cisco-umbrella-mcp
This server exposes Cisco Umbrella REST API v2 (classic Umbrella) as an MCP service, letting agents query a customer's security activity, deployments, app discovery, and managed-provider console data using 14 tools.
Activity reports: DNS, proxy/SWG, firewall, and AMP retrospective events for a customer org over a time range (filter by domains, categories, verdicts, threats, identities, etc.).
Roaming computers: List customer endpoints running the Umbrella roaming client, with filters for name, status, SWG status, and last-sync time.
App Discovery: List discovered cloud applications, network protocols, and application categories.
Category intelligence: Fetch the category catalogue (security vs content types) and per-category request/block summaries for a time range.
Deployments: List networks and virtual appliances with their state/health.
Managed provider operations: List managed customer orgs and get the provider console subscription/usage summary.
Configuration/access: Supports stdio or HTTP transport, env- or gateway-based credentials, and per-customer
organization_idscoping at token mint time to avoid silently mixing tenant data.
Provides tools for interacting with Cisco Umbrella's REST API, enabling retrieval of DNS/proxy/firewall/AMP-retrospective activity reports, listing roaming computers, app discovery data (applications, protocols, categories), managing provider customers, and obtaining provider console summaries.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cisco-umbrella-mcpshow me the DNS activity for the last 24 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
cisco-umbrella-mcp
Cisco Umbrella MCP Service — a stateless HTTP MCP server wrapping the Cisco Umbrella REST API v2 (classic Umbrella, not the newer Secure Access/SASE product), scoped to the 10 endpoints MSPbots currently uses: DNS/proxy/firewall/AMP-retrospective activity reports, roaming computers, app-discovery (applications/protocols/application categories), managed-provider customer list, and the provider console summary.
Tech stack: Python 3.12 + uv + FastMCP (Starlette/Uvicorn)
When would an agent use this
Cisco Umbrella protects a customer's network at the DNS/web layer — it blocks malicious domains, filters web content by category, and logs network activity. An agent should reach for this MCP for requests like:
"Has this domain been queried or blocked on this customer's network recently?" →
cisco_umbrella_get_activity_dns"What web categories/URLs are being filtered or proxied for this customer?" →
cisco_umbrella_get_activity_proxy"Any firewall allows/blocks for this customer's network in the last day?" →
cisco_umbrella_get_activity_firewall"Did a file that looked clean later get flagged as malware?" →
cisco_umbrella_get_activity_amp_retrospective"List this customer's roaming laptops and their last sync/status" →
cisco_umbrella_list_roaming_computers"List the customer orgs we manage under Cisco Umbrella" / "What's our Umbrella package usage across customers?" →
cisco_umbrella_list_customers,cisco_umbrella_get_providers_console
Caveat: this credential set is a Managed Provider (MSSP) root-org key, not a per-customer credential, so the per-customer activity/device tools above may come back empty in practice — see Known Gaps below for the verified details.
Related MCP server: cisco-secure-access-mcp
Authentication method note
Cisco Umbrella's classic REST API supports the OAuth2 client_credentials grant — a pure server-to-server exchange, no user browser redirect. An admin creates an API Key + Key Secret pair in the Umbrella dashboard (Admin > API Keys), and this service exchanges that pair for a short-lived (1 hour) bearer token on every call (no refresh token, so no cross-request caching — same "re-login every call" pattern as covedataprotection-mcp/webroot-mcp/logmein-mcp).
POST https://api.umbrella.com/auth/v2/token
Authorization: Basic base64(apiKey:keySecret)
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentialsRegion note: MSPbots' own integration config for Cisco Umbrella has a dataCenter field (us/eu). Verified directly against the raw OpenAPI spec embedded in Cisco's own developer docs for all 10 endpoints plus the auth/token endpoint: every one of them lists exactly one host, https://api.umbrella.com — there is no separate EU host for classic Umbrella. (Cisco's newer "Secure Access" product does have its own region concept, but that's a different product from what this service targets.) This service therefore ignores the dataCenter value entirely; it's not needed for any of these 10 endpoints.
