---
title: "VMware Carbon Black Cloud MCP server - actionlake"
description: "Give Claude 390 VMware Carbon Black Cloud actions through one MCP server: watchlists. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/vmware-carbon-black-cloud
updated: 2026-10-23
---

Connectors · Identity & security

# VMware Carbon Black Cloud MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to VMware Carbon Black Cloud and the rest of your systems. It gives your agent 390 VMware Carbon Black Cloud actions (221 reads, 115 writes and 54 that wait for a confirmation) and holds the VMware Carbon Black Cloud credential itself, so the agent never does. It paces VMware Carbon Black Cloud's limits and records every call.

[Connect VMware Carbon Black Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "carbon_black_cloud.users.list_all_users",
  intent: "check which VMware Carbon Black Cloud account is connected"
}
# List All Users · read · 1 upstream call
```

- 390 actions in one signed file
- 221 read look, never change
- 115 write create and update
- 54 wait for a yes destructive, confirmed first

Set up

## Connect VMware Carbon Black Cloud in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect VMware Carbon Black Cloud.
   API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `api_id` Carbon Black Cloud API ID
   - `api_secret_key` Carbon Black Cloud API Secret Key for the same API ID (API Credentials on the key's row)
   - `host` Where your VMware Carbon Black Cloud lives: your host
   - `org_key` Your VMware Carbon Black Cloud org key
   ```
   account { op: "connections.requirements", service: "carbon_black_cloud" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "carbon_black_cloud.users.list_all_users" }
   # list all users · read · 1 upstream call
   check { action: "carbon_black_cloud.users.create_user", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

VMware Carbon Black Cloud at a glance

**Sign-in**

API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`api_id` `api_secret_key`

**Setup fields**

`host` `org_key`

**Limits we pace to**

100 calls a second, per connection

**API covered**

VMware Carbon Black Cloud (Broadcom) platform, Endpoint Standard, Enterprise EDR, Audit and Remediation, Workload and Container APIs API Carbon Black Cloud REST APIs (Alerts v7, Devices v6, Policy Service v1, Investigate v2, Watchlist Manager v3, Feed Manager v2, Live Query v1, Asset Groups v1, Vulnerability Assessment v1, CIS Benchmarks v1, Containers v1/v1beta), at your VMware Carbon Black Cloud instance's API base URL, which you enter when connecting

**Built from**

VMware Carbon Black Cloud's documentation, read 23 October 2026[documenter.getpostman.com](https://documenter.getpostman.com/view/19038029/2s8YK4to5o) [developer.carbonblack.com](https://developer.carbonblack.com/reference/carbon-black-cloud/)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

221 of 221 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

3, so ask can line VMware Carbon Black Cloud up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in VMware Carbon Black Cloud.

390 actions in 71 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **221** read look, never change
- **115** write create and update
- **54** destructive wait for a confirmation

1. ### Watchlists
   35
   13 read · 11 write · 11 destructive
   Bulk Get Report Ignore Status · Create New Report · Create New Watchlist · Get All Watchlists
2. ### Cloud accounts
   17
   7 read · 6 write · 4 destructive
   Add SSM Document · Create Provision Template · Facet Cloud Accounts · Get External ID for AWS Account
3. ### Feeds
   15
   7 read · 6 write · 2 destructive
   Convert Legacy Query · Create a New Private Feed · Create a New Reserved Feed · Get all Feeds
4. ### Data forwarders
   14
   8 read · 4 write · 2 destructive
   Create Filter on Forwarder · Create Forwarder · Filterable Event Schema · Forwarder Healthcheck
5. ### Processes
   12
   7 read · 4 write · 1 destructive
   Get Time Limits for Available Data (v1) · Process Search Suggestions (v2) · Process Search Validation (v2) · Retrieve Results for a Process Detail Search (v2)
6. ### Live query
   11
   8 read · 1 write · 2 destructive
   Get Device Summary Facets · Get Device Summary From Results · Get Facets From Live Query Results · Get Live Query Recommendations
7. ### Live response
   11
   5 read · 2 write · 4 destructive
   Get All Files Metadata · Get Commands List · Start Session · Disable Live Response
8. ### Asset groups
   10
   6 read · 3 write · 1 destructive
   Create Asset Group · Export Asset Groups · Get All Asset Groups · Get Asset Group Stats

