servosity/msp-skills/action1

Action1 - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the action1-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/action1/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/action1/install.ps1 | iex ``

1. Verify: action1-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the action1-cli and action1-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Action1's REST API is organization-siloed - every call is scoped to one org and nothing is kept over time. This CLI mirrors the full API, then fans out across all your organizations into a local SQLite store so you can rank the worst-patched endpoints fleet-wide (fleet patch-posture), triage CVEs by blast radius and CISA KEV status (fleet vuln-triage), find dark agents (fleet stale), and diff patch drift week over week (fleet patch-drift). Agent-native output, typed exit codes, and offline search throughout.

When to Use This CLI

Use this CLI when an agent or technician needs to query Action1 patch, vulnerability, endpoint, software, automation, or report data - especially across multiple client organizations at once, offline, or over time. It is the right tool for fleet-wide patch posture, exploit-aware CVE triage, dark-agent detection, and patch-drift reporting that the org-scoped Action1 API cannot answer directly. All fleet commands read the local SQLite store; run sync --full first or they return empty results.

Anti-triggers

Do not use this CLI for:

• Do not use fleet commands for one client's live data - use the per-org commands (e.g. endpoints managed <orgId>, vulnerabilities list <orgId>) which call the API directly.
• Do not use fleet vuln-triage for a single CVE's detail - use cve-descriptions <cveId>.
• Do not run fleet commands before a sync - they read the local store and return [] until 'sync --full' has populated it.
• Do not use this CLI to remediate or deploy patches interactively in real time - launch automations via the automations commands and check results afterwards; there is no live remote-control surface beyond what the Action1 API exposes.

Unique Capabilities

Cross-org views the API can't give you

• `fleet patch-posture` - See every endpoint across all your client organizations ranked by how many updates it is missing - one fleet-wide view.

_Reach for this when an agent needs the worst-patched machines across the whole book of business, not one client at a time._

``bash action1-cli fleet patch-posture --agent --limit 25 ``

• `fleet vuln-triage` - Rank CVEs across every organization by how many endpoints they hit, weighted by CVSS and the CISA Known-Exploited flag.

_Pick this to answer 'what should we patch first across all clients' with exploit-aware prioritization._

``bash action1-cli fleet vuln-triage --kev-only --agent ``

• `fleet software-rollup` - Deduplicate installed software across the whole fleet into app name x version spread x install count.

_Use this for license counting and version-spread audits across all clients at once._

``bash action1-cli fleet software-rollup --name "Google Chrome" --agent ``

• `fleet automation-health` - Success and failure rates across automation instances and their per-endpoint results, aggregated across organizations.

_Use this to spot automations that are quietly failing on a subset of endpoints across clients._

``bash action1-cli fleet automation-health --agent ``

• `fleet org-scorecard` - One row per client organization: endpoint count, missing updates, open CVEs, KEV exposure, and stale agents - the per-client posture number MSPs report to account managers.

_Reach for this when an agent needs a per-client posture summary across every organization, not per-endpoint detail._

``bash action1-cli fleet org-scorecard --agent ``

• `fleet reboot-pending` - Every endpoint fleet-wide where an installed update is waiting on a reboot to finish - the action queue that closes out a patch cycle.

_Reach for this when an agent needs the concrete list of machines blocking patch-cycle completion, not a composite health score._

``bash action1-cli fleet reboot-pending --agent ``

Fleet health & drift

• `fleet stale` - Surface endpoints that have not checked in for N days, or are offline, across all organizations.

_Use this to find agents that silently stopped reporting before they become a coverage gap._

``bash action1-cli fleet stale --days 14 --agent ``

• `fleet patch-drift` - Diff two synced snapshots to show which updates were remediated and which newly appeared since last sync.

_Reach for this to prove remediation progress week over week, or catch regressions._

``bash action1-cli fleet patch-drift --agent ``

• `fleet health-score` - A single composite score per endpoint from missing updates, open vulnerabilities, reboot-required, and staleness - fleet-ranked.

_Pick this when you need a triage-ranked worst-to-best list of machines across the fleet._

``bash action1-cli fleet health-score --agent --limit 50 ``

Command Reference

audit - Manage audit

• action1-cli audit events-get - Requires permission: `view_audit` 'The Audit Trail contains event records associated with user actions
• action1-cli audit events-id-get - Requires permission: `view_audit` Get a specific audit record by its ID.
• action1-cli audit export-get - Requires permission: `view_audit` Exports audit data. Use parameters to filter out exported data.

automations - Manage automations

• action1-cli automations actions-templates-get - Gets a list of existing action templates.
• action1-cli automations actions-templates-template-id-get - Gets details for an action template specified by its ID.
• action1-cli automations policies-instances-org-id-get - **Requires permission
• action1-cli automations policies-instances-org-id-id-get - Requires permission: `view_automations` Gets details about a automation instance specified by its ID.
• action1-cli automations policies-instances-org-id-instance-id-endpoint-results-endpoint-id-details-get - **Requires permission
• action1-cli automations policies-instances-org-id-instance-id-endpoint-results-get - **Requires permission
• action1-cli automations policies-instances-org-id-instance-id-stop-post - **Requires permission
• action1-cli automations policies-instances-org-id-post - **Requires permission
• action1-cli automations policies-schedules-org-id-get - Requires permission: `view_automations` Lists existing scheduled automations.
• action1-cli automations policies-schedules-org-id-id-actions-action-id-delete - Requires permission: `manage_automations` Deletes a specified action from a scheduled automation.
• action1-cli automations policies-schedules-org-id-id-delete - Requires permission: `manage_automations` Deletes a scheduled automation specified by its ID.
• action1-cli automations policies-schedules-org-id-id-deployment-statuses-get - Requires permission: `view_automations` Gets the deployment statuses of a automation specified by its ID.
• action1-cli automations policies-schedules-org-id-id-get - Requires permission: `view_automations` Gets a scheduled automation specified by its ID.
• action1-cli automations policies-schedules-org-id-id-patch - **Requires permission
• action1-cli automations policies-schedules-org-id-post - Requires permission: `manage_automations` Schedules a new automation.

cve-descriptions - Manage cve descriptions

• action1-cli cve-descriptions <cveId> - Requires permission: `view_vulnerabilities` Retrieves detailed information about a specific vulnerability in general

data-sources - A data source is a scripting template that queries certain endpoint data, such as disk volume or local group members, and presents it in a structured way consumed by reports or alerts. Data sources can be built-in or custom (defined by 'builtin' parameter). Built-in data sources are maintained by Action1 and cannot be modified. Custom data sources can be created and maintained by the user.

• action1-cli data-sources all-post - Requires permission: `manage_data_sources` Creates a new custom data source.
• action1-cli data-sources org-id-get - **Requires one of the following permissions: manage_data_sources
• action1-cli data-sources org-id-id-delete - Requires permission: `manage_data_sources` Deletes an existing custom data source.
• action1-cli data-sources org-id-id-get - **Requires one of the following permissions: manage_data_sources
• action1-cli data-sources org-id-id-patch - Requires permission: `manage_data_sources` Updates a custom data source specified by its ID.

endpoints - The endpoint object represents a server, workstation, or other device managed by Action1 within a specific organization. Endpoints can only belong to one Action1 organization at one time, but can be moved between organizations.