Skip to main content
Glama
WYRE-AI

Island MCP Server

by WYRE-AI

Island MCP Server

MCP server for Island's Enterprise Browser Management API - administrator actions, browser/session audit events, compromised-credential detections, and device inventory - for AI assistants and the WYRE Conduit gateway.

Scope: 4 read-only tools, one per documented resource group

This connector implements exactly the four resource groups Island documents for its v1 Management API: Admin Actions, Audit (Island's own endpoint name for this is timeline), Compromised Credential, and Device. Island also documents a fifth resource, User, which is deliberately out of scope for this connector (not requested; can be added as a follow-up).

Two of the four - Compromised Credential and Device - are POST-with-body operations on Island's own API rather than plain GETs. Neither mutates anything: both are filtered/searched reads that happen to take their filter parameters in a JSON body instead of a query string, the same "POST for a filtered read, not a mutation" shape this gateway's UniFi connector already uses for its ISP-metrics query tool. No tool in this connector calls a PATCH/PUT/DELETE endpoint, and none reaches Island's broader Management Console surface (policy CRUD, user/browser-configuration-policy management) - see src/client.ts, which implements only these four read operations.

Island's authoritative API reference (documentation.island.io/apidocs) redirects to an authenticated customer portal and was not accessible for this build. Endpoint paths, the Api-Key header name, the request/response shape, and the default base URL below were all confirmed independently against a different, publicly-readable source: criblpacks/cribl-island-browser-rest-io, a published third-party log-collector integration whose repository ships real, executable REST-collector job definitions (default/jobs.yml) against Island's live API - not marketing copy or a prose guess. Response body field names are not independently confirmed from any source and are passed through exactly as Island returns them (see IslandApiResponse in src/types.ts) rather than re-modeled into a guessed shape.

Related MCP server: mcp-m365-mgmt

Base URL

Every endpoint below is confirmed at a single fixed host: https://management.island.io/api, taken verbatim from that Cribl pack's island_browser_api_base_url variable, which its own five REST-collector jobs all reference. This connector uses that as the default and lets a customer override it via an optional baseUrl/ISLAND_BASE_URL field, in case a given tenant is provisioned on a different host - a second, lower-confidence source (a third-party SIEM-integration doc, prose only, not executable config) describes the host as https://api.<company>.island.io, which this connector could not independently confirm or rule out. State plainly: the fixed-host reading is the better-evidenced one and is what ships as the default; the override exists specifically to not silently break a tenant for which it's wrong.

Authentication

Island's Management API authenticates with a static API key, generated in the Island Management Console under Modules > Platform Settings > System Settings > Integrations > API > + Create. There is no OAuth flow - this connector only ever holds a live API key, sent as Island's own custom Api-Key header (not Authorization: Bearer). In gateway mode the key arrives per-request via the X-Island-Api-Key header; in local/stdio mode it's read once from ISLAND_API_KEY.

Credential scope: what "Read Only" actually restricts

Two separate claims here, at deliberately different confidence levels - don't collapse them into one "read-only" statement:

  • Structurally verified (checked directly, stated with full confidence): this connector's own code makes zero mutating calls. Every function in client.ts calls one of the four read operations above; no PATCH/PUT/DELETE call exists anywhere in src/, and no policy/user/browser-configuration-management endpoint is referenced under any name.

  • Vendor-documented, not independently verified (hedged deliberately): Island's API-key creation dialog offers a "Read Only" role alongside "Full Admin"/"System Admin" - so some server-side scoping evidently exists - but Island's authoritative documentation of what that role actually restricts sits behind the same customer-only login noted above, and was not accessible to confirm independently. Whether "Read Only" genuinely blocks server-side access to Island's broader Management API surface (policy CRUD, user management, browser configuration policies - none of which this connector implements or calls) versus being a UI-level label has not been tested. Do not read this connector, or this README, as having established what the underlying API key can or cannot do if a non-Read-Only role were selected - only that this connector's own code never attempts anything beyond the four reads above, regardless of which role the customer's key was issued with.

Configuration

Env var

Description

ISLAND_API_KEY

API key issued by the Island Management Console, sent as the Api-Key header.

ISLAND_BASE_URL

Optional override of the Management API base URL. Defaults to https://management.island.io/api - see Base URL above.

MCP_TRANSPORT

stdio (default) or http.

AUTH_MODE

env (default, reads the vars above) or gateway (credentials arrive per-request via X-Island-Api-Key/X-Island-Base-URL, injected by the Conduit gateway).

CONDUIT_S2S_SECRET

When set, the HTTP transport requires a valid X-Gateway-S2S header (Conduit sidecar auth) on every /mcp request.

LOG_LEVEL

debug | info (default) | warn | error.

Tools

All four tools are classified isAdmin: true in the Conduit gateway - every resource group here is security/compliance-sensitive (who administrators are and what they changed, browser audit trail, detected compromised credentials, and the managed device inventory) even though every one of them is a plain read.