**63 more areas · 265 actions**

- Cis benchmark sets **10**
- Vulnerabilities **10**
- Grants **9**
- Alerts **8**
- Container setup **8**
- Device vulnerabilities **8**
- Enriched events **8**
- Cis compliance **7**
- Sensor updates **7**
- Auth events **6**
- Container scopes **6**
- Data collection **6**
- Host based firewall **6**
- Reputation overrides **6**
- Threats **6**
- Usb approvals **6**
- Binaries **5**
- Compute resources **5**
- Container overview **5**
- Container vulnerabilities **5**
- Devices **5**
- Live query templates **5**
- Observations **5**
- Policies **5**
- Usb blocks **5**
- Usb devices **5**
- Users **5**
- Appliances **4**
- Cis bundles **4**
- Container policies **4**
- Container templates **4**
- Cve **4**
- Jobs **4**
- Policy rules **4**
- Alert notes **3**
- Asset group members **3**
- Asset group queries **3**
- Audit logs **3**
- Bypass rules **3**
- Container inventory **3**
- Container scan logs **3**
- Core prevention **3**
- Feed search **3**
- Grouped alerts **3**
- Policy rule configs **3**
- Process events **3**
- Threat tags **3**
- Alert workflow **2**
- Auth event details **2**
- Auth event facets **2**
- Cis devices **2**
- Cis settings **2**
- Container rules **2**
- Observation details **2**
- Observation facets **2**
- Process watchlist **2**
- Recommendations **2**
- Differential analysis **1**
- Scripts **1**
- Sensor lifecycle **1**
- Threat hunts **1**
- Threat metadata **1**
- Usb products **1**

Top actions

## The VMware Carbon Black Cloud API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 13 of VMware Carbon Black Cloud's 13 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `carbon_black_cloud.users.list_all_users` List All Users | List All Users. | read | `identity.user.list` 474 connectors |
| `carbon_black_cloud.policies.get_policy_summary` Get Policy Summary | Get Policy Summary. | read | `security.policy.list` 36 connectors |
| `carbon_black_cloud.users.create_user` Create User | Create User. | write | `identity.user.create` 262 connectors |
| `carbon_black_cloud.policies.create_policy` Create Policy | Create Policy. | write | `security.policy.create` 25 connectors |
| `carbon_black_cloud.users.delete_user` Delete User | Delete User. | destructive | `identity.user.delete` 253 connectors |
| `carbon_black_cloud.devices.search_devices` Search Devices | Search Devices. | read | `device.endpoint.search` 8 connectors |
| `carbon_black_cloud.devices.specific_device_information` Specific Device Information | Specific Device Information. | read | `device.endpoint.get` 57 connectors |
| `carbon_black_cloud.alerts.get_alert_details` Get Alert Details | Get Alert Details. | read | `security.alert.get` 21 connectors |
| `carbon_black_cloud.alerts.find_alerts_ungrouped` Find alerts - Ungrouped | Find alerts - Ungrouped. | read | `security.alert.search` 6 connectors |
| `carbon_black_cloud.feeds.get_reports` Get Reports | Get Reports. | read | this connector |
| `carbon_black_cloud.feeds.get_all_feeds` Get all Feeds | Get all Feeds. | read | this connector |
| `carbon_black_cloud.alerts.export_alerts` Export Alerts | Export Alerts. | write | this connector |

Try it

## Prompts to paste into Claude.

Each one names the VMware Carbon Black Cloud actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Which VMware Carbon Black Cloud devices have not checked in for a week?
   calls `carbon_black_cloud.devices.search_devices`
2. Write write
   Create User in VMware Carbon Black Cloud. Show me exactly what you will send before you save it.
   calls `carbon_black_cloud.users.create_user`

Governance for VMware Carbon Black Cloud

## Destructive actions wait for a yes.

54 VMware Carbon Black Cloud actions are destructive. The first 10:

- Delete User `carbon_black_cloud.users.delete_user`
- Delete Policy `carbon_black_cloud.policies.delete_policy`
- Delete Feed `carbon_black_cloud.feeds.delete_feed`
- Delete report `carbon_black_cloud.feeds.delete_report`
- Delete Profile `carbon_black_cloud.grants.delete_profile`
- Device Actions `carbon_black_cloud.devices.device_actions`
- Delete a Tag `carbon_black_cloud.threat_tags.delete_a_tag`
- Remove Report `carbon_black_cloud.watchlists.remove_report`
- Delete a Note `carbon_black_cloud.alert_notes.delete_a_note`
- Delete File `carbon_black_cloud.live_response.delete_file`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do carbon_black_cloud.users.delete_user confirm_policy: **human**

Delete User?

