Integration

Twingate integration

Twingate is a zero trust network access service that replaces VPNs. With its Admin API an agent can manage Resources and who may reach them (grant, replace or revoke Group and Service Account access), Groups and their members, users and their roles, Remote Networks and Connectors, devices (trust, block, archive, posture), registered serial numbers, Security Policy assignments, access requests (approve or reject), Service Accounts and their keys (revoke or delete) and DNS filtering profiles, and list Gateways. Many tools change who can reach your network, and say so. Left out: generating Connector tokens and creating Service Keys (both return secrets), resetting a user's MFA, certificate authorities, Gateway setup, Kubernetes, SSH and web app Resource setup, and the events-sync OIDC URL. The API is GraphQL and allows 60 reads and 20 writes per minute per account. Authentication is an API token generated in the Admin Console (Settings, API, Generate Token; Read & Write to change anything), sent in the X-API-KEY header, plus your network's subdomain.

Connect Twingate How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Twingate.Built from the 60 Twingate tools below, on the connection you add once.

What you can do with Twingate

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Each badge shows the default agent permission of an endpoint (allowed: an agent calls it without asking; ask first: you are asked before an agent calls it, when the agent or chat asks permission for sensitive actions; never: no agent may call it), which every user can change endpoint by endpoint in their credential settings.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Device, 7 operations

archive_deviceArchive devicePOSTAgents: ask firstArchives a Twingate device: its user is SIGNED OUT and must sign in again to reach Resources, which makes the device active again; unarchive_device restores it. Needs a Read & Write token. Check ok: false means it was refused (see error).
block_deviceBlock devicePOSTAgents: ask firstBLOCKS a Twingate device: it can no longer reach any Resource until unblock_device. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_deviceGet devicePOSTAgents: ask firstReturns one Twingate device: name, OS and version, type, state, trusted flag, serial number, host and user names, client version, last sign-ins and its owner. Personal data.
list_devicesList devicesPOSTAgents: ask firstLists the devices that signed in to Twingate, page by page: name, OS, type, state, trusted flag, serial number, host and user names, client version, last sign-ins and owner. Personal data.
set_device_trustSet device trustPOSTAgents: ask firstMarks a Twingate device as trusted or untrusted (a Security Policy can require a trusted device). Needs a Read & Write token. Check ok: false means it was refused (see error).
unarchive_deviceUnarchive devicePOSTAgents: ask firstRestores a Twingate device archived by archive_device. Needs a Read & Write token. Check ok: false means it was refused (see error).
unblock_deviceUnblock devicePOSTAgents: ask firstUnblocks a Twingate device blocked by block_device, so it can reach Resources again. Needs a Read & Write token. Check ok: false means it was refused (see error).

User, 6 operations

create_userCreate userPOSTAgents: ask firstAdds a user to the Twingate network by email (role MEMBER by default; ADMIN gives full control). The user joins the Everyone group, gets its Resources and is billed. Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_userDelete userPOSTAgents: ask firstDeletes a user from the Twingate network: they lose all access. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_userGet userPOSTAgents: ask firstReturns one Twingate user: name, email, state, role, type, the first 100 Groups and the first 100 devices. Personal data.
list_usersList usersPOSTAgents: ask firstLists the users of the Twingate network, page by page: id, first and last name, email, state, role, type and dates. Personal data.
update_userUpdate userPOSTAgents: ask firstChanges a Twingate user's name, or DISABLES (cuts all access) or re-activates the user. Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).
update_user_roleUpdate user rolePOSTAgents: ask firstChanges a Twingate user's role; ADMIN gives full control of the network, MEMBER removes admin rights. Needs a Read & Write token. Check ok: false means it was refused (see error).

Connector, 5 operations

create_connectorCreate connectorPOSTAgents: ask firstRegisters a new Connector in a Twingate Remote Network. Its deployment tokens are not returned here: the user generates them in the Twingate Admin Console. Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_connectorDelete connectorPOSTAgents: ask firstDeletes a Twingate Connector: a Remote Network left without one becomes unreachable. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_connectorGet connectorPOSTAgents: ask firstReturns one Twingate Connector: name, state, last heartbeat, host name, version, public and private IPs, notification flag and Remote Network.
list_connectorsList connectorsPOSTAgents: ask firstLists the Twingate Connectors (the agents that link a Remote Network to Twingate), page by page: name, state (ALIVE or a DEAD reason), last heartbeat, host name, version, IPs and Remote Network.
update_connectorUpdate connectorPOSTAgents: ask firstRenames a Twingate Connector or turns its status notifications on or off. Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).

