Retrieve Automox audit trail events performed by a user on a specific date.

Query OCSF-formatted audit events from the Automox Audit Service v2. Filter by date (required) and event type name. The category_name filter is applied client-side against the event type_name prefix: the upstream events do NOT carry a category_name field, only an integer category_uid that maps 1:N across categories, so category filtering matches the type_name label prefix (authentication/entity_management/web_resource_activity are live-verified prefixes; account_change/user_access are spec-derived and unverified live). An unmappable category token leaves results unfiltered and sets metadata.applied_filters.category_name_matched=false (so an empty result is never mistaken for 'no activity'); metadata.events_before_filter reports the unfiltered count. category_uid/type_uid/class_uid/activity_id are raw OCSF taxonomy integers with no decode table in the upstream spec — prefer the human-readable sibling strings type_name and activity. Uses cursor-based pagination for large result sets. Event time is an ISO 8601 UTC string (converted from the upstream epoch-seconds value). The date parameter selects events by event date; the timezone of that date boundary is not stated by the upstream spec (unverified). severity/status labels follow the OCSF scales (severity: informational/low/medium/high/critical/fatal; status: success/failure/other) and are filled from severity_id/status_id when the upstream omits the string. Permissions: as of 2025-10-27 the upstream endpoint requires the API key to have BOTH organization:manage and users:read scopes; keys missing either scope return 403.

List devices with detailed per-device information including hostname, OS, policy status, and patch status. Use this to explore and investigate specific devices, optionally filtered by management/policy status. For aggregate statistics and health metrics, use device_health_metrics instead.

Return detailed information and recent activity for a device. Includes a compliance rollup (per-policy status counts: up_to_date / pending / needs_remediation, plus the policies needing remediation — only needs_remediation policies make a device non-compliant). uptime_minutes is sampled at the device's last full scan, so it can lag the current boot session.

Surface Automox devices flagged for immediate action.

Search Automox devices by hostname (including custom name), IP, tag, severity of missing patches, or patch status (only 'missing' is supported). The severity filter is passed upstream to scope the result set (the requested values are echoed in metadata.filters.severity); it narrows the candidate set but does NOT guarantee every returned device currently has an outstanding patch at that severity (live, ~41% of severity=critical results report zero outstanding patches — likely already remediated or reassessed since the index was built). Per-device pending_patches is the device's total outstanding-patch count and is NOT scoped to the severity filter, so do not read it as the count matching the requested severity.

Aggregate organization-wide device health statistics including managed/unmanaged breakdown, device status breakdown, compliance metrics, and check-in recency analysis. Compliance follows the platform rule: a device is non-compliant only when at least one policy needs remediation — pending work is tracked separately as devices_with_pending_policies. Use this for monitoring dashboards and getting a fleet-wide health overview.

Retrieve detailed device inventory data including hardware, network, security, services, system, and user information. Optionally filter by category. Uses the Console API device-details endpoint.

List available inventory categories for a device. Categories are dynamic per device. Use this to discover what inventory data is available before requesting specific categories.

Issue an immediate command to a device (scan, patch, or reboot).

Apply bulk attribute actions to many devices at once (up to 500). Currently supports tag apply/remove via actions like {'attribute': 'tags', 'action': 'apply', 'value': ['env:prod']}.

Update a single device's mutable attributes: custom_name, server_group_id, exception (policy-enforcement exclusion), tags, and ip_addrs. Fills the single-device gap that batch_update_devices (tags-only, bulk) does not cover — e.g. renaming a device or moving it to a server group. Supply only the fields you want to change; at least one is required.

List saved device searches from the Advanced Device Search API. Returns saved search names, queries, and metadata.

Execute an advanced device search using the Automox Advanced Device Search API's structured query language. Enables complex queries like 'find all Windows devices not seen in 30 days' or 'devices with nginx installed' using field-based filtering. Pass query as a dict with a filters list of AND/OR groups, each a list of conditions: {"filters": [{"AND": [{"scope": "SOFTWARE", "field": "pkgDisplayName", "operator": "IN", "values": ["nginx"]}]}]}. Tag search uses scope TAGS (not DEVICE): {"scope": "TAGS", "field": "tag", "operator": "IN", "values": ["Nginx"]}. Use get_searchable_fields for valid scope/field/operator combos and device_search_typeahead to discover values. The org is scoped automatically. limit sets the page size. On each returned device, outstanding_patch_severity distinguishes the string 'none' (assessed, no outstanding patches — clean) from JSON null/absent (device not yet assessed — unknown, NOT clean); see metadata.field_notes.outstanding_patch_severity. Use an org-scoped API key — global/account keys are unreliable on this endpoint and often return HTTP 403.

