avanan-legacy-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Log level: debug, info, warn, error (default info). | |
| AVANAN_TOKEN | Yes | Token from the Avanan auth handshake (x-av-token). | |
| AVANAN_APP_ID | Yes | Application ID provided by Avanan Support (x-av-app-id). | |
| AVANAN_REGION | No | Region: us, eu, ca, or ap. Defaults to JWT region claim, then us. | |
| AVANAN_SECRET | Yes | Shared secret used to compute the x-av-sig HMAC. | |
| MCP_HTTP_PORT | No | HTTP transport port (default 8080). | |
| MCP_TRANSPORT | No | Transport: stdio (default) or http. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| avanan_test_connectionA | Verify the configured Avanan credentials: performs the auth handshake, lists the key's scopes, and probes an MSP endpoint to confirm the key is MSP-scoped. Run this first when MSP tools return 403. |
| avanan_list_scopesA | List the farm:tenant scopes this key can query. A customer-tenant key has one; an MSP key has one per managed customer, usable as |
| avanan_query_eventsA | Query Avanan security events (phishing, malware, DLP, anomaly, shadow IT, malicious URL). Filter by type, state, severity, SaaS, date range, or description text. Returns each event's available remediation actions. |
| avanan_get_eventA | Get full details of one security event by its Avanan event ID. |
| avanan_search_emailsC | Search secured entities (emails and SaaS objects) by platform and date range, with optional attribute filters (fromEmail, subject, recipients, isQuarantined, attachmentMd5, ...). |
| avanan_get_emailB | Get full details of one secured entity (email, file, message) by its Avanan entity ID. |
| avanan_list_exceptionsA | List whitelist or blacklist exception entries. |
| avanan_get_exceptionA | Get one whitelist or blacklist entry by its entity ID. |
| avanan_add_exceptionA | Add a whitelist or blacklist entry. Provide at least one match field (senderEmail, senderDomain, senderName, recipient, subject, attachmentMd5, linkDomains, senderIp). |
| avanan_update_exceptionB | Update an existing whitelist or blacklist entry by its entity ID. |
| avanan_delete_exceptionA | DESTRUCTIVE and irreversible: delete a whitelist or blacklist entry by its entity ID. Confirm with the user before invoking. |
| avanan_quarantine_eventsA | HIGH IMPACT: quarantine the emails behind one or more security events. Reversible with avanan_restore_events. Returns task IDs. Confirm with the user before invoking. |
| avanan_restore_eventsB | Restore previously quarantined emails behind one or more security events. Returns task IDs. |
| avanan_quarantine_emailsA | HIGH IMPACT: quarantine specific secured entities (emails) by entity ID. Reversible with avanan_restore_emails. Returns task IDs. Confirm with the user before invoking. |
| avanan_restore_emailsA | Restore specific quarantined entities (emails) by entity ID. Returns task IDs. |
| avanan_get_task_statusA | Check the state of a quarantine/restore task by the task ID an action returned. |
| avanan_list_msp_partnersA | List all associated child MSP partners under the current MSP. Returns id and name for each child MSP. |
| avanan_create_msp_partnerB | Create a new child MSP partner under the current MSP (msppartners-extended endpoint, July 2026 guide). |
| avanan_delete_msp_partnerA | Delete a child MSP partner by ID. WARNING: all tenants associated with this MSP are also deleted. |
| avanan_list_msp_usersC | List all MSP users. |
| avanan_get_msp_userA | Get a single MSP user by ID. |
| avanan_create_msp_userA | Create a new MSP user. |
| avanan_update_msp_userB | Update an MSP user by ID. All fields are required per the SmartAPI spec. |
| avanan_delete_msp_userA | Delete an MSP user by ID. |
| avanan_list_tenantsA | List all customer tenants associated with the current MSP. Each tenant entry includes domain, deployment mode, user counts, status, license package and add-ons. |
| avanan_get_tenantA | Get details of a single customer tenant by ID, including license, PoC/paid dates, user count, and expiration. |
| avanan_create_tenantB | Create a new customer tenant under the current MSP. |
| avanan_delete_tenantA | Delete a customer tenant by ID. WARNING: this deletes the tenant and all its data. |
| avanan_list_licensesA | List all available license packages (id, codeName, displayName). Use the codeName when assigning a license to a tenant. |
| avanan_list_addonsA | List all available license add-ons (id, name). Add-on IDs are used when assigning a license to a tenant. |
| avanan_assign_licenseB | Assign a license (and optional add-ons) to an existing customer tenant. |
| avanan_get_monthly_usageA | Get monthly usage details across all customer tenants for a given year/month. Returns per-day, per-tenant rows with user count, daily price, and cost. |
| avanan_get_daily_usageB | Get daily usage details across all customer tenants for a specific year/month/day. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Avanan Tenant Card | Interactive MCP Apps card rendering an Avanan MSP customer tenant |
TDQS
Scored across 33 tools
Tools are mostly grouped by clear resource domains (MSP partners, users, tenants, exceptions, events, emails). Potential confusion between query_events/search_emails and quarantine_events/quarantine_emails is mitigated by descriptions, and each tool has a distinct purpose.
All tools share the avanan_ prefix and generally follow verb_noun (list/get/update/delete/create). Minor inconsistency: query_events vs search_emails, and get_monthly_usage/get_daily_usage aren't resource-based, but the pattern is otherwise predictable.
33 tools is well above the comfortable 3-15 range. While they cover several distinct subdomains (MSP admin, tenant management, events, quarantine, usage), the surface is heavy and would benefit from consolidation or separate servers.
Most core entities have CRUD coverage: MSP users, exceptions, tenants (except update), partners (no update), plus query/search/actions. Obvious gaps include no update_tenant or update_msp_partner, and no way to list tenants by filter or fetch usage for a single tenant.