Quick Start
# Install dependencies
cd D:\claude\project\cisco-umbrella-mcp
uv sync
# Run in stdio mode (for Claude Desktop)
$env:UMBRELLA_API_KEY="your_api_key"
$env:UMBRELLA_KEY_SECRET="your_key_secret"
uv run cisco-umbrella-mcpConfiguration
Copy .env.example to .env and fill in your values:
Variable | Default | Description |
| — | Cisco Umbrella API Key (Admin > API Keys) |
| — | Cisco Umbrella Key Secret (shown once at creation time) |
|
|
|
|
|
|
|
| HTTP server port |
HEADER 授权参数说明
Gateway 模式下,每个请求必须携带以下两个 HTTP Header:
Header | 类型 | 是否必填 | 默认值 | 枚举值 | 字段描述 | Example |
| string | 是 | 无 | 无 | Cisco Umbrella API Key(Umbrella 后台 Admin > API Keys 页面生成) |
|
| string | 是 | 无 | 无 | Cisco Umbrella Key Secret(创建时仅显示一次,用于配合 API Key 走 client_credentials 换 token) |
|
Claude Desktop Setup
Add to claude_desktop_config.json:
{
"mcpServers": {
"cisco-umbrella": {
"command": "uv",
"args": ["run", "--directory", "D:/claude/project/cisco-umbrella-mcp", "cisco-umbrella-mcp"],
"env": {
"UMBRELLA_API_KEY": "your_api_key",
"UMBRELLA_KEY_SECRET": "your_key_secret"
}
}
}
}Transport Modes
stdio (Claude Desktop / CLI)
$env:UMBRELLA_API_KEY="your_api_key"
$env:UMBRELLA_KEY_SECRET="your_key_secret"
uv run cisco-umbrella-mcpHTTP — single-tenant
$env:UMBRELLA_API_KEY="your_api_key"
$env:UMBRELLA_KEY_SECRET="your_key_secret"
$env:MCP_TRANSPORT="http"
$env:AUTH_MODE="env"
uv run cisco-umbrella-mcpHTTP — gateway / multi-tenant
$env:MCP_TRANSPORT="http"
$env:AUTH_MODE="gateway"
uv run cisco-umbrella-mcp
# Each request must include: X-Umbrella-Api-Key and X-Umbrella-Key-Secret headersAvailable Tools (14)
Tool | Description | API | Parameters |
| DNS activity events |
|
|
| Proxy (SWG) activity events |
|
|
| Firewall activity events |
|
|
| AMP retrospective activity events |
|
|
| List roaming client endpoints |
|
|
| List discovered cloud applications |
|
|
| List discovered network protocols |
|
|
| List application categories |
|
|
| Category catalogue; |
|
|
| Per-category request counts for a time range |
|
|
| List registered networks and their deployment state |
|
|
| List virtual appliances, their health and state |
|
|
| List customer orgs under this Managed Provider account |
|
|
| Get provider console subscription/usage summary (single object, not a list) |
| none |
from_/to accept epoch milliseconds, ISO-8601, or a relative offset (e.g. "-1days", "-7days", "now"), per Umbrella's reporting API conventions. (from_ has a trailing underscore because from is a Python reserved word — it's mapped to the literal from query parameter internally.)
organization_id is the managed customer's Umbrella organization ID (the customerId from cisco_umbrella_list_customers). It is sent as X-Umbrella-OrgId on the token exchange, so Umbrella mints a token whose sub claim is org/<organization_id>/client/<key>. It is required on every customer-scoped tool rather than optional. Omitting it would run the call at the provider (parent) organization's own scope, which answers 200 with either nothing or the parent's own traffic — indistinguishable downstream from "this customer had no activity in this period". Consumers of these tools state security findings to end clients, so a loud failure is safer than a quiet empty. Resolve an ID with cisco_umbrella_list_customers; the three provider-level tools (list_customers, get_providers_console, test_connection) deliberately do not take one.
Known Gaps
Tested against two real Managed Provider (MSSP) accounts before per-customer scoping existed. Of the 10 tools that build had, only 2 were confirmed working with verified real data; the other 8 were blocked or unverified (empty results don't prove correctness — they just mean no error was raised). The 4 tools added since have not been exercised live at all.
