Integration

Nightfall AI integration

Nightfall AI is a data loss prevention (DLP) platform. Scan text for sensitive data (PII, PHI, credentials, card numbers) with Nightfall detectors, inline regex or word-list rules or saved policies, and get redacted copies; triage DLP violations from connected SaaS apps (list, search, read redacted findings, acknowledge, quarantine, redact, resolve, annotate false positives); review exfiltration and data-posture events and their activity feeds; inventory the AI tooling on employee devices (MCP servers, agent plugins and hooks, IDE extensions); manage endpoint domain and MCP-server collections; and change which users or domains a Google Drive policy covers. To protect the people and content Nightfall monitors, responses never include user names or emails, email recipients, share lists, raw findings or their surrounding text from SaaS violations, email subjects, browser tab titles, AI-agent prompts, tool payloads, shell or hook commands, IP or MAC addresses, session keys, local file paths, or links to the scanned resources; the two tools that change a policy's user scope therefore return an empty result on success, because Nightfall's reply to them is the full list of user emails in the scope. Chunked file upload and file scanning are not exposed (they need raw byte uploads and a webhook receiver). Authentication is a Nightfall API key (Developer APIs, Overview, Create key) sent as a Bearer token. Rate limits are per key and endpoint: Free plan 5 requests per second (bursts of 15), Enterprise 10 per second (bursts of 50); a 429 carries Retry-After. The Free plan includes 3 GB of scanned data per month.

Connect Nightfall AI How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Nightfall AI.Built from the 56 Nightfall AI tools below, on the connection you add once.

What you can do with Nightfall AI

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Device, 6 operations

get_ai_governance_deviceGet ai governance deviceGETGets one device and the full, unpaginated list of MCP servers configured on it, with usage counts, risk and provenance per server. Pass a deviceId from list_ai_governance_devices.
list_ai_governance_devicesList ai governance devicesGETLists employee devices that have at least one MCP server installed, one row per device with its MCP server, hook, plugin and IDE-extension counts, OS and Nightfall agent status. Paginated with pageToken.
list_hook_devicesList hook devicesGETLists the devices that declare one hook (device id and machine name), with a short header describing the hook. Pass a hook id from list_ai_governance_hooks.
list_ide_extension_devicesList ide extension devicesGETLists the devices on which one IDE extension is installed (device id, machine name, clients, install time). Pass the opaque id from list_ide_extensions.
list_mcp_server_devicesList mcp server devicesGETLists the devices using one MCP server, with per-client launch and network-call counts and last use. Pass the opaque id from list_mcp_servers.
list_plugin_devicesList plugin devicesGETLists the devices that declare one AI-agent plugin (device id, machine name, status, version, bundled counts), with a short plugin header. Pass the opaque id from list_ai_governance_plugins.

Domain collection, 4 operations

create_domain_collectionCreate domain collectionPOSTCreates a manual endpoint domain collection (really, in the account). Names are case-insensitive unique per company; CORPORATE DOMAINS is reserved. Add domains with add_collection_domains.
delete_domain_collectionDelete domain collectionDELETEDeletes a manual endpoint domain collection (soft delete, really applied to the account). System collections cannot be deleted.
list_domain_collectionsList domain collectionsGETLists the endpoint DLP domain collections (manual and system), each with a truncated preview of its domains and the total domain count. Paginated with pageToken.
rename_domain_collectionRename domain collectionPUTRenames a manual endpoint domain collection; only the name changes. System collections cannot be renamed.

Mcp collection, 4 operations

create_mcp_collectionCreate mcp collectionPOSTCreates a manual MCP server collection (really, in the account). Names are case-insensitive unique per company. Add servers with add_mcp_collection_items.
delete_mcp_collectionDelete mcp collectionDELETEDeletes a manual MCP server collection (soft delete, really applied to the account).
list_mcp_collectionsList mcp collectionsGETLists the endpoint MCP server collections (manual and system) with their item counts. Paginated with pageToken.
rename_mcp_collectionRename mcp collectionPUTRenames a manual MCP server collection; only the name changes. System collections cannot be renamed.

