Search the Action1 MCP server capabilities and examples. Use this first when deciding which tool to call.

List the Action1 organizations this credential can access. Start here — other tools need an orgId.

Inventory of managed endpoints: name, OS, agent status, last seen, update/vulnerability status, reboot-required. All status filters accept the values shown in the Action1 console. fields="*" adds extended data.

Fetch one managed endpoint; includeMissingUpdates=true also returns its missing updates.

List endpoint groups, one group (groupId), or its member endpoints (contents=true).

Available updates with approval status, severity, and affected endpoints. Filters: approvalStatus (New/Approved/Declined), securitySeverity, onlyLatest. packageId fetches a single update.

CVEs across endpoints with score and remediation status. cveId fetches one CVE; detail=endpoints|remediations lists affected machines or available fixes.

Installed software inventory for the organization, or one endpoint with endpointId.

Deployable packages in the software repository (read-only).

The script library, read-only. This server can NOT run or edit scripts by design.

Scheduled automations (kind=schedules) or run history (kind=instances); endpointResults=true lists per-endpoint outcomes for one instance. Read-only — creating/running automations is deliberately not exposed.

List available built-in and custom reports.

Fetch the data rows of a report for an organization.

Enterprise-wide audit events, or org-scoped logs with orgId.

Approve/decline updates for ONE organization. Approved updates are what scheduled automations deploy — confirm the list with the user before approving. Requires write access on this instance; orgId="all" is refused.