**intent:** the user asked me to delete User

run suspended · waiting for a named person · key _carbon-black-cloud-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "carbon-black-cloud-agent",
  allowed_actions: ["carbon_black_cloud.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "carbon_black_cloud.users.delete_user", approver: "lead@example.com" },
    { match: "carbon_black_cloud.policies.delete_policy", approver: "lead@example.com" },
    { match: "carbon_black_cloud.feeds.delete_feed", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to VMware Carbon Black Cloud only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What VMware Carbon Black Cloud costs on actionlake.

Every VMware Carbon Black Cloud action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call VMware Carbon Black Cloud refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 390 VMware Carbon Black Cloud actions
- 390 actions page each page of a long list is one call
- 221 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every VMware Carbon Black Cloud action.

390 actions by area: the id your agent calls, what it does, and its effect.

**Watchlists 35**

- `carbon_black_cloud.watchlists.bulk_get_report_ignore_status` Bulk Get Report Ignore Status read
- `carbon_black_cloud.watchlists.create_new_report` Create New Report write
- `carbon_black_cloud.watchlists.create_new_watchlist` Create New Watchlist write
- `carbon_black_cloud.watchlists.get_all_watchlists` Get All Watchlists read
- `carbon_black_cloud.watchlists.add_iocs_to_report` Add IOCs to Report write
- `carbon_black_cloud.watchlists.bulk_ignore_report_and_iocs` Bulk Ignore Report and IOCs write
- and 29 more in this area

**Cloud accounts 17**

- `carbon_black_cloud.cloud_accounts.add_ssm_document` Add SSM Document write
- `carbon_black_cloud.cloud_accounts.create_provision_template` Create Provision Template write
- `carbon_black_cloud.cloud_accounts.facet_cloud_accounts` Facet Cloud Accounts read
- `carbon_black_cloud.cloud_accounts.get_external_id_for_aws_account` Get External ID for AWS Account read
- `carbon_black_cloud.cloud_accounts.bulk_delete_cloud_account` Bulk Delete Cloud Account destructive
- `carbon_black_cloud.cloud_accounts.delete_cloud_account` Delete Cloud Account destructive
- and 11 more in this area

**Feeds 15**

- `carbon_black_cloud.feeds.convert_legacy_query` Convert Legacy Query read
- `carbon_black_cloud.feeds.create_a_new_private_feed` Create a New Private Feed write
- `carbon_black_cloud.feeds.create_a_new_reserved_feed` Create a New Reserved Feed write
- `carbon_black_cloud.feeds.get_all_feeds` Get all Feeds read
- `carbon_black_cloud.feeds.delete_feed` Delete Feed destructive
- `carbon_black_cloud.feeds.delete_report` Delete report destructive
- and 9 more in this area

**Data forwarders 14**

- `carbon_black_cloud.data_forwarders.create_filter_on_forwarder` Create Filter on Forwarder write
- `carbon_black_cloud.data_forwarders.create_forwarder` Create Forwarder write
- `carbon_black_cloud.data_forwarders.filterable_event_schema` Filterable Event Schema read
- `carbon_black_cloud.data_forwarders.forwarder_healthcheck` Forwarder Healthcheck read
- `carbon_black_cloud.data_forwarders.delete_filter_on_forwarder` Delete Filter on Forwarder destructive
- `carbon_black_cloud.data_forwarders.delete_forwarder` Delete Forwarder destructive
- and 8 more in this area

**Processes 12**

- `carbon_black_cloud.processes.get_time_limits_for_available_data_v1` Get Time Limits for Available Data (v1) read
- `carbon_black_cloud.processes.process_search_suggestions_v2` Process Search Suggestions (v2) read
- `carbon_black_cloud.processes.process_search_validation_v2` Process Search Validation (v2) read
- `carbon_black_cloud.processes.retrieve_results_for_a_process_detail_search_v2` Retrieve Results for a Process Detail Search (v2) read
- `carbon_black_cloud.processes.cancel_a_process_search_v1` Cancel a Process Search (v1) destructive
- `carbon_black_cloud.processes.retrieve_results_for_a_process_facets_search_v2` Retrieve Results for a Process Facets Search (v2) read
- and 6 more in this area