Get typeahead suggestions for device search fields. Useful for discovering valid values when building advanced device queries.

Get available fields for device queries. Returns the field names and types supported by the advanced device search API.

Get device-to-policy and device-to-group assignments.

Get the near-raw device payload by UUID (canonical /servers endpoint). Integer policy codes carry a status_label sibling (up_to_date / pending / needs_remediation — only needs_remediation makes a device non-compliant; see the compliance rollup). uptime_minutes is sampled at the device's last full scan, so it can lag the current boot session.

Retrieve a single saved device search by ID. Returns the saved search name, description, query, and metadata.

Execute a saved device search and retrieve its current device result set. Supports pagination via page + limit.

Retrieve cached server-side results for a previously-executed device search, keyed by search execution ID. Distinct from get_saved_search_results which re-executes a saved-search definition.

List available device-search scope options. Org-independent metadata describing the scopes (e.g., device, group, org) supported by the Advanced Device Search API.

List searchable device fields grouped by scope, with per-field type metadata. Richer than get_device_metadata_fields (a flat field-name array) — use this to construct typed advanced-search queries.

List the saved device searches whose result set currently contains a given device (by UUID). Triage primitive: 'which saved searches does this device match?' Optionally filter by saved-search type.

Execute a saved device search by UUID and return its device results, with paging (page/size) and an optional fields projection. Lighter-weight than get_saved_search_results when you only need a subset of fields.

Create a new saved device search. Provide a name, a structured query dict carrying a filters list (same syntax as advanced_device_search — e.g. {"filters": [{"AND": [{"scope": "SOFTWARE", "field": "pkgDisplayName", "operator": "IN", "values": ["nginx"]}]}]}), and an optional description. The org is scoped automatically.

Update an existing saved device search (partial update). Provide at least one of name, query, or description. The query dict uses the Automox Advanced Device Search API query syntax (see advanced_device_search).

Permanently delete a saved device search by ID.

Bulk-assign one or more policies to the result set of a saved device search. Takes the saved-search UUID and a list of policy IDs.

Force a re-cache of a saved device search's results when they may be stale. Triggers server-side recomputation; returns once queued.

Summarize recent Automox policy activity. status_breakdown counts RUNS by overall result; the 'no_success_or_failure' bucket means every device was pending/not_included/remediation_not_applicable (a benign no-op or still in progress), not an error.

Review recent executions for a policy. Each execution's device_outcomes are device counts per outcome (not run statuses); a run with no successes or failures but pending/not_included/remediation_not_applicable completed as a benign no-op or is still in progress, not a failure.

Retrieve per-device results and output for a specific policy execution token. exit_code is the raw process exit code from the policy script (0 = success; negative values on Windows are NTSTATUS codes as signed 32-bit ints, e.g. -1073741502 = 0xC0000142); result_status is the lowercase per-device outcome string.

List Automox policies with type and status summaries. schedule_days is a bitmask (decoded alongside as schedule_days_decoded); schedule_time is a bare HH:MM string with no timezone marker — device-local vs. org time depends on policy configuration, so the timezone cannot be inferred from this field alone.

Retrieve configuration and recent history for a policy.

Retrieve per-policy compliance statistics for the organization. compliance_rate_percent is computed over evaluated devices (compliant + noncompliant) and is null when none have been evaluated; pending devices do not count against compliance and are reported separately via pending_devices / pending_rate_percent over all targeted devices.

Summarize patch approvals awaiting decision. Each approval covers one software package (title, software.version/os_family, CVE ids under cves) for a specific policy; manual_approval is true = approved, false = rejected, null = awaiting decision. The upstream record has no severity field, so severity_breakdown buckets approvals without one as 'unspecified' — use the CVE ids to judge urgency.

Dry-run: preview which devices a policy's targeting would resolve to, before creating or updating the policy. Read-only — nothing is created or changed. server_groups is REQUIRED when device_filters is provided (the upstream preview cannot evaluate a filter-only target): pass the groups the policy will be assigned to, and the device_filters clauses ({field, op, value}) are applied within that scope.

List the devices currently targeted by one or more policies (by policy UUID) — blast-radius assessment before executing or changing a policy. Read-only.

