Integration

runZero integration

runZero (formerly Rumble) is an asset discovery and exposure management platform. Search and export the organization's inventory of assets, services, software, vulnerabilities, certificates, wireless networks, findings and directory users; tag, rate, assign owners to, merge or delete assets; manage sites, Explorers and tasks and start network scans or traffic samples. With an account API token it also manages organizations, users, groups, scan templates, custom integrations and asset ownership types, and exports the account event log. Not exposed: CSV, JSON Lines and XML exports, scan file imports, API key, export token and scan credential management, SSO group mappings and the legacy agent routes. Authentication is a bearer token: an organization API token (OT prefix) covers the organization and export tools; an account API token (CT prefix, Platform license) covers everything, with the organization id passed in _oid.

Connect runZero How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in runZero.Built from the 97 runZero tools below, on the connection you add once.

What you can do with runZero

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Custom integration, 8 operations

create_account_custom_integrationCreate account custom integrationPOSTRegisters a custom integration with a unique name, an optional description and an optional icon. Needs an account API token.
delete_account_custom_integrationDelete account custom integrationDELETEDeletes a custom integration. Needs an account API token.
get_account_custom_integrationGet account custom integrationGETReturns one custom integration of the account. Needs an account API token.
get_org_custom_integrationGet org custom integrationGETReturns one custom integration: its name, description and icon.
list_account_custom_integrationsList account custom integrationsGETLists the custom integrations (asset data sources your own scripts register) of the account. Needs an account API token.
list_org_custom_integrationsList org custom integrationsGETLists the custom integrations (asset data sources registered by your own scripts) available to the organization.
replace_account_custom_integrationReplace account custom integrationPUTReplaces a custom integration's name, description and icon as a whole. Needs an account API token.
update_account_custom_integrationUpdate account custom integrationPATCHChanges the name, description or icon of a custom integration, leaving fields you omit unchanged. Needs an account API token.

Org, 7 operations

create_account_organizationCreate account organizationPUTCreates an organization in the account. Needs an account API token.
delete_account_organizationDelete account organizationDELETEDeletes an organization and its data. Needs an account API token.
get_account_organizationGet account organizationGETReturns one organization of the account. Needs an account API token.
get_organizationGet organizationGETReturns the organization the token belongs to: name, description, parent organization, asset and service counts, and the data expiration settings in days.
list_account_organizationsList account organizationsGETLists every organization of the account with its counts and expiration settings. Needs an account API token.
update_account_organizationUpdate account organizationPATCHUpdates an organization's name, description, parent organization or data expiration settings. Needs an account API token.
update_organizationUpdate organizationPATCHUpdates the organization the token belongs to: name, description, parent organization or how many days stale assets, offline assets, scan data and vulnerabilities are kept.

Site, 7 operations

create_siteCreate sitePUTCreates a site with a name and optional description, default scan scope (addresses, ranges or CIDRs) and excluded addresses. Returns the new site and its id.
delete_siteDelete siteDELETEDeletes a site together with all the assets it holds.
export_sitesExport sitesGETExports every site of the organization with its scope, excludes and subnets.
get_siteGet siteGETReturns one site by id or name: description, default scan scope, excludes and subnets.
list_account_sitesList account sitesGETLists the sites of every organization of the account. Needs an account API token.
list_sitesList sitesGETLists the sites of the organization (each site groups the assets of one network, with its default scan scope and excludes).
update_siteUpdate sitePATCHUpdates a site's name, description, default scan scope, excludes or subnets.

Group, 6 operations

create_account_groupCreate account groupPOSTCreates a user group with a default role and per-organization roles. Needs an account API token.
delete_account_groupDelete account groupDELETEDeletes a user group. Needs an account API token.
export_directory_groupsExport directory groupsGETExports the directory groups imported from integrations, with names, description, email and user count.
get_account_groupGet account groupGETReturns one user group. Needs an account API token.
list_account_groupsList account groupsGETLists the user groups of the account with their roles and user counts. Needs an account API token.
update_account_groupUpdate account groupPUTUpdates an existing user group, identified by the id in the body. Needs an account API token.

Ownership type, 6 operations

create_ownership_typesCreate ownership typesPOSTCreates one or more asset ownership types. Needs an account API token.
delete_ownership_typeDelete ownership typeDELETEDeletes one asset ownership type. Needs an account API token.
delete_ownership_typesDelete ownership typesDELETEDeletes several asset ownership types at once, by id. Needs an account API token.
list_ownership_typesList ownership typesGETLists the asset ownership types of the account (the kinds of owner an asset can have, such as Asset Owner). Needs an account API token.
update_ownership_typeUpdate ownership typePATCHUpdates one asset ownership type: name, reference, display order or hidden flag. Needs an account API token.
update_ownership_typesUpdate ownership typesPUTUpdates several asset ownership types at once, each identified by its id. Needs an account API token.

User, 6 operations

create_account_userCreate account userPUTCreates a user account without sending an invitation email. Needs an account API token.
delete_account_userDelete account userDELETEDeletes a user from the account. Needs an account API token.
export_directory_usersExport directory usersGETExports the directory users imported from integrations (for example Active Directory or Azure AD), with names, email, title and last logon time.
get_account_userGet account userGETReturns one user of the account with roles, last login and MFA state. Needs an account API token.
list_account_usersList account usersGETLists the users of the account with their roles, last login and MFA state. Needs an account API token.
update_account_userUpdate account userPATCHUpdates a user's name, email, superuser flag or organization roles. Needs an account API token.

Template, 5 operations

create_scan_templateCreate scan templatePOSTCreates a scan template in an organization. Needs an account API token.
delete_scan_templateDelete scan templateDELETEDeletes a scan template. Needs an account API token.
get_scan_templateGet scan templateGETReturns one scan template with its parameters. Needs an account API token.
list_scan_templatesList scan templatesGETLists the scan templates (saved scan settings) across every organization of the account, up to 1000, optionally filtered with a runZero search query. Needs an account API token.
update_scan_templateUpdate scan templatePUTUpdates a scan template, identified by the id in the body. Needs an account API token.

Asset, 4 operations

delete_assetDelete assetDELETEDeletes one asset from the inventory.
export_assetsExport assetsGETExports the organization's asset inventory one page at a time, optionally filtered with a runZero search query and limited to chosen fields. Pass the returned next_key as start_key to read the next page; an empty next_key means the last page.
get_assetGet assetGETReturns one asset with its addresses, names, operating system, hardware, MAC addresses, services, tags, comments, risk and first and last seen times.
list_assetsList assetsGETLists the assets of the organization (every device found by scans and integrations), optionally filtered with a runZero search query and limited to chosen fields.

Explorer, 4 operations

delete_explorerDelete explorerDELETERemoves an Explorer from the organization and uninstalls it from its host.
get_explorerGet explorerGETReturns one Explorer of the organization: host name, operating system, version, site, connection state and last check-in time.
list_explorersList explorersGETLists the runZero Explorers (the scanning agents installed on your hosts) of the organization with host name, operating system, architecture, version, internal and external IP, assigned site, connection state and last check-in time.
update_explorerUpdate explorerPATCHChanges an Explorer's settings, for example assigns it to another site with site_id.

Service, 4 operations

delete_serviceDelete serviceDELETEDeletes one service from the inventory.
export_servicesExport servicesGETExports the organization's service inventory (open ports and protocols, each with its asset) one page at a time, optionally filtered with a runZero search query. Pass the returned next_key as start_key to read the next page.
get_serviceGet serviceGETReturns one service: its address, port, transport, protocol, summary and the asset it runs on.
list_servicesList servicesGETLists the services (an open port and protocol on an asset, with the product and banner data runZero found) of the organization, optionally filtered with a runZero search query.

Task, 4 operations

export_tasksExport tasksGETExports the organization's tasks with their type, status, parameters, statistics and schedule, optionally filtered with a runZero search query.
get_taskGet taskGETReturns one task with its type, status, error, parameters, statistics and schedule. Use it to follow a scan started with create_scan.
list_account_tasksList account tasksGETLists the latest tasks (up to 1000) across every organization of the account, optionally filtered with a runZero search query. Needs an account API token.
list_tasksList tasksGETLists the latest tasks (up to 1000: scans, traffic samples, imports and integration syncs) of the organization, optionally filtered by status or a runZero search query.

Remove, 3 operations

remove_asset_custom_integrationRemove asset custom integrationDELETERemoves the data one custom integration contributed to an asset.
remove_asset_sourceRemove asset sourceDELETERemoves the data one source (a scan or an integration) contributed to an asset.
remove_custom_integration_from_assetsRemove custom integration from assetsPOSTRemoves the data one custom integration contributed to each of the listed assets.

Wireles, 3 operations

delete_wireless_networkDelete wireless networkDELETEDeletes one wireless network from the inventory.
get_wireless_networkGet wireless networkGETReturns one wireless network: SSID, BSSID, authentication, encryption, signal, channels, vendor and when it was last seen.
list_wireless_networksList wireless networksGETLists the wireless networks seen by the organization's Explorers: SSID (essid), BSSID, authentication, encryption, signal, channels and vendor, optionally filtered with a runZero search query.

Criticality, 2 operations

set_criticality_by_searchSet criticality by searchPATCHSets the criticality of every asset that matches a search query.
update_asset_criticalityUpdate asset criticalityPATCHSets how critical an asset is to your organization. Returns the updated asset.