Per-customer scoping, added 2026-09-18 — live-verified. The empty results below were the expected consequence of running every call at the provider (parent) org's own scope, which carries no client traffic. X-Umbrella-OrgId fixes it, but only on the token exchange. Cisco's own docs give two placements and they disagree; tested against a live Managed Provider account with 62 managed customers:
Placement | Result |
Header on the business request ( |
|
Header on |
|
The failing placement fails silently, which is exactly the hazard this parameter exists to prevent — so this is pinned by tests/test_tools.py::test_org_scope_is_applied_at_token_mint_not_on_the_business_request. The scoped token's sub claim changes from org/<parent>/client/<key> to org/<customer>/client/<key>, and two customers return disjoint data. Because the token is minted per call and never cached, the scope cannot leak between tenants.
Breaking change, 2026-09-18.
organization_idbecame a required parameter on all 8 customer-scoped tools plus the 4 new ones. Calls that omit it now fail schema validation instead of silently returning parent-scope data. Agent sessions built against the previous signatures will break.
✅ Confirmed working (real, non-empty, cross-validated data):
cisco_umbrella_get_providers_console— real subscription summary on both test accounts (customerCount: 77andcustomerCount: 47respectively).cisco_umbrella_list_customers— returned 77 real customer organizations (real company names) on account 1. Failed with403 Access Forbiddenon account 2 — confirmed by decoding that account's token that it genuinely lacks theadmin.customers:readscope (20 total scopes vs. 76 on account 1). Not a code bug; a real per-key permission difference.
⚠️ Unverified — returned well-formed but empty results on both accounts, not proven correct: cisco_umbrella_get_activity_dns, _proxy, _firewall, _amp_retrospective, cisco_umbrella_list_roaming_computers. Cross-checked the live OpenAPI parameter definitions for Activity DNS directly against Cisco's own docs (pulled the raw spec, not summarized) — from/to/limit are exactly as implemented, no missing/misnamed parameter. The likely explanation is that both test accounts are Managed Provider root orgs, which have no direct DNS/proxy/firewall/AMP traffic or roaming computers of their own — that data lives under each managed customer org individually. Resolved by organization_id / X-Umbrella-OrgId — the earlier conclusion here ("searched Cisco's docs for a scoping parameter/header, found none") was wrong. With a child-scoped token, get_activity_dns and list_roaming_computers return real per-customer data (verified on two customers). The app-discovery three remain blocked by entitlement, which is a separate problem.
cisco_umbrella_list_applications,_protocols,_application_categories(App Discovery) — confirmed blocked, not a code bug. Reproduced identically on both test accounts and via direct curl with the same tokens (ruling out request-construction issues):403 Access Forbiddenon account 1,500/403on account 2. Both tokens' scope lists includedreports.appdiscovery:read, so this is most likely a package/entitlement restriction (App Discovery as a paid add-on not included in either account's "Umbrella for MSSPs" tier), not a permissions or parameter problem.cisco_umbrella_get_providers_consolereturns a single subscription-summary object, not a list — confirmed via both live tests. Despite the plural name in MSPbots' own configured API list ("Providers Consoles"), double-check this against whatever MSPbots' existing collector expects (array vs single object).The
Applicationsapp-discovery endpoint's optional parameter list may not be fully exhaustive (a couple of parameters near the end of that endpoint's schema were not fully captured during research) — the ones documented here (sources,identity,labels,controllable,categories,subcategory,limit,offset) are confirmed real; there may be one or two more not yet added.Scope is limited to the 14 operations MSPbots currently uses, not Umbrella's full API surface (which also includes Internal Domains, Sites, Network Tunnels, Policies, Tagging, the separate "Providers" API for per-customer actions, and the Key Admin API for managing API keys themselves). Whether Umbrella's
networksandsitesare the same objects under two names is an open question — the provider-side deployment response uses an identity type ofsite.
API Reference
Verified API behaviour (live, 2026-09-18)
Measured against a Managed Provider account with 62 managed customers. These decide how a consumer must define its metrics, so they are recorded here rather than left to be rediscovered.
