Island MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Island MCP ServerWhat compromised credentials were detected in the last week?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Island MCP Server
MCP server for Island's Enterprise Browser Management API - administrator actions, browser/session audit events, compromised-credential detections, and device inventory - for AI assistants and the WYRE Conduit gateway.
Scope: 4 read-only tools, one per documented resource group
This connector implements exactly the four resource groups Island documents for its v1 Management API: Admin Actions, Audit (Island's own endpoint name for this is timeline), Compromised Credential, and Device. Island also documents a fifth resource, User, which is deliberately out of scope for this connector (not requested; can be added as a follow-up).
Two of the four - Compromised Credential and Device - are POST-with-body operations on Island's own API rather than plain GETs. Neither mutates anything: both are filtered/searched reads that happen to take their filter parameters in a JSON body instead of a query string, the same "POST for a filtered read, not a mutation" shape this gateway's UniFi connector already uses for its ISP-metrics query tool. No tool in this connector calls a PATCH/PUT/DELETE endpoint, and none reaches Island's broader Management Console surface (policy CRUD, user/browser-configuration-policy management) - see src/client.ts, which implements only these four read operations.
Island's authoritative API reference (documentation.island.io/apidocs) redirects to an authenticated customer portal and was not accessible for this build. Endpoint paths, the Api-Key header name, the request/response shape, and the default base URL below were all confirmed independently against a different, publicly-readable source: criblpacks/cribl-island-browser-rest-io, a published third-party log-collector integration whose repository ships real, executable REST-collector job definitions (default/jobs.yml) against Island's live API - not marketing copy or a prose guess. Response body field names are not independently confirmed from any source and are passed through exactly as Island returns them (see IslandApiResponse in src/types.ts) rather than re-modeled into a guessed shape.
Related MCP server: mcp-m365-mgmt
Base URL
Every endpoint below is confirmed at a single fixed host: https://management.island.io/api, taken verbatim from that Cribl pack's island_browser_api_base_url variable, which its own five REST-collector jobs all reference. This connector uses that as the default and lets a customer override it via an optional baseUrl/ISLAND_BASE_URL field, in case a given tenant is provisioned on a different host - a second, lower-confidence source (a third-party SIEM-integration doc, prose only, not executable config) describes the host as https://api.<company>.island.io, which this connector could not independently confirm or rule out. State plainly: the fixed-host reading is the better-evidenced one and is what ships as the default; the override exists specifically to not silently break a tenant for which it's wrong.
Authentication
Island's Management API authenticates with a static API key, generated in the Island Management Console under Modules > Platform Settings > System Settings > Integrations > API > + Create. There is no OAuth flow - this connector only ever holds a live API key, sent as Island's own custom Api-Key header (not Authorization: Bearer). In gateway mode the key arrives per-request via the X-Island-Api-Key header; in local/stdio mode it's read once from ISLAND_API_KEY.
Credential scope: what "Read Only" actually restricts
Two separate claims here, at deliberately different confidence levels - don't collapse them into one "read-only" statement:
Structurally verified (checked directly, stated with full confidence): this connector's own code makes zero mutating calls. Every function in
client.tscalls one of the four read operations above; noPATCH/PUT/DELETEcall exists anywhere insrc/, and no policy/user/browser-configuration-management endpoint is referenced under any name.Vendor-documented, not independently verified (hedged deliberately): Island's API-key creation dialog offers a "Read Only" role alongside "Full Admin"/"System Admin" - so some server-side scoping evidently exists - but Island's authoritative documentation of what that role actually restricts sits behind the same customer-only login noted above, and was not accessible to confirm independently. Whether "Read Only" genuinely blocks server-side access to Island's broader Management API surface (policy CRUD, user management, browser configuration policies - none of which this connector implements or calls) versus being a UI-level label has not been tested. Do not read this connector, or this README, as having established what the underlying API key can or cannot do if a non-Read-Only role were selected - only that this connector's own code never attempts anything beyond the four reads above, regardless of which role the customer's key was issued with.
Configuration
Env var | Description |
| API key issued by the Island Management Console, sent as the |
| Optional override of the Management API base URL. Defaults to |
|
|
|
|
| When set, the HTTP transport requires a valid |
|
|
Tools
All four tools are classified isAdmin: true in the Conduit gateway - every resource group here is security/compliance-sensitive (who administrators are and what they changed, browser audit trail, detected compromised credentials, and the managed device inventory) even though every one of them is a plain read.
Admin Actions
island_list_admin_actions- list actions taken by administrators in the Island Management Console (policy changes, user/role changes) within a time window, offset-paginated.
Audit
island_list_audit_events- list browser/session audit events (navigation, file transfer, clipboard, print, policy-enforcement events) within a time window, offset-paginated. Island's own endpoint name for this istimeline.
