action1-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ACTION1_REGION | No | One of NorthAmerica, NA-2, Europe, Australia | NorthAmerica |
| ACTION1_CLIENT_ID | Yes | API credential from the Action1 console | |
| ACTION1_MAX_ITEMS | No | Cap on items one tool call will page through | 1000 |
| ACTION1_PAGE_SIZE | No | Items per API request | 200 |
| ACTION1_MCP_BEARER | No | Bearer token required by the HTTP transport | |
| ACTION1_ALLOW_WRITE | No | Unblocks non-GET requests. No write tools exist in v1 | 0 |
| ACTION1_CLIENT_SECRET | Yes | API credential from the Action1 console | |
| ACTION1_DEFAULT_ORG_ID | No | Org used when a tool is called without org_id | |
| ACTION1_MAX_429_RETRIES | No | Retries after a rate-limit response | 3 |
| ACTION1_TIMEOUT_SECONDS | No | Per-request timeout | 60 |
| ACTION1_RATE_LIMIT_PER_MINUTE | No | Local throttle; Action1's ceiling is 30/min per tenant | 25 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| action1_whoamiA | Show which Action1 identity these API credentials map to, and their permissions. Use this first when a call fails with 403 — it tells you whether the API credential simply lacks access to the organization you asked about. Returns:
The |
| action1_list_organizationsA | List the organizations (tenants) these credentials can see. Most other tools need an |
| action1_get_organizationB | Get one organization's details. |
| action1_list_endpointsA | List managed endpoints (machines with the Action1 agent installed). |
| action1_get_endpointA | Get full detail for one managed endpoint. |
| action1_list_discovered_endpointsA | List discovered but unmanaged devices — seen on the network, no agent installed. Useful for finding coverage gaps: machines that exist but are not being patched. |
| action1_list_endpoint_groupsA | List endpoint groups, which are what policies and automations target. |
| action1_get_endpoint_group_membersB | List the endpoints in one group. |
| action1_list_missing_updatesA | List updates missing across the organization's endpoints. |
| action1_list_installed_appsA | List installed software, tenant-wide or for one endpoint. |
| action1_list_packagesA | List app packages available in the Action1 software repository. These are what a deployment could install — this tool does not deploy anything. |
| action1_list_vulnerabilitiesA | List CVEs detected across the organization's endpoints. |
| action1_get_vulnerabilityA | Get details for one CVE as Action1 sees it in this organization. |
| action1_list_vulnerability_endpointsA | List the endpoints affected by one CVE. |
| action1_list_vulnerability_remediationsA | List remediations already configured for one CVE. Read-only: this shows what remediation exists, it does not create or run one. |
| action1_list_policiesB | List policy instances (deployments and remediations configured in the tenant). |
| action1_get_policy_resultsA | Show per-endpoint results for one policy — what succeeded, failed or is pending. |
| action1_list_automationsB | List automations (scheduled policies) configured in the organization. |
| action1_list_scriptsA | List scripts available in the tenant. Useful for auditing what automation could run. This tool cannot execute them. |
| action1_list_reportsA | List the report definitions available in the tenant. Pair with action1_get_report_data to read one. |
| action1_get_report_dataA | Read the rows of one report. Returns Action1's last computed data. This tool does not trigger a requery, so figures can lag the console. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 21 tools
Every tool targets a distinct resource or action: whoami, organizations, endpoints (managed vs. discovered), groups, missing updates, installed apps, packages, vulnerabilities (with sub-resources), policies, automations, scripts, and reports. There is no overlap or ambiguity between tool purposes.
All tools follow the consistent 'action1_' prefix followed by a verb_noun pattern (list_*, get_*). Even whoami fits as a single verb. The naming is predictable and uniform across the entire set.
21 tools is on the higher end but justified by the broad scope of endpoint management, vulnerability tracking, and reporting. Each tool covers a specific functional area without redundancy, though a few could potentially be consolidated.
The server provides comprehensive read/query coverage for endpoints, vulnerabilities, policies, and reports. However, it is explicitly read-only with no create/update/delete or execution capabilities, which limits it to auditing and visibility rather than full management. This is a minor gap given the evident purpose.