Fleet MCP

Create or update an MDM Apple Setup Assistant. Creates or updates the Setup Assistant profile for automatic enrollment (DEP/ADE). The Setup Assistant customizes the out-of-box experience for devices enrolled via Apple Business Manager. Args: name: Name for the Setup Assistant configuration enrollment_profile: JSON string containing the Setup Assistant profile team_id: Optional team ID (None for no team/global) Returns: Dict containing the created/updated Setup Assistant configuration. Example: >>> import json >>> profile = { ... "skip_setup_items": { ...…

Create a new team in Fleet. Args: name: Name for the team description: Optional description of the team Returns: Dict containing the created team information.

Create a new user in Fleet. Creates a new user with specified role and team assignments. Global roles: admin, maintainer, observer, observer_plus, gitops Team roles: admin, maintainer, observer, observer_plus, gitops Args: name: Full name of the user email: Email address (used for login) password: Password for the user (required if not SSO) global_role: Optional global role assignment teams: Optional list of team assignments with roles sso_enabled: Whether SSO is enabled for this user api_only: Whether this is an API-only user (no UI access) Returns: Dict co…

Delete a bootstrap package for a team. Removes the bootstrap package configured for a team. This will prevent the package from being installed on newly enrolled devices. Args: team_id: Team ID to delete the bootstrap package from (0 for no team) Returns: Dict indicating success or failure of the deletion.

Delete a custom variable from Fleet. Removes a custom variable that was previously created. This will affect any scripts or configuration profiles that reference this variable. Args: variable_id: ID of the custom variable to delete Returns: Dict indicating success or failure of the deletion. Example: >>> result = await fleet_delete_custom_variable(variable_id=123) >>> print(result["message"]) Warning: Deleting a variable that is currently used in scripts or profiles may cause those scripts/profiles to fail when executed.

Delete a host from Fleet. Note: A deleted host will fail authentication and may attempt to re-enroll if it still has a valid enroll secret. Args: host_id: The ID of the host to delete Returns: Dict indicating success or failure of the deletion.

Delete a pending invite from Fleet. Cancels a pending invite. The invite token will no longer be valid. Args: invite_id: ID of the invite to delete Returns: Dict containing the deletion result.

Delete a label from Fleet by name. Args: label_name: Name of the label to delete Returns: Dict indicating success or failure of the deletion.

Delete an MDM configuration profile. Removes a custom MDM configuration profile from Fleet. This will also remove the profile from all devices where it's installed. Note: Fleet-managed profiles (FileVault, etc.) cannot be deleted using this endpoint. Args: profile_uuid: UUID of the profile to delete Returns: Dict containing the result of the deletion.

Delete a pack from Fleet by name. Args: pack_name: Name of the pack to delete Returns: Dict containing the deletion result.

Delete a policy from Fleet. Args: policy_id: ID of the policy to delete Returns: Dict indicating success or failure of the deletion.

Delete a saved query from Fleet. Args: query_id: ID of the query to delete Returns: Dict indicating success or failure of the deletion.

Delete a script. Args: script_id: ID of the script to delete Returns: Dict indicating success or failure.

Delete a secret variable from Fleet by ID. Args: secret_id: ID of the secret variable to delete Returns: Dict containing the deletion result.

Delete/invalidate a specific session. Logs out a user by invalidating their session. Args: session_id: ID of the session to delete Returns: Dict containing the result of the deletion.

Delete the MDM Apple Setup Assistant. Removes the Setup Assistant profile for automatic enrollment. This will revert to the default Apple setup experience for newly enrolled devices. Args: team_id: Optional team ID (None for no team/global) Returns: Dict indicating success or failure of the deletion.

Delete all sessions for a specific user. Logs out a user from all devices by invalidating all their sessions. Args: user_id: ID of the user Returns: Dict containing the result of the deletion.

Delete a VPP token. Removes a Volume Purchase Program token from Fleet. This will also remove all associated App Store apps. Args: token_id: ID of the VPP token to delete Returns: Dict containing the result of the deletion.

Find specific software on a host by hostname. This is useful for answering questions like "What version of Firefox is XYZ-Machine using?" Args: hostname: The hostname of the host to search software_name: The name of the software to find (case-insensitive) Returns: Dict containing the software information if found.

