CyberArk (Privilege Cloud) MCP Server
for AI Agents
Connect your AI agent to StackOne's CyberArk (Privilege Cloud) MCP server and give it 31 MCP tools out of the box. Auth, tool execution, and security all managed.
StackOne 
Coverage
31 Agent Actions
Create, read, update, and delete across CyberArk (Privilege Cloud) — and extend your agent's capabilities with custom actions.
Authentication
Agent Tool Authentication
Per-user OAuth in one call. Your CyberArk (Privilege Cloud) MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →
Security
Agent Protection
Every CyberArk (Privilege Cloud) tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.
Prompt Injection Defense →
Performance
Max Agent Context. Min Cost.
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every CyberArk (Privilege Cloud) call.
Tools Discovery →What is the CyberArk (Privilege Cloud) MCP Server?
A CyberArk (Privilege Cloud) MCP server lets AI agents read and write CyberArk (Privilege Cloud) data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's CyberArk (Privilege Cloud) MCP server ships with 31 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, observability, and agent execution runtime. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
All CyberArk (Privilege Cloud) MCP Tools
Every action from CyberArk (Privilege Cloud)'s API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.
Users
- Add User
Add a new user to Privilege Cloud via POST /Users
- Get Users
Retrieve a list of all existing users in Privilege Cloud via GET /Users
- Update User
Update an existing user via PUT /Users/{UserID}
- Delete User
Delete a specific user in Privilege Cloud via DELETE /Users/{UserID}
Groups
- Create Group
Add a new group via POST /UserGroups
- Get Groups
Retrieve a list of all existing user groups via GET /UserGroups
- Update Group
Update a Vault group via PUT /UserGroups/{groupId}
- Delete Group
Delete a Privilege Cloud group via DELETE /UserGroups/{GroupID}
Safes
- Add Safe
Add a new Safe to Privilege Cloud via POST /Safes
- Update Safe
Update a single Safe in Privilege Cloud via PUT /Safes/{SafeUrlId}
- Delete Safe
Delete a Safe from the Vault via DELETE /Safes/{safeUrlId}
Safe Members
- Add Safe Member
Add an existing user or group as a Safe member via POST /Safes/{safeUrlId}/Members
- Update Safe Member
Update an existing Safe member via PUT /Safes/{SafeUrlId}/Members/{MemberName}
- Remove Safe Member
Remove a member from a Safe via DELETE /Safes/{safeUrlId}/Members/{memberName}
Accounts
- Add Account
Add a new privileged account to Privilege Cloud via POST /Accounts
- Get Accounts
Retrieve a list of all privileged accounts via GET /Accounts
- Update Account
Update an existing account's details via PATCH /Accounts/{AccountID}
- Delete Account
Delete a specific account in the Vault via DELETE /Accounts/{id}
Other (13)
- Add Member To Group
Add a user as a member to an existing Vault group via POST /UserGroups/{id}/Members
- Get User Details
Retrieve information about a specific user via GET /Users/{UserID}
- Get Group Details
Retrieve details of a single user group via GET /UserGroups/{ID}
- Get All Safes
Retrieve a list of all Safes in the Vault via GET /Safes
- Get Safe Details
Retrieve information about a specific Safe via GET /Safes/{SafeUrlId}
- Get All Safe Members
Retrieve a list of members of a Safe via GET /Safes/{SafeUrlId}/Members
- Get Account Details
Retrieve details of a specific privileged account identified by its ID via GET /Accounts/{id}
- Get Password Value
Retrieve the password or SSH key of an existing account via POST /Accounts/{accountId}/Password/Retrieve
- Get Platforms
Retrieve all existing account platforms via GET /Platforms
- Get Platform Details
Retrieve details of a specific platform via GET /Platforms/{PlatformName}
- Remove User From Group
Remove a specific user from a user group in the Vault via DELETE /UserGroups/{groupID}/Members/{member}
- Activate User
Activate a suspended user via POST /Users/{UserID}/Activate
- Reset User Password
Reset an existing Vault user's password via POST /Users/{UserID}/ResetPassword
Set Up Your CyberArk (Privilege Cloud) MCP Server in Minutes
One endpoint. Any framework. Your agent is talking to CyberArk (Privilege Cloud) in under 10 lines of code.
Agent Frameworks
JSON{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}Check More developer MCP Servers
113+ actions
62+ actions
61+ actions
54+ actions
50+ actions
43+ actions
19+ actions
Platform Resources
MCP Code Mode: Keeping Tool Responses Out of Agent Context
Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.
11 min
Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
Indirect Prompt Injection Defense for MCP Tools: A Technical Guide
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
MCP vs A2A: Architecture, Security, and When to Use Each
MCP vs A2A: what each protocol standardizes, how they differ, their shared security risks including indirect prompt injection, and when to use one, both, or a hybrid architecture.
12 min
MCP vs API: What 200+ Connector Builds Taught Us
MCP wraps APIs, it doesn't replace them. After building 200+ connectors that serve both, here's when each approach wins.
14 min read
CyberArk (Privilege Cloud) MCP Server FAQ
Does StackOne have a CyberArk (Privilege Cloud) MCP server?
CyberArk (Privilege Cloud) MCP server vs direct API integration — what's the difference?
How does CyberArk (Privilege Cloud) authentication work for AI agents?
origin_owner_id.Are CyberArk (Privilege Cloud) MCP tools vulnerable to prompt injection?
What is the context bloat of a CyberArk (Privilege Cloud) agent and how do I avoid it?
Can I limit which actions my CyberArk (Privilege Cloud) agent can access?
Can I create custom agent actions for my CyberArk (Privilege Cloud) MCP server?
When should I NOT use a CyberArk (Privilege Cloud) MCP server?
What AI frameworks and AI clients does the StackOne CyberArk (Privilege Cloud) MCP server support?
Put your AI agents to work
All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.