Compromised Credential
island_list_compromised_credentials- list credentials Island has detected as compromised within a time window.POST-with-body on Island's own API (a filtered read, not a mutation - see Scope above). At least one third-party integrator's published collector config notes this endpoint's offset pagination as unreliable in practice (returning the same page regardless of offset); treatlimit/offsetas best-effort here for the same reason.
Device
island_list_devices- list devices running Island Browser under this account, optionally filtered to devices last seen at/after a given time, sortable by field.POST-with-body on Island's own API (a filtered read, not a mutation - see Scope above).
Excluded, by design
Hard-excluded (out of this connector's requested scope, not a technical block):
The User resource (
GET /external/v1/userson Island's API) - Island documents this alongside the four implemented here; not requested for this connector. Can be added as a follow-up, after a deliberate scope decision.
Hard-excluded (write/provisioning - Island's broader Management API, never implemented):
Policy create/read/update/delete, policy-element management, and browser-configuration-policy management. This connector's four tools cover only the read-only data endpoints documented for Admin Actions, Audit, Compromised Credential, and Device; it does not implement any endpoint that creates, updates, or deletes a policy, user, or browser configuration.
They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.
Development
npm install
npm run build
npm test
npm run lint # tsc --noEmitDocker
docker build -t island-mcp .
docker run -p 8080:8080 -e ISLAND_API_KEY=... island-mcpLicense
Apache-2.0
Available Tools
4 toolsisland_list_admin_actionsB
List actions taken by administrators in the Island Management Console (e.g. policy changes, user/role changes) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Inclusive upper bound, ISO 8601. Defaults to now when omitted. | |
| limit | No | Items per page. Defaults to 100. | |
| start | No | Inclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted. | |
| offset | No | Pagination offset (0-based). Defaults to 0. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full transparency burden. It discloses useful behavior: results are newest first, and omitting both start/end triggers the server-side default window. However, it does not mention pagination behavior, response shape, or access/permission considerations, leaving parts of the call behavior unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The purpose and key examples are front-loaded, followed by concise parameter guidance. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with four optional parameters and full schema coverage, the core call semantics are covered: scope, ordering, and time-window defaults. However, there is no output schema and the description does not describe the response shape or how limit/offset pagination works, so an agent must infer some behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces that start/end bound the window and that omitting both selects the server-side default, but it does not add meaning beyond the schema's own parameter descriptions. Limit and offset are left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('List actions taken by administrators') and the resource scope (Island Management Console) with concrete examples such as policy changes and user/role changes. It is distinguishable from siblings like island_list_devices, though it does not explicitly contrast with island_list_audit_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives operational direction for the time window ('Use start/end to bound the window; omit both...'), but it does not explain when to choose this tool over island_list_audit_events or other siblings. No alternatives or exclusions are mentioned, so when-to-use guidance is mostly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
island_list_audit_eventsA
List browser/session audit events from Island's timeline (e.g. navigation, file transfer, clipboard, print, and policy-enforcement events) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Inclusive upper bound, ISO 8601. Defaults to now when omitted. | |
| limit | No | Items per page. Defaults to 100. | |
| start | No | Inclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted. | |
| offset | No | Pagination offset (0-based). Defaults to 0. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and does disclose meaningful traits: results are newest-first and the time window defaults server-side when both bounds are omitted. 'List' also implies a read-style operation. It doesn't cover auth or rate limits, but the disclosed behavior is sufficient for a read-only timeline query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: purpose and examples come first, followed by parameter guidance. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-optional-parameter list tool with richly described schema fields and no output schema, the description covers the key decision factors: event type, ordering, and time-window behavior. It could add explicit pagination context, but the schema already carries the limit/offset details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all four parameters at 100% coverage, so the baseline is 3. The description adds value by coupling start and end into a single window concept and clarifying the 'omit both' default, which is not fully explicit in the individual schema entries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete verb and resource: 'List browser/session audit events from Island's timeline,' and adds concrete examples of event types plus the 'newest first' ordering. The event category sets it apart from sibling tools (admin actions, compromised credentials, devices) without requiring schema inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit guidance for the time-window parameters: 'Use start/end to bound the window; omit both for Island's server-side default window.' It doesn't explicitly name sibling alternatives or state when not to use this tool, but the domain-specific wording provides clear context with no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
island_list_compromised_credentialsA
List credentials Island has detected as compromised (e.g. via dark-web/breach-corpus matching on credentials entered into the browser) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window. Note: at least one third-party integrator has reported this endpoint's offset pagination as unreliable in practice (returning the same page regardless of offset) - treat limit/offset as best-effort.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Inclusive upper bound, ISO 8601. Defaults to now when omitted. | |