**Live query 11**

- `carbon_black_cloud.live_query.get_device_summary_facets` Get Device Summary Facets read
- `carbon_black_cloud.live_query.get_device_summary_from_results` Get Device Summary From Results read
- `carbon_black_cloud.live_query.get_facets_from_live_query_results` Get Facets From Live Query Results read
- `carbon_black_cloud.live_query.get_live_query_recommendations` Get Live Query Recommendations read
- `carbon_black_cloud.live_query.delete_query_run` Delete Query Run destructive
- `carbon_black_cloud.live_query.get_query_details` Get Query Details read
- and 5 more in this area

**Live response 11**

- `carbon_black_cloud.live_response.disable_live_response` Disable Live Response write
- `carbon_black_cloud.live_response.get_all_files_metadata` Get All Files Metadata read
- `carbon_black_cloud.live_response.get_commands_list` Get Commands List read
- `carbon_black_cloud.live_response.start_session` Start Session write
- `carbon_black_cloud.live_response.cancel_command` Retrieve Command Copy destructive
- `carbon_black_cloud.live_response.close_session` Close Session destructive
- and 5 more in this area

**Asset groups 10**

- `carbon_black_cloud.asset_groups.create_asset_group` Create Asset Group write
- `carbon_black_cloud.asset_groups.export_asset_groups` Export Asset Groups write
- `carbon_black_cloud.asset_groups.get_all_asset_groups` Get All Asset Groups read
- `carbon_black_cloud.asset_groups.get_asset_group_stats` Get Asset Group Stats read
- `carbon_black_cloud.asset_groups.delete_asset_group` Delete Asset Group destructive
- `carbon_black_cloud.asset_groups.get_asset_group_by_id` Get Asset Group by ID read
- and 4 more in this area

**Cis benchmark sets 10**

- `carbon_black_cloud.cis_benchmark_sets.clone_a_benchmark_set` Clone a Benchmark Set write
- `carbon_black_cloud.cis_benchmark_sets.get_all_benchmark_set_sections` Get All Benchmark Set Sections read
- `carbon_black_cloud.cis_benchmark_sets.search_benchmark_sets` Search Benchmark Sets read
- `carbon_black_cloud.cis_benchmark_sets.search_rules_in_a_benchmark_set` Search Rules in a Benchmark Set read
- `carbon_black_cloud.cis_benchmark_sets.delete_benchmark_set` Delete Benchmark Set destructive
- `carbon_black_cloud.cis_benchmark_sets.execute_action_on_a_benchmark_set_enable_disable_reassess` Execute Action on a Benchmark Set - Enable, Disable, Reassess write
- and 4 more in this area

**Vulnerabilities 10**

- `carbon_black_cloud.vulnerabilities.export_asset_view_with_vulnerability_summary` Export Asset View with Vulnerability Summary write
- `carbon_black_cloud.vulnerabilities.export_asset_view_with_vulnerability_summary_for_vcenter` Export Asset View with Vulnerability Summary for vCenter write
- `carbon_black_cloud.vulnerabilities.get_a_vulnerability_list_for_a_vcenter_server_in_csv_format` Get a Vulnerability List for a vCenter Server in CSV Format write
- `carbon_black_cloud.vulnerabilities.get_a_vulnerability_list_in_csv_format` Get a Vulnerability List in CSV Format write
- `carbon_black_cloud.vulnerabilities.get_asset_view_with_vulnerability_summary` Get Asset View with Vulnerability Summary read
- `carbon_black_cloud.vulnerabilities.get_asset_view_with_vulnerability_summary_for_vcenter` Get Asset View with Vulnerability Summary for vCenter read
- and 4 more in this area

**Grants 9**

- `carbon_black_cloud.grants.bulk_fetch_grants` Bulk Fetch Grants read
- `carbon_black_cloud.grants.create_grant_for_a_principal` Create Grant for a Principal write
- `carbon_black_cloud.grants.create_profile_in_principal_s_grant` Create Profile in Principal’s Grant write
- `carbon_black_cloud.grants.get_permitted_roles` Get Permitted Roles read
- `carbon_black_cloud.grants.delete_grant_for_a_principal` Delete Grant for a Principal destructive
- `carbon_black_cloud.grants.delete_profile` Delete Profile destructive
- and 3 more in this area