Get details of a batch script execution. Args: batch_execution_id: The batch execution ID Returns: Dict containing batch script execution details.

Get metadata about a bootstrap package for a team. Returns information about the bootstrap package configured for a team, including name, SHA256 hash, and upload timestamp. Does not return the actual package bytes. Args: team_id: Team ID to get bootstrap package metadata for (0 for no team) Returns: Dict containing bootstrap package metadata. Example: >>> result = await fleet_get_bootstrap_metadata(team_id=0) >>> print(result) { "success": True, "message": "Retrieved bootstrap package metadata for team 0", "data": { "name": "bootstrap…

Get aggregated summary about bootstrap package deployment. Returns statistics about bootstrap package deployment status across hosts, including counts of installed, pending, and failed installations. Args: team_id: Optional team ID to scope the summary (None for all teams) Returns: Dict containing bootstrap package deployment summary.

Get detailed information about a specific carve session. Args: carve_id: The ID of the carve session to retrieve Returns: Dict containing detailed carve session information including metadata, status, and block information.

Get a specific block of data from a carve session. Carves are split into blocks for efficient transfer. This endpoint retrieves a specific block of the carved file. Args: carve_id: The ID of the carve session block_id: The ID of the block to retrieve (0-based) Returns: Dict containing the block data (base64 encoded).

Get the Fleet server certificate chain. Returns the PEM-encoded certificate chain used for osqueryd TLS termination. Returns: Dict containing the certificate chain.

Get the current Fleet application configuration. Returns the complete Fleet configuration including server settings, integrations, MDM settings, and more. Sensitive values are obfuscated. Returns: Dict containing the complete Fleet configuration. Example: >>> result = await fleet_get_config() >>> print(result) { "success": True, "message": "Retrieved Fleet configuration", "data": { "org_info": { "org_name": "Acme Corp", "org_logo_url": "https://example.com/logo.png" }, "server_setting…

Get detailed information about a specific CVE. Returns comprehensive information about a CVE including affected software, OS versions, and hosts. Args: cve: CVE identifier (e.g., CVE-2021-44228) team_id: Optional team ID to filter results Returns: Dict containing CVE details, affected software, and OS versions. Note: If the CVE is known to Fleet but doesn't affect any hosts, the API returns HTTP 204 (No Content) and this tool will return success=True with empty software/os_versions lists.

Get device information using a device token. This endpoint is used by Fleet Desktop to retrieve device-specific information using a device authentication token. Args: device_token: The device authentication token Returns: Dict containing device information. Example: >>> result = await fleet_get_device_info(device_token="abc123...") >>> print(result["device"])

Get the enrollment secrets configuration. Returns the enrollment secrets used for enrolling new hosts to Fleet. These secrets are used by osquery agents to authenticate with Fleet. Returns: Dict containing enrollment secrets for global and team-specific enrollment.

Get FileVault encryption summary. Returns aggregated statistics about FileVault disk encryption status across macOS hosts. Args: team_id: Optional team ID to scope the summary Returns: Dict containing FileVault encryption summary.

Get detailed information about a specific host. Args: host_id: The ID of the host to retrieve Returns: Dict containing detailed host information.

Get host by hostname, UUID, or hardware serial number. The tool automatically handles partial hostname matching - if you provide a short hostname like 'host-abc123', it will find the full hostname 'host-abc123.example.com' automatically. Args: identifier: Host identifier (hostname, UUID, or hardware serial) Returns: Dict containing host information if found.

Get device mapping information for a specific host. Device mapping associates a host with a user email address. Args: host_id: ID of the host Returns: Dict containing device mapping information. Example: >>> result = await fleet_get_host_device_mapping(host_id=123) >>> print(result["device_mapping"])

Get disk encryption recovery key for a specific host. This endpoint retrieves the FileVault or BitLocker recovery key for a host. Requires MDM enrollment and disk encryption to be enabled. Args: host_id: ID of the host Returns: Dict containing the encryption recovery key. Example: >>> result = await fleet_get_host_encryption_key(host_id=123) >>> print(result["encryption_key"]["key"])

Get macadmins data (Munki, MDM profiles) for a specific host. This endpoint returns macadmins-related data including Munki info and MDM profiles. Args: host_id: ID of the host Returns: Dict containing macadmins data for the host. Example: >>> result = await fleet_get_host_macadmins(host_id=123) >>> print(result["macadmins"]["munki_info"]["version"])

Get MDM information for a specific host. Args: host_id: ID of the host to get MDM information for Returns: Dict containing MDM information for the host.

