Action1 MCP

Execute one action1 API endpoint by its endpoint_id (from action1_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the action1 API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

fleet subcommands: automation-health, health-score, org-scorecard, patch-drift, patch-posture, reboot-pending, software-rollup, stale, vuln-triage

Fleet-wide automation outcomes. Reads locally synced automation instances from every organization and rolls up their statuses into succeeded / failed / running counts and an overall success rate. Action1 reports automation instances one organization at a time; this is the cross-org rollup the API does not provide. Run 'action1-cli sync' (which fans automation instances out across every organization) before this command.

Per-endpoint health score across the whole fleet. Composes locally synced signals — missing critical/other updates, open critical vulnerabilities, reboot-required, and days since last check-in — into one risk score (higher is worse) and a 0-100 health value. No single Action1 API call yields this; it is a local join across signals that only exist together in the store.

Per-client posture scorecard across the whole book of business. Groups the locally synced endpoints, missing updates, and vulnerabilities by organization into the per-client posture number MSPs report to account managers. The org-scoped Action1 API has no cross-organization rollup. This command always spans every synced organization by design — it intentionally ignores --org and $ACTION1_ORG_ID, which the per-endpoint fleet siblings honor. Use this command for a per-client posture summary across every organization. Do NOT use it for per-endpoint ranking; use 'fleet patch-posture' or 'fleet health-score' instead.

Patch drift across the fleet over time. The Action1 API is stateless — it cannot tell you what changed. This command keeps its own per-endpoint missing-update snapshots in the local store: each run records the current posture, then diffs it against the previous snapshot to show remediated, regressed, cleared, and newly-missing endpoints. Run it after each 'sync' to build the time series. The first run records a baseline; the second and later runs show drift. Use --no-capture to diff the two most recent existing snapshots without recording a new one.

Fleet-wide patch posture. Reads locally synced endpoints across every organization and ranks them by missing-update count (critical first), a view the org-scoped Action1 API does not provide. Missing-update counts come from the endpoint's missing_updates summary, which Action1 returns only when the endpoint was synced with fields including missing_updates. Endpoints without the summary are reported with zero counts.

The action queue that closes out a patch cycle. Scans locally synced endpoints across every organization and lists those reporting reboot_required, ranked by remaining critical updates. Reboot state is buried per-endpoint per-org in the Action1 API; this is one fleet-wide list. Use this command for the concrete list of machines waiting on a reboot to finish patching. Do NOT use it for a composite ranking; use 'fleet health-score' instead.

Fleet-wide installed-software inventory. Action1 reports installed software per endpoint within one organization. This deduplicates locally synced installed-software records across every organization into name x version rows with install counts and the number of organizations and endpoints affected — the asset-management view the org-scoped API cannot produce.

Dark-agent detection across the whole fleet. Reads locally synced endpoints from every organization and surfaces those whose last check-in is older than --days, or that report an offline status. Action1 has no "show me dark agents" query; this is a time-windowed scan over the local store.

Exploit-aware vulnerability triage across the whole fleet. Reads locally synced vulnerabilities from every organization and ranks them by a priority score = CVSS x affected endpoints, doubled when the CVE is in the CISA Known-Exploited Vulnerabilities catalog. The org-scoped Action1 API lists vulnerabilities one organization at a time and offers no cross-org ranking.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

CISA KEV CVEs across all orgs, ranked by affected endpoints and CVSS.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources