_black_cloud.threats.update_threat_workflowUpdate Threat Workflowwrite
  • carbon_black_cloud.threats.delete_a_threat_level_noteDelete a threat-level notedestructive
  • carbon_black_cloud.threats.update_threat_workflow_by_criteriaUpdate Threat Workflow by Criteriawrite
Usb approvals6
  • carbon_black_cloud.usb_approvals.bulk_create_approvalsBulk Create Approvalswrite
  • carbon_black_cloud.usb_approvals.export_usb_approvals_exportExport USB Approvals Exportwrite
  • carbon_black_cloud.usb_approvals.get_approval_by_idGet Approval by IDread
  • carbon_black_cloud.usb_approvals.search_approvalsSearch Approvalsread
  • carbon_black_cloud.usb_approvals.delete_approval_by_idDelete Approval by IDdestructive
  • carbon_black_cloud.usb_approvals.update_approvalUpdate Approvalwrite
Binaries5
  • carbon_black_cloud.binaries.device_summaryDevice Summaryread
  • carbon_black_cloud.binaries.download_fileDownload Fileread
  • carbon_black_cloud.binaries.file_path_inputFile Path Inputread
  • carbon_black_cloud.binaries.request_signatureRequest Signatureread
  • carbon_black_cloud.binaries.retrieve_metadataRetrieve Metadataread
Compute resources5
  • carbon_black_cloud.compute_resources.check_compute_resource_eligibilityCheck Compute Resource Eligibilityread
  • carbon_black_cloud.compute_resources.facet_workload_compute_resourcesFacet Workload Compute Resourcesread
  • carbon_black_cloud.compute_resources.get_aws_compute_resource_summaryGet AWS Compute Resource Summaryread
  • carbon_black_cloud.compute_resources.search_workload_compute_resourcesSearch Workload Compute Resourcesread
  • carbon_black_cloud.compute_resources.get_compute_resource_by_idGet Compute Resource by IDread
Container overview5
  • carbon_black_cloud.container_overview.fixes_availableFixes Availableread
  • carbon_black_cloud.container_overview.get_clusters_namespaces_and_repositoriesGet clusters, namespaces and repositoriesread
  • carbon_black_cloud.container_overview.new_vulnerabilities_previous_24_hoursNew Vulnerabilities - previous 24 hoursread
  • carbon_black_cloud.container_overview.scan_statusScan Statusread
  • carbon_black_cloud.container_overview.search_vulnerabilities_over_timeSearch Vulnerabilities Over Timeread
Container vulnerabilities5
  • carbon_black_cloud.container_vulnerabilities.get_cveGet CVEread
  • carbon_black_cloud.container_vulnerabilities.get_vulnerability_summaryGet Vulnerability Summaryread
  • carbon_black_cloud.container_vulnerabilities.search_vulnerabilites_for_cve_informationSearch Vulnerabilites for CVE informationread
  • carbon_black_cloud.container_vulnerabilities.search_vulnerabilities_exceptionsSearch Vulnerabilities Exceptionsread
  • carbon_black_cloud.container_vulnerabilities.search_workloads_for_vulnerabilitiesSearch Workloads for Vulnerabilitiesread
Devices5
  • carbon_black_cloud.devices.device_facetDevice Facetread
  • carbon_black_cloud.devices.scroll_devicesScroll Devicesread
  • carbon_black_cloud.devices.search_devicesSearch Devicesread
  • carbon_black_cloud.devices.specific_device_informationSpecific Device Informationread
  • carbon_black_cloud.devices.device_actionsDevice Actionsdestructive
Live query templates5
  • carbon_black_cloud.live_query_templates.create_live_query_templateCreate Live Query Templatewrite
  • carbon_black_cloud.live_query_templates.edit_live_query_template_by_idEdit Live Query Template by IDwrite
  • carbon_black_cloud.live_query_templates.retrieve_live_query_template_by_idRetrieve Live Query Template by IDread
  • carbon_black_cloud.live_query_templates.search_live_query_templatesSearch Live Query Templatesread
  • carbon_black_cloud.live_query_templates.delete_query_schedule_by_idDelete Query Schedule by IDdestructive

Observations 5Policies 5Usb blocks 5Usb devices 5Users 5Appliances 4Cis bundles 4Container policies 4Container templates 4Cve 4Jobs 4Policy rules 4Alert notes 3Asset group members 3Asset group queries 3Audit logs 3Bypass rules 3Container inventory 3Container scan logs 3Core prevention 3Feed search 3Grouped alerts 3Policy rule configs 3Process events 3Threat tags 3Alert workflow 2Auth event details 2Auth event facets 2Cis devices 2Cis settings 2Container rules 2Observation details 2Observation facets 2Process watchlist 2Recommendations 2Differential analysis 1Scripts 1Sensor lifecycle 1Threat hunts 1Threat metadata 1Usb products 1

This index shows a sample of each area. All 390 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The VMware Carbon Black Cloud MCP server, answered.

Is there a VMware Carbon Black Cloud MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 390 VMware Carbon Black Cloud actions across watchlists, cloud accounts, feeds and data forwarders, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by VMware Carbon Black Cloud.

What do I need to connect VMware Carbon Black Cloud?

Carbon Black Cloud API ID and Carbon Black Cloud API Secret Key for the same API ID (API Credentials on the key's row). Plus your host and your org key. The free call account { op: "connections.requirements", service: "carbon_black_cloud" } lists exactly what to paste.

Can an AI agent delete or change things in VMware Carbon Black Cloud?

Only if its key allows it, and only with an explicit confirmation. 54 VMware Carbon Black Cloud actions are destructive, including delete User, delete Policy and delete Feed. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my VMware Carbon Black Cloud API limit?

actionlake paces every call to the limits in the VMware Carbon Black Cloud service file: 100 calls a second per connection. Repeated reads are answered from cache (221 VMware Carbon Black Cloud actions can be), which never reaches VMware Carbon Black Cloud.

What does a VMware Carbon Black Cloud action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (390 VMware Carbon Black Cloud actions page). Cache hits, searches, dry runs and calls VMware Carbon Black Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which VMware Carbon Black Cloud API does it cover?

The VMware Carbon Black Cloud (Broadcom) platform, Endpoint Standard, Enterprise EDR, Audit and Remediation, Workload and Container APIs API Carbon Black Cloud REST APIs (Alerts v7, Devices v6, Policy Service v1, Investigate v2, Watchlist Manager v3, Feed Manager v2, Live Query v1, Asset Groups v1, Vulnerability Assessment v1, CIS Benchmarks v1, Containers v1/v1beta) at your VMware Carbon Black Cloud instance's API base URL, which you enter when connecting. It is built from VMware Carbon Black Cloud's documentation as read on 23 October 2026. 390 actions in 71 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my VMware Carbon Black Cloud data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your VMware Carbon Black Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like VMware Carbon Black Cloud

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by VMware Carbon Black Cloud; the name is the vendor's own. Counts are from the VMware Carbon Black Cloud service file, version 1.0.0.

Give your agent VMware Carbon Black Cloud today.

Connect VMware Carbon Black Cloud freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.