Get MDM profiles installed on a specific host. Returns the list of MDM configuration profiles that are installed or pending installation on a specific host. Args: host_id: ID of the host Returns: Dict containing the host's MDM profiles and their status.

Get software installed on a specific host. Args: host_id: ID of the host to get software for query: Search query to filter software by name (case-insensitive) vulnerable: Filter to only vulnerable software (true) or non-vulnerable (false) Returns: Dict containing software installed on the host.

Get detailed information about a specific label. Args: label_id: The ID of the label to retrieve Returns: Dict containing detailed label information.

Get results of MDM commands. Retrieves the results of MDM commands. If command_uuid is provided, returns results for that specific command. Otherwise returns all results. Args: command_uuid: Optional UUID of a specific command to get results for Returns: Dict containing MDM command results.

Get summary of MDM profile deployment status. Returns aggregated statistics about MDM profile deployment across the fleet, including counts of verified, pending, and failed profiles. Args: team_id: Optional team ID to scope the summary Returns: Dict containing MDM profiles deployment summary.

Get detailed schema information for a specific osquery table. This tool retrieves comprehensive schema information including: - Column names, types, and descriptions - Platform availability - Usage examples - Special requirements and notes from Fleet's schema overrides Args: table_name: Name of the osquery table to get schema for host_id: Optional host ID to get live schema from (recommended) Returns: Dict containing detailed table schema, columns, types, usage examples, and any special requirements or notes from Fleet's schema overrides.

Get detailed information about a specific pack. Args: pack_id: The ID of the pack to retrieve Returns: Dict containing detailed pack information including queries.

Get compliance results for a specific policy. Args: policy_id: ID of the policy to get results for team_id: Filter results by team ID Returns: Dict containing policy compliance results.

Get details of a specific saved query. Args: query_id: ID of the query to retrieve Returns: Dict containing query details.

Get the latest stored results from a SCHEDULED query. IMPORTANT: This tool ONLY works for scheduled queries (queries with an 'interval' set that run periodically). It retrieves the stored results from the last time the scheduled query ran. This tool does NOT work for: - Ad-hoc queries that haven't been saved and scheduled - Queries that don't have 'interval' configured For running ad-hoc queries and getting results, use: - fleet_query_host(host_id, query) - Run query on ONE host and get results - fleet_query_host_by_identifier(identifier, query) - Run query by hostname/UUID - fleet_run_live…

Retrieve results from a previously started asynchronous query. This tool retrieves the current status and results of an async query that was started with fleet_run_live_query_with_results in async mode. Args: campaign_id: The campaign ID returned by fleet_run_live_query_with_results Returns: Dict containing: - success: Whether the request was successful - status: Current status (pending/running/completed/failed/cancelled) - campaign_id: The campaign ID - query: The SQL query that was executed - total_hosts: Total number of hosts targeted - results_count: Numb…

Get details of a specific script including its contents. Args: script_id: ID of the script to retrieve Returns: Dict containing script details including script_contents field.

Get the result of a script execution. Args: execution_id: The execution ID of the script run Returns: Dict containing script execution result.

Get session details by ID. Returns information about a specific session. Args: session_id: ID of the session Returns: Dict containing session details.

Get the MDM Apple Setup Assistant configuration. Returns the Setup Assistant profile configured for automatic enrollment (DEP/ADE). The Setup Assistant customizes the out-of-box experience for devices enrolled via Apple Business Manager. Args: team_id: Optional team ID (None for no team/global) Returns: Dict containing Setup Assistant configuration.

Get detailed information about a specific software item. Args: software_id: ID of the software item to retrieve Returns: Dict containing detailed software information including vulnerabilities.