Hosted zone, 2 operations

get_hosted_zoneGet hosted zoneGETReturns one hosted zone: name, whether it is enabled, its Explorer count and its active and waiting tasks. Hosted zones need an Enterprise license.
list_hosted_zonesList hosted zonesGETLists the runZero hosted zones available to the organization (runZero-operated Explorers that scan public targets from the internet), with how many Explorers and active or waiting tasks each has. Hosted zones need an Enterprise license.

Owner, 2 operations

set_owners_by_searchSet owners by searchPATCHSets the owners of every asset that matches a search query, one owner per ownership type.
update_asset_ownersUpdate asset ownersPATCHSets the owners of an asset, one owner per ownership type. Returns the updated asset.

Tag, 2 operations

update_asset_tagsUpdate asset tagsPATCHAdds, changes or removes tags on one asset: name=value sets a tag, -name removes it. Returns the updated asset.
update_tags_by_searchUpdate tags by searchPATCHAdds, changes or removes tags on every asset that matches a search query: name=value sets a tag, -name removes it.

Agent, 1 operation

list_account_explorersList account explorersGETLists the Explorers (scanning agents) of every organization of the account, optionally filtered with a runZero search query. Needs an account API token.

Certificate, 1 operation

export_certificatesExport certificatesGETExports the TLS certificates runZero found, with subject, issuer, validity dates, key details, fingerprints and subject alternative names, optionally filtered with a runZero search query.

Clear owner, 1 operation

clear_owners_by_searchClear owners by searchPOSTRemoves all owners from every asset that matches a search query.

Clear tag, 1 operation

clear_tags_by_searchClear tags by searchPOSTRemoves all tags from every asset that matches a search query.

Comment, 1 operation

update_asset_commentsUpdate asset commentsPATCHReplaces the free-text comments of an asset. Returns the updated asset.

Delete, 1 operation

delete_assetsDelete assetsPOSTDeletes several assets at once, by id.

Event, 1 operation

export_account_eventsExport account eventsGETExports the account's system event log (logins, API calls, changes) one page at a time, optionally filtered with a runZero search query. Pass the returned next_key as start_key to read the next page. Needs an account API token.

Finding, 1 operation

export_findingsExport findingsGETExports the findings runZero raised (risky configurations and exposures), each with its title, category, risk rank, description, solution and how many instances were detected.

Hide, 1 operation

hide_taskHide taskPOSTHides a completed task from the task list.

Invite, 1 operation

invite_account_userInvite account userPUTCreates a user account and emails them an invitation, with an optional custom subject and message. Needs an account API token.

License, 1 operation

get_account_licenseGet account licenseGETReturns the account's license: type, expiration, maximum and current asset counts, subscription period and single sign-on settings. Needs an account API token.

Merge, 1 operation

merge_assetsMerge assetsPATCHMerges several assets (listed by id) into one asset, for duplicates of the same device.

Reset lockout, 1 operation

reset_account_user_lockoutReset account user lockoutPATCHClears the lockout of a user locked out after failed logins. Needs an account API token.

Reset mfa, 1 operation

reset_account_user_mfaReset account user mfaPATCHRemoves a user's registered MFA tokens so they can enroll again. Needs an account API token.

Reset password, 1 operation

reset_account_user_passwordReset account user passwordPATCHSends the user a password reset email. Needs an account API token.

Sample, 1 operation

create_traffic_sampleCreate traffic samplePUTStarts a passive traffic sampling task in a site: the chosen Explorer listens on the given network interfaces and records the assets it sees. Returns the created task.

Scan, 1 operation

create_scanCreate scanPUTStarts (or schedules) a network scan task in a site.

Software, 1 operation

export_softwareExport softwareGETExports the software inventory (vendor, product, version and CPE of each software found on an asset) one page at a time, optionally filtered with a runZero search query. Pass the returned next_key as start_key to read the next page.

Stop, 1 operation

stop_taskStop taskPOSTStops or cancels a task. A recurring or scheduled task is removed as well, so it does not run again.

Update, 1 operation

force_explorer_updateForce explorer updatePOSTForces an Explorer to update itself to the current version and restart.

Vulnerability, 1 operation

export_vulnerabilitiesExport vulnerabilitiesGETExports the vulnerability inventory (each vulnerability with its CVE, CVSS scores, severity, risk and the affected asset) one page at a time, optionally filtered with a runZero search query.

Wireless, 1 operation

export_wireless_networksExport wireless networksGETExports the organization's wireless network inventory one page at a time, optionally filtered with a runZero search query. Pass the returned next_key as start_key to read the next page.

Use runZero from Claude Code, Cursor or Codex

Connect runZero in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its runZero operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect runZero

Create your workspace
Sign up free. Nothing to install.
Connect runZero once
Add your runZero connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.