**Alerts 8**

- `carbon_black_cloud.alerts.export_alerts` Export Alerts write
- `carbon_black_cloud.alerts.facet_alerts_ungrouped` Facet alerts - ungrouped read
- `carbon_black_cloud.alerts.find_alerts_ungrouped` Find alerts - Ungrouped read
- `carbon_black_cloud.alerts.get_alert_details` Get Alert Details read
- `carbon_black_cloud.alerts.get_alert_histogram` Get alert histogram read
- `carbon_black_cloud.alerts.get_alert_history` Get Alert History read
- and 2 more in this area

**Container setup 8**

- `carbon_black_cloud.container_setup.create_custom_resource` Create Custom Resource write
- `carbon_black_cloud.container_setup.get_cli_installation_command` Get CLI Installation Command read
- `carbon_black_cloud.container_setup.get_download_links_for_cli` Get Download Links for CLI read
- `carbon_black_cloud.container_setup.get_full_operator_compatibility` Get Full Operator Compatibility read
- `carbon_black_cloud.container_setup.check_status_of_a_custom_resource` Check Status of a Custom Resource read
- `carbon_black_cloud.container_setup.get_operator_compatibility` Get Operator Compatibility read
- and 2 more in this area

**Device vulnerabilities 8**

- `carbon_black_cloud.device_vulnerabilities.get_a_vulnerability_list_for_specific_device_in_csv_format` Get a Vulnerability List for Specific Device in CSV Format write
- `carbon_black_cloud.device_vulnerabilities.get_a_vulnerability_list_for_specific_vcenter_device_in_csv_format` Get a Vulnerability List for Specific vCenter Device in CSV Format write
- `carbon_black_cloud.device_vulnerabilities.get_specific_device_vulnerability_list` Get Specific Device Vulnerability List read
- `carbon_black_cloud.device_vulnerabilities.get_specific_device_vulnerability_summary` Get Specific Device Vulnerability Summary read
- `carbon_black_cloud.device_vulnerabilities.get_specific_vcenter_device_vulnerability_list` Get Specific vCenter Device Vulnerability List read
- `carbon_black_cloud.device_vulnerabilities.get_specific_vcenter_device_vulnerability_summary` Get Specific vCenter Device Vulnerability Summary read
- and 2 more in this area

**Enriched events 8**

- `carbon_black_cloud.enriched_events.request_details_for_enriched_events_v2` Request Details for Enriched Events (v2) write
- `carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_event_aggregation_search_v1` Retrieve Results for an Enriched Event Aggregation Search (v1) read
- `carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_event_detail_search_v2` Retrieve Results for an Enriched Event Detail Search (v2) read
- `carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_events_facet_search_v2` Retrieve Results for an Enriched Events Facet Search (v2) read
- `carbon_black_cloud.enriched_events.retrieve_results_for_an_enriched_events_search_v2` Retrieve Results for an Enriched Events Search (v2) read
- `carbon_black_cloud.enriched_events.start_a_facet_search_on_enriched_events_v2` Start a Facet Search on Enriched Events (v2) write
- and 2 more in this area

**Cis compliance 7**

- `carbon_black_cloud.cis_compliance.export_compliance_information_for_devices` Export Compliance Information for Devices write
- `carbon_black_cloud.cis_compliance.export_rule_compliance_summaries` Export Rule Compliance Summaries write
- `carbon_black_cloud.cis_compliance.search_compliance_information_for_devices` Search Compliance Information for Devices read
- `carbon_black_cloud.cis_compliance.search_compliance_results_for_a_device` Search Compliance Results for a Device read
- `carbon_black_cloud.cis_compliance.search_compliance_summaries_for_a_benchmark_set` Search Compliance Summaries for a Benchmark Set read
- `carbon_black_cloud.cis_compliance.search_device_rule_results` Search Device Rule Results read
- and 1 more in this area

