Skip to content
actionlake
Start free

Connectors · MSP & PSA

WithSecure Elements MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to WithSecure Elements and the rest of your systems. It gives your agent 64 WithSecure Elements actions (21 reads, 29 writes and 14 that wait for a confirmation) and holds the WithSecure Elements credential itself, so the agent never does. It paces WithSecure Elements's limits and records every call.

Connect WithSecure Elements freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "withsecure_elements.devices.list",  intent: "check which WithSecure Elements account is connected"}# Query devices · read · 1 upstream call
  • 64actionsin one signed file
  • 21readlook, never change
  • 29writecreate and update
  • 14wait for a yesdestructive, confirmed first

Set up

Connect WithSecure Elements in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect WithSecure Elements.

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idWithSecure Elements API client ID
    • client_secretWithSecure Elements API client secret (shown once when the API client is created)
    account { op: "connections.requirements", service: "withsecure_elements" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "withsecure_elements.devices.list" }# query devices · read · 1 upstream callcheck { action: "withsecure_elements.api_keys.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

WithSecure Elements at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Limits we pace to
300 calls a minute, per connection
API covered
WithSecure Elements API 1.0.0 (OpenAPI 3.0.3)api.connect.withsecure.com
Built from
WithSecure Elements's documentation, read 23 October 2026connect.withsecure.comconnect.withsecure.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
17 of 21 reads, for up to 5 minutes; a write clears what it affects
Shared entities
4, so ask can line WithSecure Elements up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in WithSecure Elements.

64 actions in 19 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 21readlook, never change
  • 29writecreate and update
  • 14destructivewait for a confirmation

  1. Response actions

    34

    1 read · 23 write · 10 destructive

    Get status of response actions · Enumerate running processes · List scheduled tasks · Enumerate WMI persistence mechanisms

  2. Devices

    4

    2 read · 1 write · 1 destructive

    Query devices · Update devices · Delete devices · Query devices (aggregations)

  3. Invitations

    4

    1 read · 2 write · 1 destructive

    List invitations · Send new device invitations · Renew and resend invitations · Delete invitations

  4. API keys

    3

    1 read · 1 write · 1 destructive

    List API keys · Create API key · Delete API key

  5. Security events

    3

    3 read · 0 write · 0 destructive

    Read list of security events (deprecated) · Query security events (aggregations) · Query security events

  6. Device operations

    2

    1 read · 0 write · 1 destructive

    List device operations · Trigger remote operations on devices

  7. Incidents

    2

    1 read · 1 write · 0 destructive

    List BCDs (incidents) · Update status of BCDs

  8. Audit logs

    1

    1 read · 0 write · 0 destructive

    List audit logs

11 more areas · 11 actions
  • Databases 1
  • Exposure identities 1
  • Incident comments 1
  • Incident detections 1
  • Incident updates 1
  • Missing updates 1
  • Organizations 1
  • Profiles 1
  • Response action tasks 1
  • Software installations 1
  • Whoami 1

Top actions

The WithSecure Elements API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 18 of WithSecure Elements's 18 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
withsecure_elements.devices.listQuery devicesQuery devices.readdevice.endpoint.list65 connectors
withsecure_elements.security_events.listRead list of security events (deprecated)Read list of security events (deprecated).readmonitoring.alert.list51 connectors
withsecure_elements.whoami.getGet current user informationGet current user information.readidentity.current_user.get307 connectors
withsecure_elements.api_keys.listList API keysList API keys.readidentity.api_key.list96 connectors
withsecure_elements.incidents.listList BCDs (incidents)List BCDs (incidents).readmonitoring.incident.list19 connectors
withsecure_elements.audit_logs.listList audit logsList audit logs.readidentity.audit_event.list51 connectors
withsecure_elements.invitations.listList invitationsList invitations.readidentity.invitation.list33 connectors
withsecure_elements.api_keys.createCreate API keyCreate API key.writeidentity.api_key.create100 connectors
withsecure_elements.invitations.createSend new device invitationsSend new device invitations.writeidentity.invitation.create41 connectors
withsecure_elements.organizations.listList organizationsList organizations.readplatform.tenant.list70 connectors
withsecure_elements.devices.updateUpdate devicesUpdate devices.writedevice.endpoint.update23 connectors
withsecure_elements.devices.deleteDelete devicesDelete devices.destructivedevice.endpoint.delete35 connectors

Try it

Prompts to paste into Claude.

Each one names the WithSecure Elements actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Which WithSecure Elements incidents are open, and how long has each been open?

    callswithsecure_elements.incidents.list

  2. Writewrite

    Create API key in WithSecure Elements. Show me exactly what you will send before you save it.

    callswithsecure_elements.api_keys.create

Governance for WithSecure Elements

Destructive actions wait for a yes.