Dns filtering profile, 5 operations

create_dns_filtering_profileCreate dns filtering profilePOSTAgents: ask firstCreates an empty Twingate DNS filtering profile; set its domains, groups and categories with update_dns_filtering_profile. Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_dns_filtering_profileDelete dns filtering profilePOSTAgents: ask firstDeletes a Twingate DNS filtering profile: its Groups lose that filtering. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_dns_filtering_profileGet dns filtering profilePOSTAgents: ask firstReturns one Twingate DNS filtering profile: priority, fallback method, allowed and denied domains, assigned Groups (first 100) and its content, security and privacy category settings.
list_dns_filtering_profilesList dns filtering profilesPOSTAgents: ask firstLists the Twingate DNS filtering profiles (id, name, priority: 1 beats 2). Empty when DNS filtering is not enabled on the network.
update_dns_filtering_profileUpdate dns filtering profilePOSTAgents: ask firstChanges a Twingate DNS filtering profile, which filters the DNS of its Groups' users. A list sent REPLACES the current one: read get_dns_filtering_profile first. Needs a Read & Write token. Check ok: false means it was refused (see error).

Group, 5 operations

create_groupCreate groupPOSTAgents: ask firstCreates a Twingate Group; its users get access to the Resources listed, at once. Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_groupDelete groupPOSTAgents: ask firstDeletes a Twingate Group: its members lose the access it gave them. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_groupGet groupPOSTAgents: ask firstReturns one Twingate Group with its first 100 members (names and emails, personal data) and the first 100 Resources it can access.
list_groupsList groupsPOSTAgents: ask firstLists the Twingate Groups (sets of users given access to Resources), page by page: id, name, type (MANUAL, SYNCED, SYSTEM), active flag, dates and Security Policy.
update_groupUpdate groupPOSTAgents: ask firstChanges a Twingate Group: adding users or Resources GRANTS access, removing them REVOKES it. Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).

Remote network, 5 operations

create_remote_networkCreate remote networkPOSTAgents: ask firstCreates a Twingate Remote Network (it needs a Connector deployed in it before anyone can reach it). Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_remote_networkDelete remote networkPOSTAgents: ask firstDeletes a Twingate Remote Network: its Resources become unreachable through Twingate. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_remote_networkGet remote networkPOSTAgents: ask firstReturns one Twingate Remote Network, found by id or by name, with its first 100 Connectors (state, last heartbeat, version) and first 100 Resources.
list_remote_networksList remote networksPOSTAgents: ask firstLists the Remote Networks (the private networks Twingate gives access to), page by page: id, name, location, network type, active flag and dates.
update_remote_networkUpdate remote networkPOSTAgents: ask firstChanges a Twingate Remote Network's name or location, or deactivates it (false cuts access to its Resources). Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).

Resource, 5 operations

create_resourceCreate resourcePOSTAgents: ask firstCreates a network Resource in Twingate; the groups in groupIds get access to it at once. Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_resourceDelete resourcePOSTAgents: ask firstDeletes a Twingate Resource: every user loses access to it through Twingate. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_resourceGet resourcePOSTAgents: ask firstReturns one Twingate Resource: address, protocols and ports, policies, and who has access (the first 100 Groups and Service Accounts, with each grant's expiry and approval mode) and its approver groups.
list_resourcesList resourcesPOSTAgents: ask firstLists the Resources (protected addresses users reach through Twingate), page by page: id, name, address, alias, type, active and visible flags, approval mode, access policy, Remote Network, policy and tags.
update_resourceUpdate resourcePOSTAgents: ask firstChanges a Twingate Resource; addedGroupIds grants and removedGroupIds revokes Group access. Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).

Service account, 5 operations

create_service_accountCreate service accountPOSTAgents: ask firstCreates a Twingate Service Account, billed like a user, with access to the Resources listed (the user creates its keys in the Twingate Admin Console). Needs a Read & Write token. Check ok: false means it was refused (see error).
delete_service_accountDelete service accountPOSTAgents: ask firstDeletes a Twingate Service Account: every automation using its keys loses access. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_service_accountGet service accountPOSTAgents: ask firstReturns one Twingate Service Account with the first 100 Resources it can access and its first 100 Service Keys (name, status, expiry; never the key itself).
list_service_accountsList service accountsPOSTAgents: ask firstLists the Twingate Service Accounts (non-human identities for automation and CI/CD), page by page: id, name and dates.
update_service_accountUpdate service accountPOSTAgents: ask firstRenames a Twingate Service Account, GRANTS it access to Resources (addedResourceIds) or REVOKES it (removedResourceIds). Only what you send changes. Needs a Read & Write token. Check ok: false means it was refused (see error).

