Cisco Umbrella

MCP server for Cisco Umbrella's deployment, admin, policy, reporting, and investigate APIs.

Connector by WYRE-AI · GitHub account verified by the MCP Registry

IndexedLicense unknownLocal (stdio)

Chalk Labs

Need help deploying Cisco Umbrella?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/wyre-ai-cisco-umbrella-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

MCP server for Cisco Umbrella's deployment, admin, policy, reporting, and investigate APIs.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 22 read · 1 write · 0 delete · 8 not yet classified
Secrets: 2 (API keys, tokens or passwords)
Install scripts: Not scanned yet
Runs as: Docker image

Tools by what they do 31

Read from the source code; the running server may list different tools.

Read 22 · Look things up without changing anything.

umbrella_appdiscovery_app_identities
umbrella_appdiscovery_app_risk
umbrella_appdiscovery_applications
umbrella_domain_categorization
umbrella_domain_risk_score
umbrella_domain_security_score
umbrella_domain_volume
umbrella_get_internal_domains
umbrella_get_samples
umbrella_get_user
umbrella_identities
umbrella_list_api_keys

Show 10 more tools

umbrella_list_destination_lists
umbrella_list_destinations
umbrella_list_internal_networks
umbrella_list_networks
umbrella_list_roaming_computers
umbrella_list_roles
umbrella_list_sites
umbrella_list_users
umbrella_list_virtual_appliances
umbrella_top_most_seen_domains

Write 1 · Create, change, send or run things.

umbrella_domain_resource_records

Not yet classified 8 · We could not tell from the name and description.

umbrella_activity
umbrella_api_usage_keys
umbrella_api_usage_requests
umbrella_api_usage_responses
umbrella_api_usage_summary
umbrella_top_categories
umbrella_top_destinations
umbrella_total_requests

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

CISCOUMBRELLA_API_KEY
CISCOUMBRELLA_API_SECRET

Other settings (environment variables or headers).

AUTH_MODE
LOG_LEVEL
MCP_TRANSPORT

Tools (31)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

umbrella_activity
Raw activity (request-level) log over a time range, optionally broken down by traffic type.
umbrella_api_usage_keys
API usage broken down by API key over a date range.
umbrella_api_usage_requests
Detailed API request log over a date range.
umbrella_api_usage_responses
Detailed API response log over a date range.
umbrella_api_usage_summary
Summary of this organization's Umbrella API usage over a date range.
umbrella_appdiscovery_app_identities
List the identities (users/devices) observed using a specific discovered application.
umbrella_appdiscovery_app_risk
Get risk details for a specific discovered application. Cisco's own Postman collection lists this endpoint under both "App Details" and "App Risk Details" - they are the same URL.
umbrella_appdiscovery_applications
List cloud applications discovered in this organization's traffic (App Discovery).
umbrella_domain_categorization
Get the content/security categorization for a domain.
umbrella_domain_resource_records
Get passive DNS resource records (historical DNS resolutions) for a domain.
umbrella_domain_risk_score
Get Cisco's risk score for a domain (higher = riskier).
umbrella_domain_security_score
Get detailed security scoring signals for a domain (DGA score, perplexity, entropy, Secure Rank, etc).
umbrella_domain_volume
Get DNS query volume over time for a domain.
umbrella_get_internal_domains
Get all internal domains configured to bypass Umbrella DNS resolution.
umbrella_get_samples
Get malware/file samples associated with a domain, IP, or URL.

Show 16 more tools

umbrella_get_user
Get a specific Umbrella admin console user by user ID.
umbrella_identities
List identities (roaming computers, networks, mobile devices, AD users) with traffic summaries, filtered by one or more identity types.
umbrella_list_api_keys
List all API keys configured for this Umbrella organization.
umbrella_list_destination_lists
List all destination lists (allow/block lists) configured for this Umbrella organization.
umbrella_list_destinations
List the destinations (domains/URLs/IPs) contained in a specific destination list.
umbrella_list_internal_networks
List internal (RFC1918) networks registered for internal-network identities.
umbrella_list_networks
List Cisco Umbrella networks (public IP identities) registered to this organization.
umbrella_list_roaming_computers
List all roaming computers enrolled via the Umbrella roaming client.
umbrella_list_roles
List all administrative roles available in this Umbrella organization.
umbrella_list_sites
List Umbrella sites (logical groupings of virtual appliances/internal networks).
umbrella_list_users
List all admin console users for this Umbrella organization.
umbrella_list_virtual_appliances
List all Umbrella virtual appliances (on-prem DNS forwarders) and their status.
umbrella_top_categories
Report of the most-requested content/security categories over a time range.
umbrella_top_destinations
Report of the most-requested destinations (domains) over a time range, optionally broken down by traffic type.
umbrella_top_most_seen_domains
Get Cisco's list of the top million most globally-popular domains.
umbrella_total_requests
Total DNS/proxy/firewall request counts over a time range, optionally broken down by traffic type.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit: Oct 22, 2026 (10 days ago)
Last release: Oct 22, 2026 (10 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.WYRE-AI/cisco-umbrella-mcp
Version: 1.0.3
Auth: API key
Packages: oci ghcr.io/wyre-ai/cisco-umbrella-mcp:v1.0.3
License: License unknown
Repository: github.com/WYRE-AI/cisco-umbrella-mcp
Website: github.com/WYRE-AI/cisco-umbrella-mcp
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

More from WYRE-AI

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped: 50+; launches shipped
media placements: 500+; media placements
founders on every account: 2; founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get Cisco Umbrella running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Need help deploying Cisco Umbrella?

Call Get help

Cite this page

Cisco Umbrella MCP server. Agent Mart. https://agentmart.dev/connectors/wyre-ai-cisco-umbrella-mcp (last updated 2026-10-24)