/reports/v2/categoriesworks at child-org scope and carriestype. 180 categories, with six type values —content(153),security(13–15 depending on org, the set includes per-customer entries),system(3),aisupplychain(3),customer(5),application(1). It is not a security/content binary; filter ontype == "security"explicitly.summaries-by-categoryomits categories with no traffic — it never returns a zero. For one customer it returned 132 of 180 categories and zero rows withrequests == 0. Of that org's 13 security categories only 5 appeared;Command and Control,CryptominingandDrive-by Downloads/Exploitswere simply absent. A consumer that needs to state "no command-and-control requests this month" must union the result against/reports/v2/categoriesand treat an absent row as zero — reading the summary alone cannot distinguish "no traffic" from "no data".Category counts do distinguish blocked from allowed. The
summaryobject carriesrequests,requestsallowed,requestsblocked, plusapplications,applicationsallowed,applicationsblocked,categories,domains,files,filetypes,identities,identitytypes,policycategories,policyrequests.The deployment endpoints return a bare JSON array — no envelope, no
meta, no total, no active count, and no count headers. Active counts must be derived by counting per-item state:networkshasstatus(OPEN/CLOSED),roamingcomputershasstatus(Open/Encrypted/Off/Disabled) andswgStatus,virtualapplianceshashealthand astateobject.networksandsitesare different populations, not two names for one thing. They are separate endpoints with disjoint fields; one test org had 0 networks and 1 site, another had 2 networks and 1 site. A site looks like a container — it carriesinternalNetworkCountandvaCount.⚠️
summaries-by-categorymust be called withcategories, or the security rows are silently lost. Unfiltered, one customer's month came back as 19,902 characters — over the 20,000-char response cap — so the wrapper truncated it to 53 of 132 rows and settruncated: true. The security categories sort last and none of them survived. Passing the 15 security category IDs ascategoriesreturned 1,821 characters, 5 rows, no truncation. The working flow is two calls:cisco_umbrella_get_categories(organization_id) -> keep ids where type == "security" cisco_umbrella_get_summaries_by_category(organization_id, from_, to, categories="<those ids, comma-separated>")Measured on one customer over 30 days: Malware 118 requests / 118 blocked, Newly Seen Domains 14/14, DNS Tunneling VPN 10/10, Dynamic DNS 8/0, Phishing 1/1.
⚠️
offsetis unreliable onsummaries-by-category— do not page with it. With a 132-row result:limit=10&offset=0gave 10 rows,limit=10&offset=5gave 5,limit=10&offset=10gave 0, andlimit=100&offset=50gave 32. A consumer advancingoffsetbylimitgets one page and then silence, producing a short census that looks complete. Fetch the whole set in one call with a largelimit— the category population is bounded (~180), solimit=200covers it.metais{}on every reporting response; there is no total to check against. The deployment endpoints page normally withpage/limit.
Available Tools
10 toolscisco_umbrella_get_activity_amp_retrospectiveA
List AMP (Advanced Malware Protection) retrospective activity events — files that were re-classified as malicious after they were first seen.
API: GET /reports/v2/activity/amp-retrospective
Args:
from_: Required. Start of the time range. Accepts epoch
milliseconds, ISO-8601 (e.g. "2024-01-01T00:00:00Z"), or a
relative offset (e.g. "-1days", "-7days", "now").
to: Required. End of the time range. Same accepted formats as from_.
limit: Max results per page (default 100).
offset: Pagination offset.
ampdisposition: Filter by AMP disposition, e.g. "malicious".
sha256: Filter by a specific file's SHA-256 hash.
timezone: IANA timezone name for the response's time fields.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| from_ | Yes | ||
| limit | No | ||
| offset | No | ||
| sha256 | No | ||
| timezone | No | ||
| ampdisposition | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It mentions the API endpoint, default limit, and pagination offset, which hint at behavior. However, it does not disclose authentication needs, rate limits, or broader side effects (e.g., whether this is read-only). The word 'List' implies non-mutating, but that is implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized with a purpose line, API endpoint, and a list of args. It is front-loaded with the core purpose. It is longer than a simple two-liner but every line is informative. The structured arg list is easy to scan, though it could be slightly more concise if trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, endpoint, and all parameter semantics comprehensively. An output schema exists, so return values need no explanation. Missing pieces are explicit exclusions or caveats (e.g., 'not for DNS events') and any error/edge-case behavior. Overall it is complete for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so thoroughly: from_ and to are explained with accepted formats (epoch ms, ISO-8601, relative offsets), limit has a default, offset is explained as pagination, ampdisposition has an example, sha256 is described, and timezone is defined. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List AMP (Advanced Malware Protection) retrospective activity events' and explains what that means ('files that were re-classified as malicious after they were first seen'). This is a specific verb+resource+scope that distinguishes it from sibling activity tools like DNS, proxy, and firewall.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: this tool is for AMP retrospective events, which implies when to use it. However, it does not explicitly mention alternatives or exclusions relative to sibling activity tools. The description provides enough context for a basic selection decision, but lacks an explicit 'use this when' statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_get_activity_dnsA
List DNS activity events.