| limit | No | Items per page. Defaults to 100. | |
| start | No | Inclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted. | |
| offset | No | Pagination offset (0-based). Defaults to 0. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently exposes a known limitation: offset pagination is unreliable in practice and should be treated as best-effort. It also discloses the detection mechanism and default window behavior, giving the agent realistic expectations beyond what the schema conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each purposeful: the first states the core action and ordering, the second explains the time-window parameters, and the third gives a critical caveat. No filler or redundancy; the most important warning is placed last but is clearly highlighted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list tool with no output schema and no annotations, the description is quite complete: it covers purpose, input semantics, default behavior, and a known pitfall. It omits details about the return structure, but that is typically inferable from the tool name and 'list' action. The pagination warning is especially valuable for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100% (each parameter already has a description), the description adds extra meaning: it explains that omitting start/end triggers a server-side default window, and it characterizes limit/offset as best-effort due to pagination issues. This goes beyond the schema's straightforward definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a distinct resource ('credentials... compromised'), and adds context (dark-web/breach-corpus matching) and ordering ('newest first'). This clearly distinguishes it from sibling tools that list other resource types like admin actions, audit events, or devices.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear parameter-usage guidance: using start/end to bound the window and omitting both for the server-side default. However, it does not explicitly name alternatives or state when not to use this tool vs. siblings; the resource type makes that implicit, but exclusions are not articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
island_list_devicesA
List devices running Island Browser under this account, optionally filtered to devices last seen at/after a given time. Sortable by field (e.g. LastSeen).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Items per page. Defaults to 100. | |
| offset | No | Pagination offset (0-based). Defaults to 0. | |
| sort_by | No | Field to sort by. "LastSeen" is confirmed from Island's own published example payloads; other field names are passed through as-is. | |
| last_seen | No | Filter to devices last seen at/after this time, ISO 8601. | |
| sort_direction | No | Sort direction. Defaults to Asc. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses core behaviors: listing, optional time filtering, and sortability. It does not explicitly confirm read-only semantics, describe the response shape (there is no output schema), or address pagination defaults, leaving the safety profile and return expectations to inference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action front-loaded, followed by filter and sort behaviors. No filler or redundancy; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with zero required parameters and a fully self-documenting schema, the description plus schema cover the invocation surface well. The residual gaps — explicit sibling-selection guidance and expected return format — are minor for a resource-named list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — every parameter has a description, defaults, and the one enum is fully specified — so the baseline is 3. The description's 'e.g. LastSeen' example only echoes what the schema already confirms about sort_by and adds no new parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('List devices running Island Browser under this account'), naming the account scope. The resource (devices) is clearly distinct from all three siblings (admin_actions, audit_events, compromised_credentials), so an agent can select this tool without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys usage context — devices under the current account, optional last_seen filter, sorting — which makes its purpose inferable. However, it never explicitly states when to prefer this over island_list_admin_actions, island_list_audit_events, or island_list_compromised_credentials, nor gives exclusions. The sibling resources are obviously different, making the gap mild but real.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
island_list_admin_actions - First observed
island_list_audit_events - First observed
island_list_compromised_credentials - First observed
island_list_devices
TDQS
Scored across 4 tools
Each tool targets a distinct Island data type—admin actions, audit events, compromised credentials, and devices—so an agent can reliably pick the right one. The descriptions clearly separate browser/session audit events from console admin actions.
All tools follow the same island_list_<resource> snake_case pattern, making the naming highly predictable and consistent. There are no mixed conventions or vague verbs.
Four tools is slightly on the small side but reasonable for what appears to be a read-only Island security/audit data server. Each tool earns its place and the count avoids bloat.
The set covers several important listing surfaces, but it is entirely list-oriented with no get-by-id, deeper search, or management actions. For a server named broadly 'Island MCP Server', notable operational gaps remain.
Maintenance
Related MCP Connectors
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
Runtime permission, approval, and audit layer for AI agent tool execution.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceProvides AI assistants with read-only access to Secureframe's compliance data, enabling querying of security controls, tests, users, vendors, and more across frameworks like SOC 2 and ISO 27001.8MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants and automation tools to manage Microsoft 365, Entra ID, and Intune resources through 32 tools for user/device/file management and infrastructure monitoring.6MIT
- FlicenseNot gradedqualityCmaintenanceProvides read-only access to Confluence, GitHub, Jira, Figma, Outlook, Teams, and browser automation for AI clients, enabling safe discovery, retrieval, and summarization of company knowledge without modifying source systems.-
- FlicenseAqualityBmaintenanceProvides read-only visibility into CyberQP privileged access management data, including customer and account metadata, tenant event logs, and Just-In-Time account status and policies, for AI assistants.10-