14 WithSecure Elements actions are destructive. These are all of them:

  • Delete deviceswithsecure_elements.devices.delete
  • Delete API keywithsecure_elements.api_keys.delete
  • Delete invitationswithsecure_elements.invitations.delete
  • Execute response action (deprecated)withsecure_elements.response_actions.create
  • Trigger remote operations on deviceswithsecure_elements.device_operations.create
  • Reset Microsoft Entra passwordwithsecure_elements.response_actions.execute_reset_password
  • Delete registry key or valuewithsecure_elements.response_actions.execute_delete_registry
  • Delete Windows servicewithsecure_elements.response_actions.execute_delete_services
  • Terminate threadwithsecure_elements.response_actions.execute_terminate_thread
  • Block user access in Microsoft Entrawithsecure_elements.response_actions.execute_block_user_access
  • Terminate processwithsecure_elements.response_actions.execute_terminate_process
  • End Microsoft Entra sessionwithsecure_elements.response_actions.execute_end_current_session
  • Delete scheduled taskwithsecure_elements.response_actions.execute_delete_scheduled_tasks
  • Delete WMI persistence objectswithsecure_elements.response_actions.execute_delete_wmi_persistence

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dowithsecure_elements.devices.deleteconfirm_policy: human

Delete devices?

intent: the user asked me to delete devices

run suspended · waiting for a named person · key withsecure-elements-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "withsecure-elements-agent",  allowed_actions: ["withsecure_elements.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "withsecure_elements.devices.delete", approver: "[email protected]" },    { match: "withsecure_elements.api_keys.delete", approver: "[email protected]" },    { match: "withsecure_elements.invitations.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to WithSecure Elements only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What WithSecure Elements costs on actionlake.

Every WithSecure Elements action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call WithSecure Elements refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 64 WithSecure Elements actions
  • 15actions pageeach page of a long list is one call
  • 17reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every WithSecure Elements action.

64 actions by area: the id your agent calls, what it does, and its effect.