API: GET /reports/v2/activity/dns
Args:
from_: Required. Start of the time range. Accepts epoch
milliseconds, ISO-8601 (e.g. "2024-01-01T00:00:00Z"), or a
relative offset (e.g. "-1days", "-7days", "now").
to: Required. End of the time range. Same accepted formats as from_.
limit: Max results per page (default 100).
offset: Pagination offset.
domains: Comma-separated domain filter.
categories: Comma-separated content category ID filter.
identityids: Comma-separated identity (e.g. roaming computer) ID filter.
verdict: Filter by verdict, e.g. "allowed" or "blocked".
threats: Comma-separated threat name filter.
timezone: IANA timezone name for the response's time fields.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| from_ | Yes | ||
| limit | No | ||
| offset | No | ||
| domains | No | ||
| threats | No | ||
| verdict | No | ||
| timezone | No | ||
| categories | No | ||
| identityids | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It correctly implies a read operation via 'List' and includes details on pagination (limit, offset), but it does not disclose potential side effects, rate limits, or authentication requirements. The API endpoint is provided, adding some transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured as a docstring with a one-line summary, followed by the API endpoint and a formatted list of arguments. Every parameter earns its place, and the content is front-loaded with the core purpose. It is appropriately concise for a tool with 10 parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, output schema present), the description is nearly complete. It covers all parameters, clarifies required fields, and notes timezone handling. It does not explain the response structure, but the output schema likely covers that. Minor gap: no mention of error handling or boundary behaviors.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are absent (0% coverage), so the description fully compensates by explaining each parameter's format and purpose. It clarifies time formats, defaults (limit 100), and filter types (domains, categories, verdict, etc.), providing clear semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List DNS activity events,' which is a specific verb and resource that clearly identifies the tool's purpose. The name and API endpoint further specify DNS activity, distinguishing it from sibling tools like proxy, firewall, and AMP retrospective activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for DNS activity events, but it does not explicitly state when to choose this tool over the sibling activity tools (e.g., proxy, firewall). No alternative tools are mentioned, so the guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_get_activity_firewallA
List network firewall activity events.
API: GET /reports/v2/activity/firewall
Args:
from_: Required. Start of the time range. Accepts epoch
milliseconds, ISO-8601 (e.g. "2024-01-01T00:00:00Z"), or a
relative offset (e.g. "-1days", "-7days", "now").
to: Required. End of the time range. Same accepted formats as from_.
limit: Max results per page (default 100).
offset: Pagination offset.
identityids: Comma-separated identity (e.g. network tunnel) ID filter.
ruleid: Filter by firewall rule ID.
verdict: Filter by verdict, e.g. "allowed" or "blocked".
categories: Comma-separated category filter.
timezone: IANA timezone name for the response's time fields.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| from_ | Yes | ||
| limit | No | ||
| offset | No | ||
| ruleid | No | ||
| verdict | No | ||
| timezone | No | ||
| categories | No | ||
| identityids | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the API method (GET) and the required time-range parameters, but does not explicitly state safety (e.g., read-only) or discuss behaviors like pagination limits, result ordering, or rate limits. The 'List' verb and GET API imply a non-destructive operation, but this is not spelled out.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured. It opens with a one-line purpose, gives the API endpoint, and then lists parameters in a readable format. Every sentence adds value; there is no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all parameters, required fields, and accepted formats, and an output schema exists so return values need no explanation. It could also mention explicit when-to-use vs. sibling tools, but that falls more under usage guidelines. Overall, it is sufficiently complete for a list operation with good parameter coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description is the only source of parameter meaning. It provides detailed semantics for every parameter: accepted time formats for from_/to, default for limit, offset as pagination, and definitions for each filter (identityids, ruleid, verdict, categories, timezone). This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'List network firewall activity events,' which uses a specific verb and resource. It clearly distinguishes itself from sibling tools like get_activity_dns and get_activity_proxy by specifying 'firewall.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for firewall activity events, but it does not explicitly state when to use it over the sibling activity tools or mention any exclusions. The usage context is clear enough from the name and first line, but no alternatives or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_get_activity_proxyA
List proxy (Secure Web Gateway) activity events.