Admin Actions

  • island_list_admin_actions - list actions taken by administrators in the Island Management Console (policy changes, user/role changes) within a time window, offset-paginated.

Audit

  • island_list_audit_events - list browser/session audit events (navigation, file transfer, clipboard, print, policy-enforcement events) within a time window, offset-paginated. Island's own endpoint name for this is timeline.

Compromised Credential

  • island_list_compromised_credentials - list credentials Island has detected as compromised within a time window. POST-with-body on Island's own API (a filtered read, not a mutation - see Scope above). At least one third-party integrator's published collector config notes this endpoint's offset pagination as unreliable in practice (returning the same page regardless of offset); treat limit/offset as best-effort here for the same reason.

Device

  • island_list_devices - list devices running Island Browser under this account, optionally filtered to devices last seen at/after a given time, sortable by field. POST-with-body on Island's own API (a filtered read, not a mutation - see Scope above).

Excluded, by design

Hard-excluded (out of this connector's requested scope, not a technical block):

  • The User resource (GET /external/v1/users on Island's API) - Island documents this alongside the four implemented here; not requested for this connector. Can be added as a follow-up, after a deliberate scope decision.

Hard-excluded (write/provisioning - Island's broader Management API, never implemented):

  • Policy create/read/update/delete, policy-element management, and browser-configuration-policy management. This connector's four tools cover only the read-only data endpoints documented for Admin Actions, Audit, Compromised Credential, and Device; it does not implement any endpoint that creates, updates, or deletes a policy, user, or browser configuration.

They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.

Development

npm install
npm run build
npm test
npm run lint   # tsc --noEmit

Docker

docker build -t island-mcp .
docker run -p 8080:8080 -e ISLAND_API_KEY=... island-mcp

License

Apache-2.0

Available Tools

4 tools
island_list_admin_actionsB

List actions taken by administrators in the Island Management Console (e.g. policy changes, user/role changes) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoInclusive upper bound, ISO 8601. Defaults to now when omitted.
limitNoItems per page. Defaults to 100.
startNoInclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted.
offsetNoPagination offset (0-based). Defaults to 0.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden. It discloses useful behavior: results are newest first, and omitting both start/end triggers the server-side default window. However, it does not mention pagination behavior, response shape, or access/permission considerations, leaving parts of the call behavior unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The purpose and key examples are front-loaded, followed by concise parameter guidance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with four optional parameters and full schema coverage, the core call semantics are covered: scope, ordering, and time-window defaults. However, there is no output schema and the description does not describe the response shape or how limit/offset pagination works, so an agent must infer some behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces that start/end bound the window and that omitting both selects the server-side default, but it does not add meaning beyond the schema's own parameter descriptions. Limit and offset are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('List actions taken by administrators') and the resource scope (Island Management Console) with concrete examples such as policy changes and user/role changes. It is distinguishable from siblings like island_list_devices, though it does not explicitly contrast with island_list_audit_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives operational direction for the time window ('Use start/end to bound the window; omit both...'), but it does not explain when to choose this tool over island_list_audit_events or other siblings. No alternatives or exclusions are mentioned, so when-to-use guidance is mostly implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

island_list_audit_eventsA

List browser/session audit events from Island's timeline (e.g. navigation, file transfer, clipboard, print, and policy-enforcement events) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoInclusive upper bound, ISO 8601. Defaults to now when omitted.
limitNoItems per page. Defaults to 100.
startNoInclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted.
offsetNoPagination offset (0-based). Defaults to 0.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does disclose meaningful traits: results are newest-first and the time window defaults server-side when both bounds are omitted. 'List' also implies a read-style operation. It doesn't cover auth or rate limits, but the disclosed behavior is sufficient for a read-only timeline query.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler: purpose and examples come first, followed by parameter guidance. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-optional-parameter list tool with richly described schema fields and no output schema, the description covers the key decision factors: event type, ordering, and time-window behavior. It could add explicit pagination context, but the schema already carries the limit/offset details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents all four parameters at 100% coverage, so the baseline is 3. The description adds value by coupling start and end into a single window concept and clarifying the 'omit both' default, which is not fully explicit in the individual schema entries.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a concrete verb and resource: 'List browser/session audit events from Island's timeline,' and adds concrete examples of event types plus the 'newest first' ordering. The event category sets it apart from sibling tools (admin actions, compromised credentials, devices) without requiring schema inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance for the time-window parameters: 'Use start/end to bound the window; omit both for Island's server-side default window.' It doesn't explicitly name sibling alternatives or state when not to use this tool, but the domain-specific wording provides clear context with no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