Response actions34
  • withsecure_elements.response_actions.createExecute response action (deprecated)destructive
  • withsecure_elements.response_actions.execute_block_user_accessBlock user access in Microsoft Entradestructive
  • withsecure_elements.response_actions.execute_delete_registryDelete registry key or valuedestructive
  • withsecure_elements.response_actions.execute_delete_scheduled_tasksDelete scheduled taskdestructive
  • withsecure_elements.response_actions.execute_delete_servicesDelete Windows servicedestructive
  • withsecure_elements.response_actions.execute_delete_wmi_persistenceDelete WMI persistence objectsdestructive
  • withsecure_elements.response_actions.execute_end_current_sessionEnd Microsoft Entra sessiondestructive
  • withsecure_elements.response_actions.execute_enumerate_processesEnumerate running processeswrite
  • withsecure_elements.response_actions.execute_enumerate_scheduled_tasksList scheduled taskswrite
  • withsecure_elements.response_actions.execute_enumerate_wmi_persistenceEnumerate WMI persistence mechanismswrite
  • withsecure_elements.response_actions.execute_full_memory_dumpCreate full memory dumpwrite
  • withsecure_elements.response_actions.execute_map_file_systemList file system structurewrite
  • withsecure_elements.response_actions.execute_map_registryList registry keys and valueswrite
  • withsecure_elements.response_actions.execute_netstatRetrieve network connectionswrite
  • withsecure_elements.response_actions.execute_process_memory_dumpRetrieve process memory dumpwrite
  • withsecure_elements.response_actions.execute_reset_passwordReset Microsoft Entra passworddestructive
  • withsecure_elements.response_actions.execute_retrieve_amcacheRetrieve amcache fileswrite
  • withsecure_elements.response_actions.execute_retrieve_antivirus_logsRetrieve antivirus logswrite
  • withsecure_elements.response_actions.execute_retrieve_browser_artefactsRetrieve browser artifactswrite
  • withsecure_elements.response_actions.execute_retrieve_event_log_filesRetrieve Windows event log fileswrite
  • withsecure_elements.response_actions.execute_retrieve_event_log_tracingRetrieve event log tracing fileswrite
  • withsecure_elements.response_actions.execute_retrieve_filesRetrieve files from devicewrite
  • withsecure_elements.response_actions.execute_retrieve_jump_listRetrieve jump list fileswrite
  • withsecure_elements.response_actions.execute_retrieve_log_entriesRetrieve Windows event log entrieswrite
  • withsecure_elements.response_actions.execute_retrieve_mbrRetrieve master boot recordwrite
  • withsecure_elements.response_actions.execute_retrieve_mftRetrieve master file tablewrite
  • withsecure_elements.response_actions.execute_retrieve_prefetchRetrieve prefetch fileswrite
  • withsecure_elements.response_actions.execute_retrieve_rdp_cacheRetrieve RDP cache fileswrite
  • withsecure_elements.response_actions.execute_retrieve_recently_accessedRetrieve recently accessed fileswrite
  • withsecure_elements.response_actions.execute_retrieve_registry_hivesRetrieve registry hive fileswrite
  • withsecure_elements.response_actions.execute_retrieve_srumdbRetrieve SRUM databasewrite
  • withsecure_elements.response_actions.execute_terminate_processTerminate processdestructive
  • withsecure_elements.response_actions.execute_terminate_threadTerminate threaddestructive
  • withsecure_elements.response_actions.listGet status of response actionsread
Devices4
  • withsecure_elements.devices.aggregateQuery devices (aggregations)read
  • withsecure_elements.devices.deleteDelete devicesdestructive
  • withsecure_elements.devices.listQuery devicesread
  • withsecure_elements.devices.updateUpdate deviceswrite
Invitations4
  • withsecure_elements.invitations.createSend new device invitationswrite
  • withsecure_elements.invitations.deleteDelete invitationsdestructive
  • withsecure_elements.invitations.listList invitationsread
  • withsecure_elements.invitations.resend_or_renewRenew and resend invitationswrite
API keys3
  • withsecure_elements.api_keys.createCreate API keywrite
  • withsecure_elements.api_keys.deleteDelete API keydestructive
  • withsecure_elements.api_keys.listList API keysread
Security events3
  • withsecure_elements.security_events.aggregateQuery security events (aggregations)read
  • withsecure_elements.security_events.listRead list of security events (deprecated)read
  • withsecure_elements.security_events.queryQuery security eventsread
Device operations2
  • withsecure_elements.device_operations.createTrigger remote operations on devicesdestructive
  • withsecure_elements.device_operations.listList device operationsread
Incidents2
  • withsecure_elements.incidents.listList BCDs (incidents)read
  • withsecure_elements.incidents.updateUpdate status of BCDswrite
Audit logs1
  • withsecure_elements.audit_logs.listList audit logsread
Databases1
  • withsecure_elements.databases.latest_versionsGet the latest version information for databasesread
Exposure identities1
  • withsecure_elements.exposure_identities.listQuery identitiesread
Incident comments1
  • withsecure_elements.incident_comments.createAdd comment to BCDswrite
Incident detections1
  • withsecure_elements.incident_detections.listList detections for given BCD in organization scoperead
Incident updates1
  • withsecure_elements.incident_updates.listGet BCD update historyread
Missing updates1
  • withsecure_elements.missing_updates.listQuery missing software updatesread
Organizations1
  • withsecure_elements.organizations.listList organizationsread
Profiles1
  • withsecure_elements.profiles.listList profilesread
Response action tasks1
  • withsecure_elements.response_action_tasks.listGet response action tasksread
Software installations1
  • withsecure_elements.software_installations.listCount installed software updatesread
Whoami1
  • withsecure_elements.whoami.getGet current user informationread

Questions

The WithSecure Elements MCP server, answered.

Is there a WithSecure Elements MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 64 WithSecure Elements actions across response actions, devices, invitations and API keys, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by WithSecure Elements.

What do I need to connect WithSecure Elements?

WithSecure Elements API client ID and WithSecure Elements API client secret (shown once when the API client is created). The free call account { op: "connections.requirements", service: "withsecure_elements" } lists exactly what to paste.

Can an AI agent delete or change things in WithSecure Elements?

Only if its key allows it, and only with an explicit confirmation. 14 WithSecure Elements actions are destructive, including delete devices, delete API key and delete invitations. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my WithSecure Elements API limit?

actionlake paces every call to the limits in the WithSecure Elements service file: 300 calls a minute per connection. Repeated reads are answered from cache (17 WithSecure Elements actions can be), which never reaches WithSecure Elements.

What does a WithSecure Elements action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (15 WithSecure Elements actions page). Cache hits, searches, dry runs and calls WithSecure Elements refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which WithSecure Elements API does it cover?

The WithSecure Elements API 1.0.0 (OpenAPI 3.0.3) at api.connect.withsecure.com. It is built from WithSecure Elements's documentation as read on 23 October 2026. 64 actions in 19 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my WithSecure Elements data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your WithSecure Elements credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like WithSecure Elements

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by WithSecure Elements; the name is the vendor's own. Counts are from the WithSecure Elements service file, version 1.0.0.

Give your agent WithSecure Elements today.

Connect WithSecure Elements freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.