API: GET /reports/v2/activity/proxy
Args:
from_: Required. Start of the time range. Accepts epoch
milliseconds, ISO-8601 (e.g. "2024-01-01T00:00:00Z"), or a
relative offset (e.g. "-1days", "-7days", "now").
to: Required. End of the time range. Same accepted formats as from_.
limit: Max results per page (default 100).
offset: Pagination offset.
domains: Comma-separated domain filter.
urls: Comma-separated URL filter.
categories: Comma-separated content category ID filter.
identityids: Comma-separated identity ID filter.
verdict: Filter by verdict, e.g. "allowed" or "blocked".
threats: Comma-separated threat name filter.
filename: Filter by downloaded file name.
timezone: IANA timezone name for the response's time fields.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| urls | No | ||
| from_ | Yes | ||
| limit | No | ||
| offset | No | ||
| domains | No | ||
| threats | No | ||
| verdict | No | ||
| filename | No | ||
| timezone | No | ||
| categories | No | ||
| identityids | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the HTTP method (GET) and details about timezone handling and pagination, which is useful. However, it does not explicitly state that this is a read-only operation, mention authentication requirements, or describe error behavior, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a well-structured docstring with the API endpoint followed by an Args list. Each parameter gets a single concise line, and the content is front-loaded with the core action. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 12 parameters and no schema descriptions, the description covers every parameter, the API endpoint, and special formatting details for time fields and timezone. An output schema exists, so return values are presumably covered there. It is complete for a reporting tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description fully compensates by explaining every parameter, including accepted formats for from_/to (epoch, ISO-8601, relative offsets), default values, and filter semantics with examples (e.g., verdict 'allowed' or 'blocked'). This adds substantial meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it 'List proxy (Secure Web Gateway) activity events', providing a specific verb and resource. The term 'proxy' differentiates it from sibling tools that focus on DNS, firewall, or AMP activities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives like DNS or firewall activity tools. While the name and description imply proxy/SWG reporting, there are no when-to-use or when-not-to-use statements, and no alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_get_providers_consoleA
Get this Umbrella Managed Provider console's subscription/usage summary (package name, total/used seats, customer count, status, renewal/expiry dates). Not a list — returns a single object.
API: GET /reports/v2/providers/consoles
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden. It discloses the HTTP method (GET), the fact that it returns a single object, and the summary contents, which are meaningful behavioral traits. It does not mention authentication, errors, or rate limits, but for a simple read-only report call with no parameters, the added context is strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a single main sentence with a parenthetical list, a clarifying sentence about the return type, and an API reference. Every line adds value, with no redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool, the description is complete: it states the purpose, the return value's scope, the single-object semantics, and provides the exact API endpoint. The output schema covers detailed return values, so the description need not repeat them, and the simplicity of the tool means no additional context is required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no properties, so the baseline is 4. The description does not need to explain parameters because there are none; it appropriately focuses on the output and semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as retrieving 'this Umbrella Managed Provider console's subscription/usage summary' and enumerates the specific fields (package name, seats, customer count, status, dates). The phrase 'Not a list — returns a single object' explicitly differentiates it from the sibling list tools, meeting the requirement for a specific verb+resource and sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: it is for obtaining the console's subscription/usage summary and emphasizes that it returns a single object rather than a list, which helps choose it over list-oriented siblings. However, it does not explicitly name alternative tools or state when not to use it, so it falls slightly short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_list_application_categoriesB
List application categories (App Discovery).
API: GET /reports/v2/appDiscovery/applicationCategories
Args:
limit: Max results per page (1-100).
offset: Pagination offset.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It includes the GET API endpoint, implying read-only, but fails to disclose pagination behavior, return format, permissions, rate limits, or other behavioral traits. The description stays at the surface level without revealing operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a clear purpose statement, the API endpoint, and an Args section with parameter details. Each line earns its place, with no filler, and the format is easily scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained. The description covers the core function and parameters, making it minimally viable for a simple list operation. However, it lacks any usage context, behavioral detail, or operational constraints, leaving gaps in full understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds valuable parameter semantics: 'limit: Max results per page (1-100)' and 'offset: Pagination offset.' This goes beyond the schema, which has 0% description coverage and only provides types and defaults. The range and purpose of parameters are clarified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List application categories (App Discovery).' with a specific verb and resource, and also provides the API endpoint for added clarity. However, it does not explicitly differentiate from sibling tools like 'cisco_umbrella_list_applications', though the resource name is distinct enough to infer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as 'cisco_umbrella_list_applications' or other list tools. There is no context on use cases, prerequisites, or when not to use it, so the usage guidance is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_list_applicationsA
List discovered cloud applications (App Discovery).