Violation, 4 operations

act_on_violationsAct on violationsPOSTPerforms a remediation action on violations, really, in the connected apps (redact, quarantine, delete, notify, resolve...). Violations the action cannot apply to are ignored; some actions are queued. Returns the ids submitted.
get_violationGet violationGETGets one DLP violation: state, risk, possible actions, violated policies, detection rules, detectors, file details and app metadata (people, links and paths withheld). Pass an id from list_violations.
list_violationsList violationsGETLists DLP violations found in connected SaaS apps (Slack, Google Drive, Jira, Confluence, Salesforce, Zendesk, Notion, GitHub, M365, Gmail...) for a period, with state, risk, policies, detectors and app metadata. Paginated.
search_violationsSearch violationsGETSearches DLP violations with a filter expression in query (state, integration, policy, detector, risk, app-specific fields, user email). Returns the same rows as list_violations. Paginated.

Collection domain, 3 operations

add_collection_domainsAdd collection domainsPOSTAdds domains to an endpoint domain collection (really, in the account). Returns the domains added and failedDomains: personal-email provider domains are refused for the CORPORATE DOMAINS collection.
list_collection_domainsList collection domainsGETLists every active domain in one endpoint domain collection, with how each was added. Pass a collection id from list_domain_collections.
remove_collection_domainRemove collection domainDELETERemoves one domain from an endpoint domain collection (soft delete, really applied). Pass the domain id from list_collection_domains.

Exfiltration event, 3 operations

get_exfiltration_eventGet exfiltration eventGETGets one exfiltration event: assets (name, size, type, Drive or Salesforce metadata), the actor's Nightfall id, the underlying app events and possible actions. People, links and paths are withheld. Pass an id from list_exfiltration_events.
list_exfiltration_eventsList exfiltration eventsGETLists exfiltration events for a period: integration, state, event type, policies, asset count, app and device, with risk label and score. Paginated with pageToken.
search_exfiltration_eventsSearch exfiltration eventsGETSearches exfiltration events with a filter expression in query (state, event type, policy, resource, actor, integration, endpoint device). Returns the same rows as list_exfiltration_events. Paginated.

Mcp collection item, 3 operations

add_mcp_collection_itemsAdd mcp collection itemsPOSTAdds MCP server scopes to an MCP server collection (really, in the account). Each item names a server and optionally restricts it to some tools; omitting toolNames means all tools on that server.
list_mcp_collection_itemsList mcp collection itemsGETLists the items (MCP server scopes: server name and optional tool names) in one MCP server collection. Pass a collection id from list_mcp_collections.
remove_mcp_collection_itemRemove mcp collection itemDELETERemoves one server scope from an MCP server collection (really applied). Pass the item id from list_mcp_collection_items.

Posture event, 3 operations

get_posture_eventGet posture eventGETGets one posture event: assets (name, size, type, Drive or Salesforce metadata), the actor's Nightfall id, the underlying app events and possible actions. People, links and paths are withheld. Pass an id from list_posture_events.
list_posture_eventsList posture eventsGETLists posture events for a period: integration, state, event type, policies, asset count, app and device. Paginated with pageToken.
search_posture_eventsSearch posture eventsGETSearches posture events with a filter expression in query (state, event type, policy, resource, actor, integration, endpoint device). Returns the same rows as list_posture_events. Paginated.

Actor activity, 2 operations

list_exfiltration_actor_activityList exfiltration actor activityGETLists one actor's exfiltration-related activity in a time range (downloads, permission changes, uploads, clipboard): type, time, asset names and app metadata. Pass the actor id from get_exfiltration_event.
list_posture_actor_activityList posture actor activityGETLists one actor's posture-related activity in a time range (downloads, permission changes, uploads, clipboard): type, time, asset names and app metadata. Pass the actor id from get_posture_event.

Asset activity, 2 operations

list_exfiltration_asset_activityList exfiltration asset activityGETLists the activity on one asset in a time range (downloads, permission changes, uploads, clipboard): type, time, asset names and app metadata. Pass an asset id from get_exfiltration_event.
list_posture_asset_activityList posture asset activityGETLists the activity on one asset in a time range (downloads, permission changes, uploads, clipboard): type, time, asset names and app metadata. Pass an asset id from get_posture_event.

Finding annotation, 2 operations

annotate_findingAnnotate findingPOSTAnnotates a finding as a false or true positive (really, in the account). With autoApply (vendor default true) the annotation applies to every finding of the same sensitive data. Pass a finding id from list_violation_findings.
remove_finding_annotationRemove finding annotationPOSTRemoves the annotation from a finding (really, in the account). Pass a finding id from list_violation_findings.

Hook, 2 operations

list_ai_governance_hooksList ai governance hooksGETLists the company's AI-agent hook inventory, one row per client, event and handler, with how many devices declare it. Hook commands are not returned. Filter by client, event, managed state.
list_device_hooksList device hooksGETLists the AI-agent hooks declared on one device (event, handler type, matcher, managed or not); hook commands are not returned. Pass a deviceId from list_ai_governance_devices.

