Breeze

Get one security control and its affected misconfigurations. Use after get_security_posture when the user asks why a specific control is failing or which entities it affects. Do not use this to list or search controls. Returns the control description and paginated misconfiguration summary. If truncated is true, call again with misconfig_offset + returned. For MSSP: pass the same tenant_id used for get_security_posture.

List entity summaries at or above a risk threshold. Skips entities excluded from all assessments. Use for high-risk asset questions; call get_entity_details for one entity's risk_breakdown. When truncated is true, call again with offset + returned. For MSSP: pass tenant_id from get_tenants when needed.

Get one entity with its risk. Use after search_entities, get_entities_by_risk, or get_control_details when the user asks about a specific entity. Do not use this to list or search entities. For MSSP: pass tenant_id from get_tenants when needed.

Get the authenticated tenant overall MITRE ATT&CK or NIST CSF score. Use for framework-level posture scores or breakdowns. Do not use for controls or affected entities; use get_security_posture and get_control_details instead. Returns framework and overall_score, plus data only when include_data is true. For MSSP: pass tenant_id from get_tenants when needed.

Get last scan time and whether a scan is currently running. Use for questions about scan freshness or in-progress scans. Do not use for security posture, controls, or misconfigurations — use get_security_posture / get_control_details instead. For MSSP: pass tenant_id from get_tenants when needed.

List security-control summaries for the authenticated tenant. Use this first for questions about security posture, gaps, compliance, or control counts. Returns pagination metadata; when truncated is true, call again with offset + returned. For one control description and its misconfigurations, call get_control_details with a control_id from this response. For MSSP: pass tenant_id from get_tenants when needed.

List all customer tenants managed by your MSSP organization. Returns each tenant's ID and company name. Only available for MSSP users — others get an empty list.

Report whether the Breeze MCP server is available. Use to confirm that the server is reachable before requesting workspace data.

List connected integrations for the authenticated tenant. Returns connected tool names. When truncated is true, call again with offset + returned. For MSSP: pass tenant_id from get_tenants when needed.

Search entities by display name substring. Use when the display names an asset, user, or identity and you need its unique_id. Returns summaries; call get_entity_details for risk breakdown. When truncated is true, call again with offset + returned. For MSSP: pass tenant_id from get_tenants when needed.