API: GET /reports/v2/appDiscovery/applications
Args:
sources: Comma-separated data source filter, e.g. "dns,swg,cdfw".
identity: Filter by identity (e.g. roaming computer or network) ID.
labels: Comma-separated label filter.
controllable: Filter to only applications with a controllable policy.
categories: Comma-separated application category ID filter.
subcategory: Filter by application subcategory.
limit: Max results per page.
offset: Pagination offset.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| labels | No | ||
| offset | No | ||
| sources | No | ||
| identity | No | ||
| categories | No | ||
| subcategory | No | ||
| controllable | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden for behavioral disclosure. It only states 'List' and lists parameters, but does not describe pagination behavior (e.g., default limit, max results), response structure, or any side effects beyond it being a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a one-line summary, API endpoint, and a clear list of args. It is concise and free of extraneous information, though the API line is somewhat redundant with the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list operation with an output schema, the description covers all parameters and the core purpose, but lacks usage guidance and behavioral details like pagination defaults. The output schema presumably covers return values, so the description is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All eight parameters are described with meaningful detail beyond the schema, including value formats (comma-separated, boolean), examples (sources: 'dns,swg,cdfw'), and semantics (limit as max results per page). Since schema coverage is 0%, this description fully compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'List discovered cloud applications (App Discovery).' with a clear verb and resource, and includes the API endpoint. This clearly distinguishes it from sibling tools like list_application_categories or get_activity_*.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use this tool versus alternatives such as activity reporting or category listing. There is no mention of prerequisites, exclusions, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_list_customersA
List customer organizations under this Umbrella Managed Provider (MSP) account.
API: GET /admin/v2/managed/customers
Args:
page: Page number (default 1).
limit: Max results per page (default 100, max 100).
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. The 'List' verb and 'GET' API endpoint indicate a read-only operation, and the max limit of 100 is disclosed. However, it does not mention authentication requirements, rate limits, or behavior beyond pagination, leaving some transparency gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and well-structured: purpose in the first line, API endpoint for reference, then a clear args list. Every sentence provides value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, an output schema exists (so return values are covered), the description adequately covers purpose, scope, endpoint, and parameters. It lacks explicit guidance on when to prefer this tool over siblings, but it is otherwise complete for a straightforward list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by explaining both parameters: page is the page number (default 1), and limit is max results per page (default 100, max 100). It adds the max constraint not present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists customer organizations under the MSP account, using a specific verb ('List') and resource ('customer organizations'). It distinguishes itself from sibling tools that list other entities like roaming computers, applications, or protocols.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this is for the Umbrella Managed Provider (MSP) account, implying it should be used when the agent needs to see managed customer organizations. It does not explicitly mention when not to use it or name alternatives, but the MSP-specific scope differentiates it from sibling list tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_list_protocolsA
List discovered network protocols (App Discovery).
API: GET /reports/v2/appDiscovery/protocols
Args:
identity: Filter by identity (e.g. roaming computer or network) ID.
limit: Max results per page.
offset: Pagination offset.
sort: Sort field — "firstDetected" or "lastDetected".
order: Sort order — "asc" or "desc".
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | ||
| limit | No | ||
| order | No | ||
| offset | No | ||
| identity | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses the HTTP method (GET) and the endpoint, implying read-only, and documents each parameter's meaning. However, it does not address pagination behavior limits, authentication, or other operational caveats, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core purpose, followed by the API endpoint and a structured Args list. No redundant sentences; every element serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, so return values are covered. The description explains all parameters and the endpoint. It lacks explicit cross-tool guidance, but overall it is sufficiently complete for a straightforward list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does so thoroughly via an Args section that explains identity filtering, pagination, sort fields, and order values, adding substantial meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'List discovered network protocols (App Discovery),' providing a specific verb, resource, and context. This clearly distinguishes it from sibling tools like list_applications and list_application_categories by focusing on protocols.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description identifies the App Discovery domain but does not explicitly explain when to choose this over list_applications or list_application_categories. Usage is implied by the tool name and resource, but no exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_umbrella_list_roaming_computersA
List roaming computers (endpoints running the Umbrella roaming client).