Get the result of a software installation request. Args: install_uuid: UUID of the software installation request Returns: Dict containing the installation result including status and output.

Get detailed information about a specific software title. Args: title_id: ID of the software title team_id: Optional team ID to scope the query Returns: Dict containing detailed software title information including versions, hosts, and installation options.

Get details of a specific team. Args: team_id: ID of the team to retrieve Returns: Dict containing team details.

List team-specific enroll secrets. Args: team_id: ID of the team Returns: Dict containing team enroll secrets. Example: >>> result = await fleet_get_team_secrets(team_id=1) >>> print(result["secrets"])

Get user details by ID. Returns detailed information about a specific user including their roles, teams, and optionally UI settings. Args: user_id: ID of the user to retrieve include_ui_settings: Whether to include UI settings in response Returns: Dict containing user details.

Get the Fleet server version information. Returns version information about the Fleet server including version number, branch, revision, and build date. Returns: Dict containing Fleet server version information.

List known vulnerabilities across the fleet. This function retrieves vulnerabilities from the Fleet API and applies optional client-side filters to the results. Server-side filters (known_exploit, cve_search, order_key) are applied first, then client-side filters are applied to the returned data. Args: page: Page number for pagination (0-based) per_page: Number of vulnerabilities per page order_key: Field to order by (cve, created_at, hosts_count) order_direction: Sort direction (asc, desc) team_id: Filter vulnerabilities by team ID known_exploit: Filter to vulnerabil…

Check Fleet server connectivity and authentication. Returns: Dict containing health check results and server information.

Install software on a specific host. This triggers a software installation (VPP app or software package) on the specified host. The installation is asynchronous - use fleet_get_software_install_result to check the status. Args: host_id: ID of the host to install software on software_title_id: ID of the software title to install Returns: Dict containing the installation request details including install_uuid.

List activities in Fleet. Returns a list of all activities (audit log) with pagination support. Activities include user actions, system events, and configuration changes. Args: page: Page number for pagination (0-based) per_page: Number of activities per page order_key: Column to sort by (created_at, type, actor_email) order_direction: Sort direction (asc or desc) Returns: Dict containing list of activities and pagination metadata.

List App Store apps available for installation. Returns a list of VPP (Volume Purchase Program) apps that are available for installation on Apple devices. Args: team_id: Optional team ID to filter apps Returns: Dict containing list of App Store apps. Example: >>> result = await fleet_list_app_store_apps(team_id=1) >>> print(result) { "success": True, "message": "Retrieved 5 App Store apps", "data": { "app_store_apps": [ { "id": 1, "name": "Slack", "bundle_iden…

List all asynchronous query jobs. This tool lists all async queries with their current status, allowing you to track running queries and retrieve completed results. Args: status: Optional status filter (pending/running/completed/failed/cancelled) limit: Maximum number of queries to return (default: 50) Returns: Dict containing: - success: Whether the request was successful - queries: List of query job summaries - count: Number of queries returned - total_count: Total number of queries (before limit) Examples: # List all queries fleet_list_async_queries()…

List hosts targeted in a batch script execution. Args: batch_execution_id: The batch execution ID status: Filter by host status (ran, pending, errored, incompatible, canceled) page: Page number for pagination (0-based) per_page: Number of results per page Returns: Dict containing list of hosts and their script execution status.

List batch script executions. Args: team_id: Filter by team ID (Premium feature) status: Filter by status (started, scheduled, finished) page: Page number for pagination (0-based) per_page: Number of results per page Returns: Dict containing list of batch script executions.

List file carving sessions in Fleet. Carves are file extraction sessions initiated by osquery on hosts. This endpoint lists all carve sessions with their metadata. Args: page: Page number for pagination (0-based) per_page: Number of carves per page order_key: Field to order by (created_at, name, host_id) order_direction: Sort direction (asc, desc) Returns: Dict containing list of carve sessions and pagination metadata.