**Sensor updates 7**

- `carbon_black_cloud.sensor_updates.create_sensor_update_job` Create Sensor Update Job write
- `carbon_black_cloud.sensor_updates.export_sensors_in_sensor_update_job` Export Sensors in Sensor Update Job write
- `carbon_black_cloud.sensor_updates.search_sensor_update_jobs` Search Sensor Update Jobs read
- `carbon_black_cloud.sensor_updates.search_sensors_in_sensor_update_job` Search Sensors in Sensor Update Job read
- `carbon_black_cloud.sensor_updates.get_sensor_update_job` Get Sensor Update Job read
- `carbon_black_cloud.sensor_updates.stop_sensor_update_job` Stop Sensor Update Job destructive
- and 1 more in this area

**Auth events 6**

- `carbon_black_cloud.auth_events.get_auth_events_descriptions` Get Auth Events Descriptions read
- `carbon_black_cloud.auth_events.get_auth_events_search_group_results` Get Auth Events Search Group Results read
- `carbon_black_cloud.auth_events.get_auth_events_search_job_results` Get Auth Events Search Job Results read
- `carbon_black_cloud.auth_events.get_auth_events_search_suggestions` Get Auth Events Search Suggestions read
- `carbon_black_cloud.auth_events.get_auth_events_search_validation` Get Auth Events Search Validation read
- `carbon_black_cloud.auth_events.start_auth_events_search_job` Start Auth Events Search Job write

**Container scopes 6**

- `carbon_black_cloud.container_scopes.create_or_update_scope` Create or Update Scope write
- `carbon_black_cloud.container_scopes.get_all_scopes` Get All Scopes read
- `carbon_black_cloud.container_scopes.get_all_scopes_with_policies` Get All Scopes With Policies read
- `carbon_black_cloud.container_scopes.get_scope_with_policy` Get Scope With Policy read
- `carbon_black_cloud.container_scopes.delete_scope` Delete Scope destructive
- `carbon_black_cloud.container_scopes.get_specified_scope` Get Specified Scope read

**Data collection 6**

- `carbon_black_cloud.data_collection.get_data_collection_rule_configs` Get Data Collection Rule Configs read
- `carbon_black_cloud.data_collection.get_data_collection_rule_configs_organization` Get Data Collection Rule Configs - Organization read
- `carbon_black_cloud.data_collection.update_data_collection_rule_configs` Update Data Collection Rule Configs write
- `carbon_black_cloud.data_collection.update_data_collection_rule_configs_organization` Update Data Collection Rule Configs - Organization write
- `carbon_black_cloud.data_collection.delete_data_collection_rule_configs` Delete Data Collection Rule Configs destructive
- `carbon_black_cloud.data_collection.delete_specific_data_collection_rule_config` Delete Specific Data Collection Rule Config destructive

**Host based firewall 6**

- `carbon_black_cloud.host_based_firewall.copy_host_based_firewall_rule_config` Copy Host-Based Firewall Rule Config write
- `carbon_black_cloud.host_based_firewall.export_host_based_firewall_rules` Export Host-Based Firewall Rules read
- `carbon_black_cloud.host_based_firewall.get_host_based_firewall_rule_configs` Get Host-Based Firewall Rule Configs read
- `carbon_black_cloud.host_based_firewall.update_host_based_firewall_rule_configs` Update Host-Based Firewall Rule Configs write
- `carbon_black_cloud.host_based_firewall.delete_host_based_firewall_rule_configs` Delete Host-Based Firewall Rule Configs destructive
- `carbon_black_cloud.host_based_firewall.delete_specific_host_based_firewall_rule_config` Delete Specific Host-Based Firewall Rule Config destructive

**Reputation overrides 6**

- `carbon_black_cloud.reputation_overrides.configure_reputation_override` Configure Reputation Override write
- `carbon_black_cloud.reputation_overrides.export_reputation_overrides` Export Reputation Overrides write
- `carbon_black_cloud.reputation_overrides.get_reputation_override` Get Reputation Override read
- `carbon_black_cloud.reputation_overrides.search_reputation_overrides` Search Reputation Overrides read
- `carbon_black_cloud.reputation_overrides.bulk_delete_reputation_overrides` Bulk Delete Reputation Overrides destructive
- `carbon_black_cloud.reputation_overrides.delete_reputation_override` Delete Reputation Override destructive

