Cisco Umbrella MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| AUTH_MODE | No | Authentication mode: 'env' (default, reads the vars above) or 'gateway' (credentials arrive per-request via X-CiscoUmbrella-* headers). | env |
| LOG_LEVEL | No | Log level: debug | info (default) | warn | error. | info |
| MCP_TRANSPORT | No | Transport type: 'stdio' (default) or 'http'. | stdio |
| CONDUIT_S2S_SECRET | No | When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request. | |
| CISCOUMBRELLA_API_KEY | No | API Key from the Umbrella admin console. | |
| CISCOUMBRELLA_API_SECRET | No | API Secret paired with the API Key. Shown only once at creation. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| umbrella_list_networksA | List Cisco Umbrella networks (public IP identities) registered to this organization. |
| umbrella_list_internal_networksA | List internal (RFC1918) networks registered for internal-network identities. |
| umbrella_list_sitesB | List Umbrella sites (logical groupings of virtual appliances/internal networks). |
| umbrella_list_virtual_appliancesA | List all Umbrella virtual appliances (on-prem DNS forwarders) and their status. |
| umbrella_list_roaming_computersA | List all roaming computers enrolled via the Umbrella roaming client. |
| umbrella_get_internal_domainsA | Get all internal domains configured to bypass Umbrella DNS resolution. |
| umbrella_list_rolesA | List all administrative roles available in this Umbrella organization. |
| umbrella_list_usersB | List all admin console users for this Umbrella organization. |
| umbrella_get_userB | Get a specific Umbrella admin console user by user ID. |
| umbrella_list_api_keysB | List all API keys configured for this Umbrella organization. |
| umbrella_list_destination_listsA | List all destination lists (allow/block lists) configured for this Umbrella organization. |
| umbrella_list_destinationsA | List the destinations (domains/URLs/IPs) contained in a specific destination list. |
| umbrella_top_destinationsB | Report of the most-requested destinations (domains) over a time range, optionally broken down by traffic type. |
| umbrella_total_requestsA | Total DNS/proxy/firewall request counts over a time range, optionally broken down by traffic type. |
| umbrella_top_categoriesC | Report of the most-requested content/security categories over a time range. |
| umbrella_activityC | Raw activity (request-level) log over a time range, optionally broken down by traffic type. |
| umbrella_identitiesA | List identities (roaming computers, networks, mobile devices, AD users) with traffic summaries, filtered by one or more identity types. |
| umbrella_appdiscovery_applicationsC | List cloud applications discovered in this organization's traffic (App Discovery). |
| umbrella_appdiscovery_app_identitiesB | List the identities (users/devices) observed using a specific discovered application. |
| umbrella_appdiscovery_app_riskA | Get risk details for a specific discovered application. Cisco's own Postman collection lists this endpoint under both "App Details" and "App Risk Details" - they are the same URL. |
| umbrella_api_usage_summaryC | Summary of this organization's Umbrella API usage over a date range. |
| umbrella_api_usage_requestsC | Detailed API request log over a date range. |
| umbrella_api_usage_responsesC | Detailed API response log over a date range. |
| umbrella_api_usage_keysB | API usage broken down by API key over a date range. |
| umbrella_domain_categorizationC | Get the content/security categorization for a domain. |
| umbrella_domain_risk_scoreC | Get Cisco's risk score for a domain (higher = riskier). |
| umbrella_domain_security_scoreB | Get detailed security scoring signals for a domain (DGA score, perplexity, entropy, Secure Rank, etc). |
| umbrella_top_most_seen_domainsA | Get Cisco's list of the top million most globally-popular domains. |
| umbrella_get_samplesA | Get malware/file samples associated with a domain, IP, or URL. |
| umbrella_domain_volumeB | Get DNS query volume over time for a domain. |
| umbrella_domain_resource_recordsB | Get passive DNS resource records (historical DNS resolutions) for a domain. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 31 tools
Most tools are tied to distinct Umbrella entities, but several clusters overlap: umbrella_identities overlaps with the individual network/roaming-computer listers, the four api_usage_* tools are near-variants of the same log, and the domain risk/security/categorization lookups can be confused. Descriptions disambiguate most cases, but an agent will need to read carefully.
All tools share the umbrella_ prefix and consistent snake_case, with recognizable list_/get_/top_ verbs in most entries. The domain_* and appdiscovery_* names are noun-style rather than verb-first, but the resource grouping is predictable.
31 tools is over the 25-tool comfort threshold and will bloat the tool picker even though they are grouped logically. Several families (api_usage_*, appdiscovery_*, domain_*) could be consolidated into fewer parameterized tools.
Read-only coverage is broad: networks, identities, appliances, reports, app discovery, API usage, and domain intelligence are all represented. However, the entire surface is list/get/report-oriented; there are no create/update/delete operations for destination lists, users, networks, or sites, so management workflows dead-end.