List all custom variables that can be used in scripts and profiles. Custom variables are prefixed with $FLEET_SECRET_ when used in scripts and configuration profiles. The values are hidden when viewed in the Fleet UI or API. Args: page: Page number for pagination (0-based) per_page: Number of variables per page Returns: Dict containing list of custom variables (without values) and pagination metadata. Example: >>> result = await fleet_list_custom_variables() >>> for var in result["custom_variables"]: ... print(f"ID: {var['id']}, Name: {var['name']}")

List certificates for a specific host with pagination. Args: host_id: ID of the host to get certificates for page: Page number for pagination (0-based) per_page: Number of certificates per page Returns: Dict containing list of certificates and pagination metadata.

List past activities for a specific host. Args: host_id: ID of the host to get past activities for page: Page number for pagination (0-based) per_page: Number of activities per page Returns: Dict containing list of past activities and pagination metadata.

List scripts available for a specific host. Args: host_id: ID of the host page: Page number for pagination (0-based) per_page: Number of results per page Returns: Dict containing list of scripts available for the host.

List upcoming activities for a specific host. Args: host_id: ID of the host to get upcoming activities for page: Page number for pagination (0-based) per_page: Number of activities per page Returns: Dict containing list of upcoming activities and pagination metadata.

List hosts in Fleet with optional filtering and pagination. Args: page: Page number for pagination (0-based) per_page: Number of hosts per page (max 500) query: Search query to filter hosts by hostname, UUID, hardware serial, or IPv4 team_id: Filter hosts by team ID status: Filter by host status (online, offline, mia) order_key: Field to order by (hostname, computer_name, platform, status) order_direction: Sort direction (asc, desc) Returns: Dict containing list of hosts and pagination metadata.

List all pending user invites in Fleet. Invites are sent to users to join Fleet. This endpoint lists all pending invites that haven't been accepted yet. Args: page: Page number for pagination (0-based) per_page: Number of invites per page order_key: Field to order by (created_at, email, name) order_direction: Sort direction (asc, desc) Returns: Dict containing list of pending invites.

List all labels in Fleet with optional filtering and pagination. Args: page: Page number for pagination (0-based) per_page: Number of labels per page order_key: Field to order by (name, created_at, updated_at) order_direction: Sort direction (asc, desc) team_id: Filter labels by team ID Returns: Dict containing list of labels and pagination metadata.

List all Apple MDM installers. Args: team_id: Optional team ID to filter installers Returns: Dict containing list of Apple MDM installers. Example: >>> result = await fleet_list_mdm_apple_installers() >>> print(result["installers"])

List MDM commands that have been executed. Returns a list of MDM commands (Apple and Windows) that have been sent to devices, including their status and results. Args: page: Page number for pagination (0-based) per_page: Number of commands per page Returns: Dict containing list of MDM commands with their status.

List all MDM-enrolled Apple devices. Returns a list of all Apple devices that are enrolled in MDM, including their serial numbers and enrollment status. Returns: Dict containing list of MDM-enrolled devices.

List MDM configuration profiles. Lists all MDM configuration profiles for Apple devices. Can be filtered by team. Args: team_id: Optional team ID to filter profiles Returns: Dict containing list of MDM configuration profiles.

List all available osquery tables with their schemas and descriptions. This tool dynamically discovers tables from: 1. Live osquery hosts (if host_id provided) - most accurate 2. Fleet's curated schema repository - rich metadata 3. Bundled schemas - offline fallback The tool uses a hybrid approach that combines live table discovery with Fleet's curated metadata to provide both accuracy and rich documentation. Args: host_id: Optional host ID to discover tables from (recommended for accuracy) platform: Filter tables by platform (darwin, linux, windows, chrome) search: Search table…

List all query packs in Fleet with optional filtering and pagination. Args: page: Page number for pagination (0-based) per_page: Number of packs per page order_key: Field to order by (name, created_at, updated_at) order_direction: Sort direction (asc, desc) team_id: Filter packs by team ID Returns: Dict containing list of packs and pagination metadata.

List policies with optional filtering by team and name. Search modes (automatic based on query): - Single word: Fast substring search (e.g., "firewall" finds "Firewall Enabled") - Multiple words: Keyword search with ranking (e.g., "Logged System" matches policies containing "Logged" OR "System", ranked by relevance) Tips for efficient use: - Use single-word queries for fastest results - Use team_id to narrow scope and see both team-specific and inherited policies - Use search_all_teams=True to search across all teams when you don't know which team - Multi-word queries automatically filter …

List all saved queries in Fleet. Args: page: Page number for pagination (0-based) per_page: Number of queries per page order_key: Field to order by (name, updated_at, created_at) order_direction: Sort direction (asc, desc) team_id: Filter queries by team ID Returns: Dict containing list of queries and pagination metadata.

