Cisco Umbrella MCP server

Cisco Umbrella MCP Server

MCP server for Cisco Umbrella's NextGen REST API - deployment inventory, admin, policy, reporting, and investigate visibility - for AI assistants and the WYRE Conduit gateway.

Authentication

Create an API Key in the Umbrella admin console (Admin > API Keys, or Console Settings > API Keys on a Multi-org/MSP console) to receive an API Key and API Secret pair.

The secret is shown only once at creation time and cannot be retrieved later - store it somewhere safe immediately.

This server exchanges that pair for a short-lived (1-hour) Bearer access token via POST /auth/v2/token (granttype=clientcredentials, HTTP Basic auth), and handles the exchange and its refresh on expiry internally. Callers only ever need to supply the long-lived API Key/Secret below.

A note on a real discrepancy in Cisco's own documentation: Cisco's published Postman collection (CiscoDevNet/cloud-security, Umbrella/PostmanExamples/umbrella-external-postman-collection.json) encodes the token request as a bare GET with no body, while Cisco's DevNet "Getting Started" and "Quickstart" prose docs both independently specify POST with a granttype=clientcredentials form body. This server follows the prose docs (POST), since two independent doc pages agree and it matches the standard OAuth2 client_credentials flow Cisco names explicitly - but this was not verified against a live credential pair. If token exchange 401s against a real account, try a bare GET with no body before assuming the credentials are bad.

Configuration

Tools

Deployments

• umbrellalistnetworks - list registered public-IP network identities.
• umbrellalistinternal_networks - list internal (RFC1918) network identities.
• umbrellalistsites - list Umbrella sites.
• umbrellalistvirtual_appliances - list virtual appliances and their status.
• umbrellalistroaming_computers - list roaming-client-enrolled computers.
• umbrellagetinternal_domains - get all internal domains configured to bypass Umbrella DNS.

Admin

• umbrellalistroles - list administrative roles.
• umbrellalistusers - list admin console users.
• umbrellagetuser - get a specific admin console user.
• umbrellalistapi_keys - list configured API keys.

Policies

• umbrellalistdestination_lists - list destination (allow/block) lists.
• umbrellalistdestinations - list destinations within a specific destination list.

Shortened. The full README is on GitHub.