Ide extension, 2 operations

get_ide_extensionGet ide extensionGETGets one IDE extension by its opaque id from list_ide_extensions: capabilities, provenance, device count, first install and last seen times, its Open VSX registry record and a per-IDE, per-profile version breakdown.
list_ide_extensionsList ide extensionsGETLists the IDE-extension inventory, one row per extension and version across every IDE and device, with provenance, AI capability and device count. Use aiOnly=true to keep AI-capable extensions.

Mcp server, 2 operations

get_mcp_serverGet mcp serverGETGets one MCP server by its opaque id from list_mcp_servers, with usage, risk, provenance and its public registry record (name, description, license, package, repository and website).
list_mcp_serversList mcp serversGETLists the company's MCP server inventory, one row per server fingerprint and version, with device and client counts, usage totals, risk, provenance and shadow status. Filter by client, risk, provenance, transport.

Plugin, 2 operations

list_ai_governance_pluginsList ai governance pluginsGETLists the company's AI-agent plugin inventory, one row per client, marketplace, name and version, with status, trust state, provenance, device count and the MCP servers, hooks and apps each bundles.
list_device_pluginsList device pluginsGETLists the AI-agent plugins declared on one device, with status, trust state, provenance, source type and what each bundles. Pass a deviceId from list_ai_governance_devices.

Policy scope, 2 operations

update_policy_domain_scopeUpdate policy domain scopePOSTAdds or removes domains in a Google Drive DLP policy's include and exclude scope (really applied). Returns the full updated includedDomains and excludedDomains lists.
update_policy_user_scopeUpdate policy user scopePOSTAdds or removes user emails in a Google Drive DLP policy's include and exclude scope (really applied). Nightfall's reply, the full scope email lists, is withheld: success returns an empty result, a refused change an error.

Policy trigger scope, 2 operations

update_posture_trigger_domainsUpdate posture trigger domainsPOSTAdds or removes domains in a Google Drive posture policy's trigger scope (really applied). Returns the full updated includedDomains and excludedDomains lists.
update_posture_trigger_usersUpdate posture trigger usersPOSTAdds or removes user emails in a Google Drive posture policy's trigger scope (really applied). Nightfall's reply, the full trigger email lists, is withheld: success returns an empty result, a refused change an error.

Annotation, 1 operation

get_annotationGet annotationGETGets one finding annotation: its type (false or true positive), comment and whether it applies to every finding of the same sensitive data. Pass the annotationUUID from list_violation_findings.

Endpoint agent, 1 operation

list_endpoint_devicesList endpoint devicesGETLists the devices running the Nightfall endpoint agent: OS, device name and id, connection status, agent version, stealth mode, profile status, missing permissions, errors and browser-extension status. MAC addresses and user emails are not returned.

Exfiltration event activity, 1 operation

list_exfiltration_event_activityList exfiltration event activityGETLists the activity feed of one exfiltration event (creation, analyst and automated actions, status and risk changes) with type, timestamp and structured data. Names and emails are withheld.

Finding, 1 operation

list_violation_findingsList violation findingsGETLists the findings of one violation: detector, confidence, redacted sensitive text and its location, key-verification status for API keys, and annotation id. Raw findings and surrounding text are withheld.

Posture event activity, 1 operation

list_posture_event_activityList posture event activityGETLists the activity feed of one posture event (creation, analyst and automated actions, status and risk changes) with type, timestamp and structured data. Names and emails are withheld.

Repository, 1 operation

list_github_repositoriesList github repositoriesGETLists the GitHub repositories Nightfall has access to: repository id and name, private or public, last scan time and whether a policy covers it. Paginated with pageToken.

Text, 1 operation

scan_textScan textPOSTScans a list of text strings for sensitive data and returns, per string, its findings (detector, confidence, matched text, location) plus redacted copies when redaction is configured. Give policyUUIDs or policy. Counts toward the scan quota.

Violation activity, 1 operation

list_violation_activityList violation activityGETLists the activity feed of one violation (creation, analyst and automated actions, status and risk changes, annotations, failures) with type, timestamp and structured data. Analyst names and emails are withheld.

Use Nightfall AI from Claude Code, Cursor or Codex

Connect Nightfall AI in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Nightfall AI operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Nightfall AI

Create your workspace
Sign up free. Nothing to install.
Connect Nightfall AI once
Add your Nightfall AI connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.