List scheduled queries in a specific pack. Args: pack_id: The ID of the pack page: Page number for pagination (0-based) per_page: Number of queries per page Returns: Dict containing list of scheduled queries in the pack.

List all scripts available in Fleet. Args: team_id: Filter scripts by team ID (Premium feature) page: Page number for pagination (0-based) per_page: Number of scripts per page Returns: Dict containing list of scripts and pagination metadata.

List secret variables in Fleet. Secret variables are encrypted values that can be used in scripts and profiles. This endpoint returns only the names, IDs, and timestamps - NOT the actual secret values. Secret variable names must be UPPERCASE with underscores (e.g., "API_KEY", "DB_PASSWORD"). Args: page: Page number for pagination (0-based) per_page: Number of secrets per page Returns: Dict containing list of secret variable identifiers (id, name, updated_at).

List software inventory across the fleet. Args: page: Page number for pagination (0-based) per_page: Number of software items per page order_key: Field to order by (name, hosts_count, vulnerabilities_count) order_direction: Sort direction (asc, desc) query: Search query to filter software by name team_id: Filter software by team ID vulnerable: Filter to only vulnerable software (true) or non-vulnerable (false) Returns: Dict containing list of software and pagination metadata.

List software titles in Fleet. Software titles represent unique software products that may have multiple versions installed across hosts. This is different from fleet_list_software which lists individual software versions. Args: page: Page number for pagination (0-based) per_page: Number of titles per page order_key: Field to order by (name, hosts_count) order_direction: Sort direction (asc, desc) query: Search query to filter titles by name team_id: Filter titles by team ID available_for_install: Filter to titles available for installation Returns: Dict cont…

List all users that are members of a specific team. Args: team_id: ID of the team Returns: Dict containing list of users in the team. Example: >>> result = await fleet_list_team_users(team_id=1) >>> print(result["users"])

List all teams in Fleet with pagination and sorting. Args: page: Page number for pagination (0-based) per_page: Number of teams per page order_key: Field to order by (name, created_at) order_direction: Sort direction (asc, desc) query: Search query to filter teams by name Returns: Dict containing list of teams and pagination metadata.

List active sessions for a user. Returns all active sessions for a specific user. Args: user_id: ID of the user Returns: Dict containing list of user sessions.

List users in Fleet. Returns a list of all users with pagination and filtering support. Args: page: Page number for pagination (0-based) per_page: Number of users per page order_key: Column to sort by (name, email, created_at, etc.) order_direction: Sort direction (asc or desc) query: Search query to filter users team_id: Optional team ID to filter users by team Returns: Dict containing list of users.

List VPP tokens configured in Fleet. Returns a list of Volume Purchase Program tokens that are configured for App Store app distribution. Returns: Dict containing list of VPP tokens.

Lock an MDM-enrolled device remotely. Sends a DeviceLock command to an MDM-enrolled Apple device, which will lock the device and require a PIN to unlock. Args: host_id: ID of the host to lock Returns: Dict containing the result of the lock command.

Lock a host device remotely. This sends a lock command to the host device. The device will be locked and require authentication to unlock. Args: host_id: ID of the host to lock Returns: Dict containing lock status and any unlock PIN if applicable.

Modify an existing script. Args: script_id: ID of the script to modify script_contents: New contents of the script script_name: Optional name of the script to validate file type. If provided, the file extension determines validation: - .sh files MUST have a shebang line (e.g., #!/bin/bash) - .ps1 files can be uploaded as-is Returns: Dict containing updated script information. Raises: ValueError: If .sh script is missing a shebang line

Run an ad-hoc live query against a specific host and get results. This runs a query immediately against a single host and waits for results. The query will timeout if the host doesn't respond within the configured FLEET_LIVE_QUERY_REST_PERIOD (default 25 seconds). Args: host_id: ID of the host to query query: SQL query string to execute Returns: Dict containing query results from the host.

