Skip to main content

Frequently asked questions

Why do alert tools return no data on a new setup?​

A new Alerts API configuration starts empty. Its token only exposes alerts pushed to that configuration after creation. Wait for a new alert, or use an existing configuration that already has data.

GTI tools use a separate data source. Threat actor, CVE, feed, or IOC results can work while account alert results are empty.

How do I make sure new alerts and incidents reach MCP?​

Open the Alerts API configuration in the CloudSEK Platform and turn on Default. This routes new alerts and incidents to that configuration. If Default is off, records routed to other configurations do not appear through your MCP token.

Why can I read records but not update them?​

Almost always because the token predates the write release. Every Alerts API token issued from 30 July 2026 carries write access natively; a token created before that date can return alerts, snapshots, and audit data but cannot write changes.

Rotate it under CloudSEK Platform → Integrations → Alerts API → Rotate Token, against your existing integration configuration, then update CLOUDSEK_BEARER_TOKEN with the new value. No other setting changes.

If the token has write permission, check that you used an incident display ID such as XVA-1234, the event record identifier returned by CloudSEK, and exact case-sensitive status or priority values.

How do I revoke MCP access?​

Revoke or rotate the token under CloudSEK Platform → Integrations → Alerts API. Then remove or replace the token in every client configuration.

Deleting a local config entry removes access from that client, but it does not invalidate the token. Revoke the token if it may exist anywhere else.

Does disabling the Alerts API configuration stop MCP access?​

No. Disabling the configuration stops new alerts from entering its queue. The token remains valid and can read data already in the queue. Token revocation and configuration state are separate controls.

Can CloudSEK MCP make changes without my approval?​

CloudSEK MCP exposes write tools, but your AI client controls approval behavior. Review the client's tool permission settings. For sensitive work, require approval for each write and always inspect the target records first.

Prompt the client to show the current values, proposed values, and record count before it writes. Verify single-record changes in the audit trail and bulk changes with get_job_status.

Do I need to know tool names?​

No. Describe the result you want. Tool names are useful for debugging and for writing repeatable runbooks, but they are not required in normal prompts.

Do GTI tools need separate credentials?​

No. GTI tools are included on the hosted CloudSEK MCP endpoint. Your CloudSEK Bearer token and Org ID authenticate the MCP connection, and no second GTI token is required.

Can I connect from Claude.ai in a browser?​

Not currently. Claude.ai uses an OAuth flow that the CloudSEK MCP endpoint does not support. Use Claude Desktop or another client that can send the required Authorization and X-CloudSEK-Org-Id headers.

What happens if I repeat a write?​

Single-record writes are idempotent. If the record already has the requested value, the operation can succeed with changed: false. Identical comments on the same record are deduplicated.

Bulk jobs can report records as skipped when they are already in the requested state. A skipped no-op counts as a successful outcome, not a failed update.