island_list_compromised_credentialsA

List credentials Island has detected as compromised (e.g. via dark-web/breach-corpus matching on credentials entered into the browser) within a time window, newest first. Use start/end to bound the window; omit both for Island's server-side default window. Note: at least one third-party integrator has reported this endpoint's offset pagination as unreliable in practice (returning the same page regardless of offset) - treat limit/offset as best-effort.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoInclusive upper bound, ISO 8601. Defaults to now when omitted.
limitNoItems per page. Defaults to 100.
startNoInclusive lower bound, ISO 8601 (e.g. 2026-09-01T00:00:00Z). Island applies a server-side default window when omitted.
offsetNoPagination offset (0-based). Defaults to 0.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently exposes a known limitation: offset pagination is unreliable in practice and should be treated as best-effort. It also discloses the detection mechanism and default window behavior, giving the agent realistic expectations beyond what the schema conveys.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each purposeful: the first states the core action and ordering, the second explains the time-window parameters, and the third gives a critical caveat. No filler or redundancy; the most important warning is placed last but is clearly highlighted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with no output schema and no annotations, the description is quite complete: it covers purpose, input semantics, default behavior, and a known pitfall. It omits details about the return structure, but that is typically inferable from the tool name and 'list' action. The pagination warning is especially valuable for correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100% (each parameter already has a description), the description adds extra meaning: it explains that omitting start/end triggers a server-side default window, and it characterizes limit/offset as best-effort due to pagination issues. This goes beyond the schema's straightforward definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a distinct resource ('credentials... compromised'), and adds context (dark-web/breach-corpus matching) and ordering ('newest first'). This clearly distinguishes it from sibling tools that list other resource types like admin actions, audit events, or devices.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear parameter-usage guidance: using start/end to bound the window and omitting both for the server-side default. However, it does not explicitly name alternatives or state when not to use this tool vs. siblings; the resource type makes that implicit, but exclusions are not articulated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

island_list_devicesA

List devices running Island Browser under this account, optionally filtered to devices last seen at/after a given time. Sortable by field (e.g. LastSeen).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoItems per page. Defaults to 100.
offsetNoPagination offset (0-based). Defaults to 0.
sort_byNoField to sort by. "LastSeen" is confirmed from Island's own published example payloads; other field names are passed through as-is.
last_seenNoFilter to devices last seen at/after this time, ISO 8601.
sort_directionNoSort direction. Defaults to Asc.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses core behaviors: listing, optional time filtering, and sortability. It does not explicitly confirm read-only semantics, describe the response shape (there is no output schema), or address pagination defaults, leaving the safety profile and return expectations to inference.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the core action front-loaded, followed by filter and sort behaviors. No filler or redundancy; every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with zero required parameters and a fully self-documenting schema, the description plus schema cover the invocation surface well. The residual gaps — explicit sibling-selection guidance and expected return format — are minor for a resource-named list tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — every parameter has a description, defaults, and the one enum is fully specified — so the baseline is 3. The description's 'e.g. LastSeen' example only echoes what the schema already confirms about sort_by and adds no new parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('List devices running Island Browser under this account'), naming the account scope. The resource (devices) is clearly distinct from all three siblings (admin_actions, audit_events, compromised_credentials), so an agent can select this tool without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys usage context — devices under the current account, optional last_seen filter, sorting — which makes its purpose inferable. However, it never explicitly states when to prefer this over island_list_admin_actions, island_list_audit_events, or island_list_compromised_credentials, nor gives exclusions. The sibling resources are obviously different, making the gap mild but real.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedisland_list_admin_actions
    • First observedisland_list_audit_events
    • First observedisland_list_compromised_credentials
    • First observedisland_list_devices

TDQS

A3.9/5.0

Scored across 4 tools

Disambiguation5/5

Each tool targets a distinct Island data type—admin actions, audit events, compromised credentials, and devices—so an agent can reliably pick the right one. The descriptions clearly separate browser/session audit events from console admin actions.

Naming Consistency5/5

All tools follow the same island_list_<resource> snake_case pattern, making the naming highly predictable and consistent. There are no mixed conventions or vague verbs.

Tool Count4/5

Four tools is slightly on the small side but reasonable for what appears to be a read-only Island security/audit data server. Each tool earns its place and the count avoids bloat.

Completeness3/5

The set covers several important listing surfaces, but it is entirely list-oriented with no get-by-id, deeper search, or management actions. For a server named broadly 'Island MCP Server', notable operational gaps remain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    Provides AI assistants with read-only access to Secureframe's compliance data, enabling querying of security controls, tests, users, vendors, and more across frameworks like SOC 2 and ISO 27001.
    8
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Provides read-only access to Confluence, GitHub, Jira, Figma, Outlook, Teams, and browser automation for AI clients, enabling safe discovery, retrieval, and summarization of company knowledge without modifying source systems.
    -
  • F
    license
    A
    quality
    B
    maintenance
    Provides read-only visibility into CyberQP privileged access management data, including customer and account metadata, tenant event logs, and Just-In-Time account status and policies, for AI assistants.
    10
    -