Approve or reject an Automox patch approval request.

Permanently delete an Automox policy by ID.

Clone an existing Automox policy. By default creates an in-org copy with an optional new name and server group assignments. Pass target_zone_ids to instead clone a patch policy into one or more zones/orgs in a single server-side call (patch policies only; mutually exclusive with name/server_groups).

Create or update Automox policies with automatic format correction.

Execute an Automox policy immediately for remediation (all devices or specific device).

List policy runs with time-range filtering, policy name/type filters, and result status filtering. Uses the Policy History v2 API for richer data than the standard policy execution timeline. Each run's device_outcomes (pending/success/failed/not_included/remediation_not_applicable/blocked) are DEVICE COUNTS per outcome for that run, not run statuses. result_status filters with any-device-with-this-outcome semantics: a run matches when AT LEAST ONE device had that outcome — it does NOT mean every device did (live-verified 2026-06-05: result_status='failed' returns runs with 1 failed device alongside 200+ not-failed). The same run can match multiple result_status values.

Get aggregate policy execution counts. Optionally filter by number of days to look back.

Get policy runs grouped by policy for cross-policy comparison. Shows which policies have been running and their aggregate results.

Get policy history details by UUID, including run history and status. Each run's device_outcomes are device counts per outcome, not run statuses.

Get execution runs for a specific policy by UUID. Optionally filter by number of days and sort order. Each run's device_outcomes are device counts per outcome, not run statuses.

List fleet-wide policy execution counts over a time window: one row per policy with its run count, in a single round-trip. Answers 'which policies ran most last quarter?' without per-policy calls or client-side aggregation. Distinct from policy_run_count (single aggregate) and policy_runs_for_policy (per-run records for one policy).

Get detailed per-device results for a specific policy run. Uses UUID-based queries and supports device name filtering. exit_code is the raw process exit code from the policy script (0 = success; negative values on Windows are NTSTATUS codes as signed 32-bit ints); result_status is the lowercase per-device outcome (e.g. success, failed).

Invite a user to the Automox account with optional zone assignments.

Remove a user from the Automox account by UUID.

List API keys for the Automox organization. Returns key metadata (name, enabled, expiry) only — secrets are never exposed.

List organizations visible to the API key, with device count, device limit, parent org, and trial end time. Useful for MSP/multi-org navigation, capacity posture, and trial warnings. A tier slug may be present per spec but has no defined feature ordering and is absent on some tenants — do not infer a paid-plan or capability ranking from it.

List users in the organization with name, email, and RBAC roles. Secrets (e.g. intercom_hmac) are never surfaced.

Get a single user by numeric ID, including org/server-group membership and RBAC roles. Secrets are never surfaced.

Get Automox account detail (id, name, type, timestamps).

List the RBAC roles available in the Automox account.

Get an account-scoped user record by UUID: status, account RBAC role, verification, and 2FA type. two_factor_authentication carries the literal string 'disabled' when 2FA is OFF (do NOT read it as a configured type); a null/absent value is ambiguous (may mean disabled or not-reported) — see metadata.field_notes.

List the zones (organizations) a given user belongs to.

List the zones (organizations) in the Automox account.

Get a single zone (organization) by UUID. The zone access_key is never surfaced.

List the users assigned to a given zone (by zone UUID).

List a user's API keys by user ID. Returns key metadata (name, enabled, expiry) only — secrets are never exposed.

Get one user API key by user ID and key ID. Returns metadata only — the secret is never exposed.

List global (account-scoped) API keys. Returns key metadata (name, enabled, expiry) only — secrets are never exposed.

Create a new zone (organization) in the account. The zone access_key is never surfaced.

Update a user's profile fields (firstname, lastname, email, tfa_type) by user ID. Passwords cannot be set through this tool.

Create an API key for a user. Returns metadata only — the key secret is never surfaced and cannot be retrieved via MCP.

Enable or disable a user API key by user ID and key ID.

Permanently delete a user API key by user ID and key ID.

Create a global (account-scoped) API key. Returns metadata only — the key secret is never surfaced and cannot be retrieved via MCP.

Enable or disable a global (account-scoped) API key by ID.

Permanently delete a global (account-scoped) API key by ID.

List all Automox server groups with their device counts and assigned policies. refresh_interval is the agent check-in/scan cadence in minutes (live-verified; spec range 240-1440) — see metadata.field_notes.

Get detailed information about a specific Automox server group. refresh_interval is the agent check-in/scan cadence in minutes (live-verified; spec range 240-1440) — see metadata.field_notes.

Create a new Automox server group. refresh_interval is the agent check-in/scan cadence in minutes (live-verified; spec range 240-1440).

Update an existing Automox server group. refresh_interval is the agent check-in/scan cadence in minutes (live-verified; spec range 240-1440).

Delete an Automox server group permanently.

List Automox organization events with optional filters by policy, device, user, event name, or date range. For policy/patch events, data.status is the raw process exit code (arrives as string or int): '0' = success; negative values on Windows are NTSTATUS codes as signed 32-bit ints (e.g. '-1073741502' = 0xC0000142).

Retrieve the Automox pre-patch readiness report showing devices with pending patches before the next scheduled patch window. Per-device 'highest_severity' distinguishes 'no_known_cves' (patches carry no associated CVE — benign) from 'unknown' (severity undetermined). 'compliant' follows the platform rule: a device is non-compliant only when a policy needs remediation; pending work alone does not count against it.

Retrieve the Automox non-compliant devices report showing devices that need attention due to policy failures or missing patches. Each failing policy includes 'reason_for_fail' (upstream failure text, may be truncated), 'severity', and 'type' so you can state why a device is non-compliant and prioritize across devices.

List software packages on a specific Automox device. Returns package name, version, installed (boolean install state), repo, is_managed, and severity. There is no patch-status field in the response; install state comes from the installed boolean. severity is one of critical/high/medium/low/no_known_cves or JSON null (live-verified); none/unknown exist per spec but were not observed live. JSON null means no severity assessment was recorded (not a safety claim); no_known_cves means scanned with no known CVEs. See metadata.field_notes.severity. By default returns the complete package set (auto-paginated), so it is reliable for 'is package X installed?' checks. Pass an explicit page to fetch a single page instead.

Search software packages across the Automox organization. Filter by managed status (include_unmanaged) or install state (awaiting: true = available but not installed, false = already installed -- per spec; note this is inverted from a naive reading of the word). awaiting is a request filter only, NOT a field in the response. Returns package name, version, is_managed, and severity. severity vocabulary is the same as list_device_packages: critical/high/medium/low/no_known_cves or JSON null observed live, with none/unknown present in the spec enum but unobserved. See metadata.field_notes.severity. The endpoint returns a bare list with no total, so returned_package_count is the count of packages on THIS page only (NOT a fleet-wide org total); when metadata.pagination.has_more is true, increment page to enumerate the rest.

List all available Automox webhook event types with descriptions. Use this to see which events can trigger webhook deliveries.

List all webhook subscriptions for the Automox organization. Supports cursor-based pagination.

Retrieve details for a specific Automox webhook subscription.

List recent delivery attempts (status, latency, error) for a webhook -- delivery troubleshooting. Results are newest-first and cursor-paginated; optional startDate/endDate filters.

Create a new Automox webhook subscription. The response includes a signing secret that is ONLY shown once — save it immediately. Max 5 webhooks per organization. URL must be HTTPS.

Update an existing Automox webhook. Only provided fields are changed (partial update). Can update name, URL, enabled status, or event types.

Delete an Automox webhook subscription permanently.

Send a test delivery to an Automox webhook endpoint. Returns success status, HTTP status code, and response time.

Rotate the signing secret for an Automox webhook. The old secret is immediately invalidated. Save the new secret — it is only shown once.

Search the Automox community worklet catalog. Returns worklet names, descriptions, categories, OS compatibility, and trust/availability signals (verified boolean, access tier such as premium, license_required). Catalog items have no status field. Use to discover pre-built evaluation and remediation scripts.

Get detailed information for a specific community worklet, including evaluation code, remediation code, and requirements.

List data extract jobs for the Automox organization. Returns each job's id, type (e.g. patch-history | api-activity), status, the is_completed readiness boolean, and whether a download link is available (has_download_url).

Get details for a data extract job. Returns status (per spec enum: queued | running | complete | failed | canceled | expired) and the is_completed boolean (use this for readiness). download_expires_at is the link-expiry timestamp; has_download_url=true means the CSV is currently downloadable. The presigned download URL itself is not returned to the model — retrieve it from the Automox console.

Request a new data extract for bulk reporting. Returns the extract ID and initial status.

List vulnerability remediation action sets for the organization. Shows imported vulnerability data and remediation tracking.