ast action1

Managing remote endpoints at scale often involves constant context switching between the Action1 dashboard and your terminal. This skill provides a direct interface to Action1 RMM, allowing you to audit device inventory, inspect live processes, and manage software deployments without leaving your development environment. It bridges the gap between endpoint visibility and automated remediation while maintaining a strict safety model for production environments.

What it does

• Device Inventory Retrieves hardware details, online status, and network adapter configurations for managed workstations.
• Process Auditing Inspects live processes and installed software lists to identify unauthorized or vulnerable applications.
• Task Analysis Queries task history to verify previous deployment successes or troubleshoot failed script executions.
• Remote Execution Runs approved scripts and deploys software packages (install, uninstall, upgrade) on target hosts with system privileges.
• Credential Security Manages API secrets via the system keychain or encrypted local environment files to avoid chat leaks.

How it works

1. Discovery Use action1 lookup commands to identify specific hosts and their current operational state.
2. Audit Run read-only queries for processes or software to build evidence for a necessary change.
3. Approval Present the exact script or package action to the user; the agent waits for explicit confirmation before proceeding.
4. Execution Run the write operation via the CLI with --yes or via the gated MCP tool once an execution token is generated.

Frameworks & tools

The skill utilizes the ast-action1 CLI and sectools-mcp server. It requires Python 3.12+ and communicates with the Action1 API (app.action1.com) over HTTPS.

Why this beats prompting it yourself

Generic prompts cannot securely interface with RMM APIs or manage the stateful multi-step "dry run to execution" workflow required for Action1 writes. This skill enforces a specific safety protocol that prevents accidental mass-deployments and ensures every system change is logged and pre-approved.

Use cases

• Auditing a fleet for a specific vulnerable software version across all online hosts.
• Remotely reinstalling a corrupted management agent on a specific workstation.
• Checking live process trees on a host suspected of being compromised.
• Automating the deployment of emergency patches to a targeted subset of devices.

Known limitations

Does not support Intune-managed devices or CrowdStrike Real Time Response. Only supports the app.action1.com data center; other regions are not currently supported. deploy commands do not support winget on macOS or Linux.