Run an ad-hoc live query against a host identified by UUID/hostname/serial. This runs a query immediately against a single host and waits for results. The query will timeout if the host doesn't respond within the configured FLEET_LIVE_QUERY_REST_PERIOD (default 25 seconds). The tool automatically handles partial hostname matching - if you provide a short hostname like 'host-abc123', it will find the full hostname 'host-abc123.example.com' automatically. Args: identifier: Host UUID, hostname (full or partial), or hardware serial number query: SQL query string to execute Returns: …

Force a host to refetch and update its data immediately. This triggers the host to immediately report its current state to Fleet, updating information like installed software, OS version, and other details. Args: host_id: ID of the host to refetch Returns: Dict indicating success or failure of the refetch request. Example: >>> result = await fleet_refetch_host(host_id=123) >>> print(result["message"])

Remove labels from a host. This removes manual labels from a host. Only works with manual labels (not dynamic/query-based labels). Args: host_id: ID of the host to remove labels from label_names: List of label names to remove from the host Returns: Dict containing the operation result.

Remove a specific user from a team. Args: team_id: ID of the team user_id: ID of the user to remove Returns: Dict indicating success or failure of the operation. Example: >>> result = await fleet_remove_team_user(team_id=1, user_id=10) >>> print(result["message"])

Run a script on multiple hosts in a batch. Either host_ids or filters must be provided, but not both. Args: script_id: ID of the saved script to run host_ids: List of host IDs to target filters: Filter object with query, status, label_id, team_id not_before: UTC time when batch should start (ISO 8601 format) Returns: Dict containing batch execution ID.

Execute a live query and wait for results via WebSocket. This tool runs a live query campaign and collects results in real-time via WebSocket. It creates a campaign, connects to Fleet's WebSocket API, and streams results back as they arrive. Progress notifications are sent as results arrive. ⚠️ IMPORTANT NOTES: 1. This tool BLOCKS until timeout or all results are collected 2. You will see progress updates as hosts respond 3. Not all hosts may respond within the timeout period 4. Results are collected in real-time as they stream in 🔄 ASYNC MODE (when FLEET_USE_ASYNC_QUERY_MODE=true): - Que…

Run a saved query against specified hosts. Args: query_id: ID of the saved query to run host_ids: List of specific host IDs to target label_ids: List of label IDs to target hosts team_ids: List of team IDs to target hosts Returns: Dict containing query execution results and campaign information.

Run a script on a specific host. Only one of script_id, script_contents, or script_name should be provided. Args: host_id: ID of the host to run the script on script_id: ID of an existing saved script script_contents: Contents of the script to run (max 10,000 characters) script_name: Name of an existing saved script (requires team_id) team_id: Team ID (required if using script_name) Returns: Dict containing execution ID and host ID. Example: >>> # Run a saved script by ID >>> result = await fleet_run_script(host_id=123, script_id=5) >>> print(result) …

Search for hosts by hostname, UUID, hardware serial, or IP address. Args: query: Search term (hostname, UUID, serial number, or IP) page: Page number for pagination (0-based) per_page: Number of results per page (max 500) order_key: Field to order by (hostname, computer_name, platform, status) order_direction: Sort direction (asc, desc) Returns: Dict containing matching hosts and pagination metadata.

Search for software by name across the fleet. Args: query: Search term for software name limit: Maximum number of results to return team_id: Filter search by team ID vulnerable: Filter to only vulnerable software (true) or non-vulnerable (false) Returns: Dict containing matching software titles.

Suggest relevant osquery tables based on query intent or keywords. This tool helps you find the right osquery tables for your query by: 1. Analyzing your intent (e.g., "find installed software", "check network connections") 2. Matching keywords against table names, descriptions, and columns 3. Providing relevance scores to rank suggestions 4. Including usage examples and metadata BEST PRACTICES: - Describe what you want to find, not how to find it - Use natural language (e.g., "running processes" not "SELECT * FROM processes") - Specify host_id for most accurate results (discovers custom tab…

Transfer hosts to a different team. Args: team_id: Target team ID (use 0 for "No team") host_ids: List of host IDs to transfer Returns: Dict indicating success or failure of the transfer.

