loading…
Review suspicious activity across our SaaS apps for this employee
/api/mcp/srv-saas-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Calculate user risk score based on access patterns, privilege changes, and behavioral anomalies across connected SaaS applications
{
"type": "object",
"required": [],
"properties": {
"email": {
"type": "string"
},
"user_id": {
"type": "string"
},
"time_window": {
"enum": [
"7d",
"30d",
"90d"
],
"type": "string",
"default": "30d"
},
"risk_factors": {
"type": "array",
"items": {
"enum": [
"privilege_escalation",
"unusual_access",
"geographic_anomaly",
"off_hours_activity",
"data_exfiltration"
],
"type": "string"
}
},
"include_peer_comparison": {
"type": "boolean",
"default": true
}
}
}Create a security incident from one or more alerts for coordinated response and tracking
{
"type": "object",
"required": [
"title",
"severity",
"alert_ids"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string"
}
}
}Retrieve detailed information for a specific security alert including evidence, affected users, and remediation recommendations
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"alert_id": {
"type": "string"
},
"include_evidence": {
"type": "boolean",
"default": true
},
"include_timeline": {
"type": "boolean",
"default": true
}
}
}Retrieve security configuration assessment for a SaaS application including misconfigurations, compliance gaps, and remediation guidance
{
"type": "object",
"required": [
"application_id"
],
"properties": {
"application_id": {
"type": "string"
},
"assessment_type": {
"type": "array",
"items": {
"enum": [
"configuration",
"permissions",
"compliance",
"integration"
],
"type": "string"
}
},
"severity_filter": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"include_remediation": {
"type": "boolean",
"default": true
}
}
}Retrieve comprehensive risk assessment for a SaaS application including security posture, compliance status, and risk metrics
{
"type": "object",
"required": [
"application_id"
],
"properties": {
"application_id": {
"type": "string"
},
"include_historical": {
"type": "boolean",
"default": false
}
}
}Execute threat hunting queries across SaaS application logs and user activity using behavioral analytics and IOCs
{
"type": "object",
"required": [
"hunt_query",
"time_range"
],
"properties": {
"iocs": {
"type": "array",
"items": {
"type": "string"
}
},
"hunt_query": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"user_filter": {
"type": "string"
},
"applications": {
"type": "array",
"items": {
"type": "string"
}
},
"include_baselines": {
"type": "boolean",
"default": false
}
}
}Retrieve all monitored SaaS applications with their security posture scores, risk levels, and connection status
{
"type": "object",
"required": [],
"properties": {
"category": {
"type": "array",
"items": {
"enum": [
"collaboration",
"crm",
"hr",
"finance",
"productivity",
"storage",
"identity"
],
"type": "string"
}
},
"risk_level": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"include_metrics": {
"type": "boolean",
"default": true
},
"connection_status": {
"type": "array",
"items": {
"enum": [
"connected",
"disconnected",
"error",
"pending"
],
"type": "string"
}
}
}
}Retrieve security policies and compliance rules configured across SaaS applications with violation counts and enforcement status
{
"type": "object",
"required": [],
"properties": {
"application": {
"type": "string"
},
"policy_type": {
"type": "array",
"items": {
"enum": [
"dlp",
"access_control",
"compliance",
"configuration",
"behavioral"
],
"type": "string"
}
},
"enforcement_status": {
"type": "array",
"items": {
"enum": [
"enforced",
"monitor_only",
"disabled"
],
"type": "string"
}
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"sox",
"pci",
"hipaa",
"gdpr",
"iso27001"
],
"type": "string"
}
}
}
}Retrieve policy violations across SaaS applications with filtering by policy type, severity, and compliance framework
{
"type": "object",
"required": [],
"properties": {
"status": {
"type": "array",
"items": {
"enum": [
"active",
"remediated",
"accepted",
"suppressed"
],
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "7d"
},
"policy_type": {
"type": "array",
"items": {
"enum": [
"access_control",
"data_protection",
"encryption",
"sharing",
"retention",
"authentication"
],
"type": "string"
}
},
"application_id": {
"type": "string"
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"sox",
"pci",
"hipaa",
"gdpr",
"iso27001",
"nist"
],
"type": "string"
}
}
}
}Search security alerts across all connected SaaS applications using filters for severity, application, detection rule, and time range
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000,
"minimum": 1
},
"query": {
"type": "string",
"description": "Free-text search query"
},
"rule_id": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"info"
],
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"application": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Execute automated remediation actions like user suspension, session termination, file quarantine, or access revocation across SaaS applications
{
"type": "object",
"required": [
"action"
],
"properties": {
"action": {
"enum": [
"suspend_user",
"terminate_sessions",
"quarantine_file",
"revoke_access",
"reset_password",
"disable_app_access"
],
"type": "string"
},
"reason": {
"type": "string"
},
"user_id": {
"type": "string"
},
"alert_id": {
"type": "string"
},
"application": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": false
}
}
}Initiate a security scan of a specific SaaS application to detect misconfigurations, compliance violations, and security risks
{
"type": "object",
"required": [
"application_id"
],
"properties": {
"priority": {
"enum": [
"high",
"normal",
"low"
],
"type": "string",
"default": "normal"
},
"scan_type": {
"enum": [
"full",
"compliance",
"permissions",
"configuration",
"quick"
],
"type": "string",
"default": "full"
},
"application_id": {
"type": "string"
}
}
}Update alert status, assign to analyst, add notes, or escalate to incident for investigation and response workflow
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"resolved",
"false_positive",
"escalated"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"priority": {
"enum": [
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"escalate_to_incident": {
"type": "boolean",
"default": false
}
}
}Change the status of a security alert and add investigation notes or resolution details
{
"type": "object",
"required": [
"alert_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"open",
"in_progress",
"resolved",
"false_positive"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"assignee": {
"type": "string"
},
"resolution_reason": {
"enum": [
"mitigated",
"policy_updated",
"user_educated",
"false_positive",
"duplicate"
],
"type": "string"
}
}
}