Action1 MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ACTION1_REGION | No | The Action1 region. Valid values are `north_america` (default), `europe`, or `australia`. | north_america |
| ACTION1_CLIENT_ID | Yes | The Action1 API client ID / API key (e.g. api-key-xxxx@action1.com), created in the Action1 console under Configuration → API Credentials. | |
| ACTION1_CLIENT_SECRET | Yes | The Action1 API client secret associated with the API key. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_organizationsA | List all organizations. Call this first to get the org_id other tools need. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| searchC | Full-text search across endpoints, software, etc. in an organization. |
| list_endpointsA | List all managed endpoints (computers) in an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| get_endpointC | Get full details of one endpoint. |
| get_endpoint_statusB | Connected/disconnected/pending endpoint counts for an organization. |
| get_endpoint_missing_updatesA | List updates missing on one endpoint. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_endpoint_installed_softwareA | List software installed on one endpoint. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_endpoint_groupsA | List endpoint groups in an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_endpoint_group_membersA | List endpoints in an endpoint group. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_missing_updatesA | List missing OS/third-party updates across an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_update_missing_endpointsA | List endpoints missing a specific update package version. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_vulnerabilitiesA | List vulnerabilities (CVEs) detected in an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| get_vulnerabilityC | Get details of one CVE in an organization. |
| list_vulnerability_endpointsA | List endpoints affected by a CVE. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_automation_schedulesA | List automation schedules in an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_automation_instancesA | List automation runs (instances) in an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_automation_instance_endpoint_resultsA | Per-endpoint results of one automation run. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_reportsA | List available reports and report categories. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_report_dataA | Get the rows of a report for an organization. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_usersA | List console users. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_rolesA | List roles. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| get_enterprise_usageC | Enterprise-wide license/endpoint usage. |
| get_report_or_categoryC | Get a report (or category) definition by id. |
| list_report_errorsA | Endpoints where a report's data source script failed, with the error. Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| list_data_sourcesA | List data sources (PowerShell scripts agents run to feed reports). Returns one page {total, offset, has_more, items} (limit default 20, max 200). |
| get_data_sourceB | Get a data source including its script_text and columns. |
| requery_reportC | Ask agents to re-run the report's data source script now. |
| delete_custom_reportC | Delete a custom report. |
| delete_data_sourceA | Delete a data source (delete reports that use it first). |
| stop_automation_instanceB | Stop a running automation (e.g. a deploy_updates or run_script run). |
| publish_checkA | Publish a PowerShell script as an Action1 data source and (if report_name is given) a custom report showing its columns. Pass data_source_id to update an existing data source in place - reports built on it pick up new columns automatically. |
| run_scriptA | Run a PowerShell script now, as SYSTEM, on the given endpoints (ids from list_endpoints) and wait up to wait_seconds for results. Returns each endpoint's status and output (stdout, capped at ~10,000 chars by Action1). Never reboots. Offline endpoints stay pending - check later with list_automation_instance_endpoint_results(instance_id). |
| deploy_updatesA | Install updates now on the given endpoints. packages maps a package id (the |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 33 tools
Most tools target clearly distinct resources and actions, but there is a cluster of easily confusable update-related tools (list_missing_updates, list_update_missing_endpoints, get_endpoint_missing_updates) whose boundaries rely on reading descriptions carefully. The report/data-source tools are also numerous and slightly overlapping. A few oddballs like publish_check (which actually publishes a script) and requery_report are less self-explanatory.
Naming is predominantly consistent snake_case verb_noun (list_*, get_*, delete_*, stop_*), which is easy to predict. A handful of deviations (search, publish_check, requery_report, deploy_updates, run_script) break the pattern slightly but remain readable. Overall convention is stable.
33 tools is on the heavy side and exceeds the comfortable range for a single agent surface, risking selection overload. However, the breadth of the domain (endpoints, vulnerabilities, updates, automation, reports, users/roles) means most tools do correspond to a real operation. Borderline but defensible given the platform's scope.
The surface covers discovery, read, and key write/action operations (run_script, deploy_updates, requery_report, delete_data_source, delete_custom_report) plus lifecycle paging. Some gaps exist: no create/update for users or roles, no delete for automations (only stop), and limited report authoring beyond publish_check. Core workflows are nonetheless covered.