Unenroll a host from MDM. This removes the host from MDM management. The host will no longer receive MDM profiles or commands. Args: host_id: ID of the host to unenroll from MDM Returns: Dict indicating success or failure of the unenrollment.

Unlock a host device remotely. This sends an unlock command to the host device. For some platforms, this may return an unlock PIN that needs to be entered on the device. Args: host_id: ID of the host to unlock Returns: Dict containing unlock status and any unlock PIN if applicable.

Update an App Store app's settings. Updates the configuration of an existing App Store app, such as self-service availability and label filters. Args: title_id: Software title ID of the app team_id: Optional team ID self_service: Whether users can install the app themselves labels_include_any: Optional list of labels - install if host has any labels_exclude_any: Optional list of labels - don't install if host has any Returns: Dict containing the updated app information.

Update the Fleet application configuration. Updates Fleet's configuration settings. Use dry_run=True to validate changes without applying them. Args: config: Configuration object with settings to update force: Bypass strict JSON validation dry_run: Validate changes without applying them Returns: Dict containing the updated configuration.

Update the enrollment secrets configuration. Updates the enrollment secrets used for enrolling new hosts. Args: secrets: List of enrollment secret strings dry_run: Validate changes without applying them Returns: Dict containing the result of the update.

Update an existing invite in Fleet. Allows modifying the role and team assignments of a pending invite before it's accepted. Args: invite_id: ID of the invite to update name: New name for the user position: New position for the user global_role: New global role (admin, maintainer, observer, observer_plus, gitops) teams: New team assignments with roles Returns: Dict containing the updated invite information.

Update an existing label in Fleet. Args: label_id: ID of the label to update name: New name for the label (optional) description: New description for the label (optional) query: New SQL query for the label (optional) Returns: Dict containing the updated label information.

Update an existing pack in Fleet. Args: pack_id: ID of the pack to update name: New name for the pack (optional) description: New description for the pack (optional) Returns: Dict containing the updated pack information.

Update an existing policy in Fleet. Args: policy_id: ID of the policy to update name: New name for the policy query: New SQL query for the policy description: New description for the policy resolution: New resolution steps for the policy critical: Whether this is a critical policy Returns: Dict containing the updated policy information.

Update user information and roles. Updates an existing user's information, role assignments, or settings. Args: user_id: ID of the user to update name: New name for the user email: New email address password: New password global_role: New global role assignment teams: New team assignments with roles sso_enabled: Whether SSO is enabled api_only: Whether this is an API-only user Returns: Dict containing the updated user information.

Upload a bootstrap package for MDM enrollment. Uploads a bootstrap package (.pkg file) that will be installed on devices during MDM enrollment. The package is deployed to devices enrolled via Apple Business Manager (DEP/ADE). Note: The package_content should be base64-encoded package data. Fleet expects multipart/form-data upload, but for MCP we accept base64-encoded content. Args: package_content: Base64-encoded bootstrap package (.pkg) content team_id: Team ID to assign the package to (0 for no team) Returns: Dict indicating success or failure of the upload. Example: >>>…

Upload a new Apple MDM installer package. Args: installer_filename: Name of the installer file (e.g., "installer.pkg") installer_content: Content of the installer file (base64 or raw) team_id: Optional team ID to associate with the installer Returns: Dict containing the uploaded installer details. Example: >>> result = await fleet_upload_mdm_apple_installer( ... installer_filename="installer.pkg", ... installer_content="<file content>", ... team_id=1 ... ) >>> print(result["installer"])

Upload a new MDM configuration profile. Uploads a custom MDM configuration profile (.mobileconfig for Apple, .xml for Windows) to Fleet. The profile will be deployed to devices based on team assignment and optional label filters. Args: profile_content: The profile content (XML/plist format) team_id: Optional team ID to assign the profile to labels: Optional list of label names to filter deployment Returns: Dict containing the created profile information.

Verify an invite token and get invite details. This endpoint verifies that an invite token is valid and returns the invite details. Used when a user clicks an invite link. Args: token: The invite token from the invite email Returns: Dict containing the invite details if valid.