Access request, 4 operations

approve_access_requestApprove access requestPOSTAgents: ask firstAPPROVES a pending Twingate access request: the user is granted access to the Resource. Needs a Read & Write token. Check ok: false means it was refused (see error).
get_access_requestGet access requestPOSTAgents: ask firstReturns one Twingate access request: status, reason, date, the requesting user (personal data) and the Resource asked for.
list_access_requestsList access requestsPOSTAgents: ask firstLists the access requests users made for Twingate Resources, page by page: status (PENDING, APPROVED, REJECTED), reason, date, requesting user (personal data) and Resource.
reject_access_requestReject access requestPOSTAgents: ask firstRejects a pending Twingate access request. Needs a Read & Write token. Check ok: false means it was refused (see error).

Resource access, 3 operations

add_resource_accessAdd resource accessPOSTAgents: ask firstGRANTS access to a Twingate Resource to Groups or Service Accounts (or changes their grant), keeping every other grant. Needs a Read & Write token. Check ok: false means it was refused (see error).
remove_resource_accessRemove resource accessPOSTAgents: ask firstREVOKES the access of Groups or Service Accounts to a Twingate Resource. Needs a Read & Write token. Check ok: false means it was refused (see error).
set_resource_accessSet resource accessPOSTAgents: ask firstREPLACES who can access a Twingate Resource: every Group or Service Account not in the list LOSES access. Read get_resource first. Needs a Read & Write token. Check ok: false means it was refused (see error).

Security policy, 3 operations

get_security_policyGet security policyPOSTAgents: ask firstReturns one Twingate Security Policy, by id or by name, with the first 100 Groups it is assigned to.
list_security_policiesList security policiesPOSTAgents: ask firstLists the Twingate Security Policies (the authentication and device rules a Resource or Group requires), page by page: id, name, type (RESOURCE or DEFAULT_RESOURCE) and dates.
update_security_policy_groupsUpdate security policy groupsPOSTAgents: ask firstAssigns a Twingate Security Policy to Groups or takes it away (removed groups fall back to the default Resource policy), changing how their members must authenticate. Needs a Read & Write token. Check ok: false means it was refused (see error).

Serial number, 3 operations

add_serial_numbersAdd serial numbersPOSTAgents: ask firstRegisters device serial numbers in Twingate: matching devices pass serial-number verification. Needs a Read & Write token. Check ok: false means it was refused (see error).
list_serial_numbersList serial numbersPOSTAgents: ask firstLists the device serial numbers registered in Twingate (for serial-number device verification), page by page, with the devices each one matches.
remove_serial_numbersRemove serial numbersPOSTAgents: ask firstRemoves registered serial numbers from Twingate: matching devices no longer pass serial-number verification. Needs a Read & Write token. Check ok: false means it was refused (see error).

Service account key, 2 operations

delete_service_account_keyDelete service account keyPOSTAgents: ask firstPermanently deletes a revoked or expired Twingate Service Key (an active key must be revoked first with revoke_service_account_key); it cannot be recovered. Needs a Read & Write token. Check ok: false means it was refused (see error).
revoke_service_account_keyRevoke service account keyPOSTAgents: ask firstREVOKES a Twingate Service Key for good (a revoked key can never be made active again): whatever uses it loses access at once. Needs a Read & Write token. Check ok: false means it was refused (see error).

Device posture, 1 operation

get_device_postureGet device posturePOSTAgents: ask firstReturns a Twingate device's posture: disk encryption, screen lock, firewall, biometrics, antivirus and OS version checks, and its verification by each trust provider (CrowdStrike, Jamf, Intune...).

Gateway, 1 operation

list_gatewaysList gatewaysPOSTAgents: ask firstLists the Twingate Gateways (proxies for Kubernetes, SSH and web app Resources), page by page: address, Remote Network and certificate authorities (name and fingerprint).

Use Twingate from Claude Code, Cursor or Codex

Connect Twingate in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Twingate operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Twingate

Create your workspace
Sign up free. Nothing to install.
Connect Twingate once
Add your Twingate connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.