**Threats 6**

- `carbon_black_cloud.threats.create_a_threat_level_note` Create a threat-level note write
- `carbon_black_cloud.threats.get_history_of_a_threat_id` Get History of a Threat ID read
- `carbon_black_cloud.threats.get_notes_for_a_threat` Get notes for a threat read
- `carbon_black_cloud.threats.update_threat_workflow` Update Threat Workflow write
- `carbon_black_cloud.threats.delete_a_threat_level_note` Delete a threat-level note destructive
- `carbon_black_cloud.threats.update_threat_workflow_by_criteria` Update Threat Workflow by Criteria write

**Usb approvals 6**

- `carbon_black_cloud.usb_approvals.bulk_create_approvals` Bulk Create Approvals write
- `carbon_black_cloud.usb_approvals.export_usb_approvals_export` Export USB Approvals Export write
- `carbon_black_cloud.usb_approvals.get_approval_by_id` Get Approval by ID read
- `carbon_black_cloud.usb_approvals.search_approvals` Search Approvals read
- `carbon_black_cloud.usb_approvals.delete_approval_by_id` Delete Approval by ID destructive
- `carbon_black_cloud.usb_approvals.update_approval` Update Approval write

**Binaries 5**

- `carbon_black_cloud.binaries.device_summary` Device Summary read
- `carbon_black_cloud.binaries.download_file` Download File read
- `carbon_black_cloud.binaries.file_path_input` File Path Input read
- `carbon_black_cloud.binaries.request_signature` Request Signature read
- `carbon_black_cloud.binaries.retrieve_metadata` Retrieve Metadata read

**Compute resources 5**

- `carbon_black_cloud.compute_resources.check_compute_resource_eligibility` Check Compute Resource Eligibility read
- `carbon_black_cloud.compute_resources.facet_workload_compute_resources` Facet Workload Compute Resources read
- `carbon_black_cloud.compute_resources.get_aws_compute_resource_summary` Get AWS Compute Resource Summary read
- `carbon_black_cloud.compute_resources.search_workload_compute_resources` Search Workload Compute Resources read
- `carbon_black_cloud.compute_resources.get_compute_resource_by_id` Get Compute Resource by ID read

**Container overview 5**

- `carbon_black_cloud.container_overview.fixes_available` Fixes Available read
- `carbon_black_cloud.container_overview.get_clusters_namespaces_and_repositories` Get clusters, namespaces and repositories read
- `carbon_black_cloud.container_overview.new_vulnerabilities_previous_24_hours` New Vulnerabilities - previous 24 hours read
- `carbon_black_cloud.container_overview.scan_status` Scan Status read
- `carbon_black_cloud.container_overview.search_vulnerabilities_over_time` Search Vulnerabilities Over Time read

**Container vulnerabilities 5**

- `carbon_black_cloud.container_vulnerabilities.get_cve` Get CVE read
- `carbon_black_cloud.container_vulnerabilities.get_vulnerability_summary` Get Vulnerability Summary read
- `carbon_black_cloud.container_vulnerabilities.search_vulnerabilites_for_cve_information` Search Vulnerabilites for CVE information read
- `carbon_black_cloud.container_vulnerabilities.search_vulnerabilities_exceptions` Search Vulnerabilities Exceptions read
- `carbon_black_cloud.container_vulnerabilities.search_workloads_for_vulnerabilities` Search Workloads for Vulnerabilities read

**Devices 5**

- `carbon_black_cloud.devices.device_facet` Device Facet read
- `carbon_black_cloud.devices.scroll_devices` Scroll Devices read
- `carbon_black_cloud.devices.search_devices` Search Devices read
- `carbon_black_cloud.devices.specific_device_information` Specific Device Information read
- `carbon_black_cloud.devices.device_actions` Device Actions destructive

**Live query templates 5**

- `carbon_black_cloud.live_query_templates.create_live_query_template` Create Live Query Template write
- `carbon_black_cloud.live_query_templates.edit_live_query_template_by_id` Edit Live Query Template by ID write
- `carbon_black_cloud.live_query_templates.retrieve_live_query_template_by_id` Retrieve Live Query Template by ID read
- `carbon_black_cloud.live_query_templates.search_live_query_templates` Search Live Query Templates read
- `carbon_black_cloud.live_query_templates.delete_query_schedule_by_id` Delete Query Schedule by ID destructive