API: GET /deployments/v2/roamingcomputers
Args:
page: Page number (default 1).
limit: Max results per page (default 100, max 100).
name: Filter by computer name (partial match).
status: Filter by status.
swg_status: Filter by Secure Web Gateway module status.
last_sync_before: Only computers that last synced before this time.
last_sync_after: Only computers that last synced after this time.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| page | No | ||
| limit | No | ||
| status | No | ||
| swg_status | No | ||
| last_sync_after | No | ||
| last_sync_before | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the HTTP method (GET), pagination via page and limit, and filter semantics. However, in the absence of annotations, it does not explicitly state read-only nature, authentication needs, or behavior like how filters combine. Some behavioral traits are covered, but not all.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: purpose first, then API endpoint, then a clear list of arguments. Every sentence contributes useful information without redundancy or fluff. The layout is scannable and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the main purpose, endpoint, all parameters, and pagination. Since an output schema exists, the absence of response format details is acceptable. It could go further by specifying allowed filter values and date/time formats, but overall it is complete enough for a list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Given schema description coverage is 0%, the description compensates by explaining each of the 7 parameters with meaningful details: defaults, max limit, partial matches for name, and the semantics of last_sync_before/after. It lacks allowed values for status and date formats, but provides substantial value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb 'List' and resource 'roaming computers', and clarifies in parentheses that these are endpoints running the Umbrella roaming client. This clearly distinguishes it from sibling tools like activity or application list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the tool's purpose clear but does not explicitly state when to use it versus alternatives or mention exclusions. Sibling tools are quite different, so usage is implied, but no direct guidance or alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
cisco_umbrella_get_activity_amp_retrospective - First observed
cisco_umbrella_get_activity_dns - First observed
cisco_umbrella_get_activity_firewall - First observed
cisco_umbrella_get_activity_proxy - First observed
cisco_umbrella_get_providers_console - First observed
cisco_umbrella_list_application_categories - First observed
cisco_umbrella_list_applications - First observed
cisco_umbrella_list_customers - First observed
cisco_umbrella_list_protocols - First observed
cisco_umbrella_list_roaming_computers
TDQS
Scored across 10 tools
Each tool targets a distinct resource and action: four activity types (DNS, proxy, firewall, AMP), app discovery resources (applications, protocols, categories), roaming computers, and MSP-specific data (customers, console). No two tools appear to overlap in purpose.
All tools follow a consistent cisco_umbrella_<verb>_<noun> pattern with snake_case. The verb varies logically: 'get' for single objects or specific activity endpoints, 'list' for collection endpoints. This is highly predictable.
10 tools is well-scoped for an umbrella security API server: it covers several distinct functional areas (activity events, app discovery, roaming computers, MSP management) without becoming unwieldy. Each tool serves a clear purpose.
The set provides broad read-only access to multiple domains: activity reporting, app discovery, roaming computer lists, and MSP summary. It lacks individual item retrieval or management operations (e.g., get by ID, create/update/delete), but for a read-only reporting server this is a minor gap rather than a fatal one.
Maintenance
Related MCP Connectors
Cybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.
ThousandEyes MCP Server for network intelligence: outages, anomalies, alerts, events, and tests.
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
MCP server for DNSimple — domains, DNS zone records, availability, pricing and contacts.
Related MCP Servers
- AlicenseCqualityBmaintenanceA Python-based MCP server that enables querying Cisco's Meraki Dashboard API to discover, monitor, and manage Meraki environments.2245MIT
- AlicenseAqualityDmaintenanceA community MCP server for Cisco Secure Access that exposes the Secure Access REST API to AI clients as a curated catalog of tools for Admin, Deployments, Investigate, Policies, and Reports.421Apache 2.0
- AlicenseBqualityAmaintenanceMCP server for Proofpoint Email Protection - email security, threat intelligence, TAP (Targeted Attack Protection), and email filtering API integration403Apache 2.0
- AlicenseNot gradedqualityBmaintenanceA read-only MCP server for Cisco Meraki Dashboard, enabling LLMs to discover devices, check health, troubleshoot, and generate reports via natural language.MIT