Observations **5** Policies **5** Usb blocks **5** Usb devices **5** Users **5** Appliances **4** Cis bundles **4** Container policies **4** Container templates **4** Cve **4** Jobs **4** Policy rules **4** Alert notes **3** Asset group members **3** Asset group queries **3** Audit logs **3** Bypass rules **3** Container inventory **3** Container scan logs **3** Core prevention **3** Feed search **3** Grouped alerts **3** Policy rule configs **3** Process events **3** Threat tags **3** Alert workflow **2** Auth event details **2** Auth event facets **2** Cis devices **2** Cis settings **2** Container rules **2** Observation details **2** Observation facets **2** Process watchlist **2** Recommendations **2** Differential analysis **1** Scripts **1** Sensor lifecycle **1** Threat hunts **1** Threat metadata **1** Usb products **1**

This index shows a sample of each area. All 390 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The VMware Carbon Black Cloud MCP server, answered.

**Is there a VMware Carbon Black Cloud MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 390 VMware Carbon Black Cloud actions across watchlists, cloud accounts, feeds and data forwarders, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by VMware Carbon Black Cloud.

**What do I need to connect VMware Carbon Black Cloud?**

Carbon Black Cloud API ID and Carbon Black Cloud API Secret Key for the same API ID (API Credentials on the key's row). Plus your host and your org key. The free call account { op: "connections.requirements", service: "carbon_black_cloud" } lists exactly what to paste.

**Can an AI agent delete or change things in VMware Carbon Black Cloud?**

Only if its key allows it, and only with an explicit confirmation. 54 VMware Carbon Black Cloud actions are destructive, including delete User, delete Policy and delete Feed. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my VMware Carbon Black Cloud API limit?**

actionlake paces every call to the limits in the VMware Carbon Black Cloud service file: 100 calls a second per connection. Repeated reads are answered from cache (221 VMware Carbon Black Cloud actions can be), which never reaches VMware Carbon Black Cloud.

**What does a VMware Carbon Black Cloud action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (390 VMware Carbon Black Cloud actions page). Cache hits, searches, dry runs and calls VMware Carbon Black Cloud refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which VMware Carbon Black Cloud API does it cover?**

The VMware Carbon Black Cloud (Broadcom) platform, Endpoint Standard, Enterprise EDR, Audit and Remediation, Workload and Container APIs API Carbon Black Cloud REST APIs (Alerts v7, Devices v6, Policy Service v1, Investigate v2, Watchlist Manager v3, Feed Manager v2, Live Query v1, Asset Groups v1, Vulnerability Assessment v1, CIS Benchmarks v1, Containers v1/v1beta) at your VMware Carbon Black Cloud instance's API base URL, which you enter when connecting. It is built from VMware Carbon Black Cloud's documentation as read on 23 October 2026. 390 actions in 71 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my VMware Carbon Black Cloud data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your VMware Carbon Black Cloud credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like VMware Carbon Black Cloud

Shares the most action names with

- [Panther 9](https://actionlake.com/connectors/panther)
- [OneLogin 9](https://actionlake.com/connectors/onelogin)
- [Palo Alto Networks Strata Cloud Manager / Prisma Access 6](https://actionlake.com/connectors/palo-alto-networks-strata-cloud-manager-prisma-access)
- [Expel Workbench 5](https://actionlake.com/connectors/expel-workbench)
- [Zscaler Internet Access (ZIA) 4](https://actionlake.com/connectors/zscaler-internet-access-zia)
- [Bitsight 4](https://actionlake.com/connectors/bitsight)

Joins with, on shared entities

- [ThreatDown Nebula 3](https://actionlake.com/connectors/threatdown-nebula)
- [ThreatDown OneView 3](https://actionlake.com/connectors/threatdown-oneview)
- [Sophos Central 3](https://actionlake.com/connectors/sophos-central)
- [DNSFilter 3](https://actionlake.com/connectors/dnsfilter)
- [Wazuh 3](https://actionlake.com/connectors/wazuh)
- [Bitdefender GravityZone 3](https://actionlake.com/connectors/bitdefender-gravityzone)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by VMware Carbon Black Cloud; the name is the vendor's own. Counts are from the VMware Carbon Black Cloud service file, version 1.0.0.

## Give your agent VMware Carbon Black Cloud today.

[Connect VMware Carbon Black Cloud free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/vmware-carbon-black-cloud
More: https://actionlake.com/llms.txt