NOBook a Demo
← All solutions
AI & MCP Server · Beta

A new way to manage endpoints.
Tell your AI what you need.

Bring CapaOne into the AI assistant your team already uses. Investigate issues, understand your exposure and turn endpoint data into clear priorities, simply by asking. In beta today for questions, investigations and reports, with actions coming next.

Book a DemoStart Free Trial
For the CISO

The morning a vulnerability hits the news

Built for the AI tools your team uses
  • Microsoft 365 Copilot
  • ChatGPT
  • Claude
  • Google Gemini
  • MistralEU
  • LangdockEU
  • GitHub Copilot
  • Cursor

Sign in with CapaOne from Microsoft 365 Copilot, ChatGPT, Claude and other AI assistants, or connect any MCP client or agent platform with an API key.

01 · What It Is

What is AI endpoint management?

AI endpoint management means an AI agent works through your endpoint platform instead of next to it, connected to CapaOne through the open Model Context Protocol (MCP).

The beta answers questions and builds reports from your live fleet. Next, the agent takes on the daily work, under rules you set.

02 · What You Can Do

From everyday questions to your next priority

Start with the work on your desk. The assistant brings the data together.

See what's holding up patching.

Failed installs, pending restarts and devices that stopped checking in, as one follow-up list.

Get context before the support call.

Crashes, errors, memory, free disk space and drivers for one user's device. Observations, not a diagnosis.

Make reporting a conversation.

A technical overview and a short summary for management, built from the same data.

Investigate your exposure.

A new CVE's score and CISA status, and the devices running the version you name.

Watch the CISO story

Spot gaps in your baseline.

Missing encryption, local administrators and unsupported drivers, device by device.

Plan the next hardware refresh.

Older models, low memory, Windows 10 and repeated crashes, as a shortlist to review.

Example report

Endpoint status, October 2026

Example Organization · 786 devices · Patch compliance and vulnerabilities compared with last month · Data from CapaOne, November 3, 2026

Summary for management

  • Patching improved slightly. 612 of 786 devices (78%) are fully up to date, up from 74%. 91.4% of all patches are installed, up from 89.8%.
  • Vulnerability exposure rose. Known vulnerabilities went from 3,940 to 4,610 (+17%), and critical ones (CVSS 9+) from 212 to 268 (+26%).
  • Most fixes are deployed but not active yet. 1,140 updates are waiting on 164 devices, mostly browsers, and 141 devices are waiting for a restart.
  • Five vulnerabilities are known to be exploited (CISA list), up from three.
  • Next steps: force restarts, move 23 devices with an old Office version to the current update channel, and fix BitLocker on 38 devices.

Key figures

Fully updated devices612 / 78677.9% · was 74.2% (+3.7 pp)
Patches installed91.4%was 89.8% (+1.6 pp)
Known vulnerabilities (CVE)4,610▲ +670 (+17%) · was 3,940
Critical (CVSS ≥ 9)268▲ +56 (+26%) · was 212
Devices with critical vulnerabilities97 / 786▲ was 81
Known exploited (CISA)5▲ +2 · was 3

Exposed is not compromised. The figures show what devices are vulnerable to, not that anything has been exploited.

Patch compliance

Oct 1Nov 391.4 %
Patches installed per day, October 2026 (%)
Sep 30Nov 3Change
Devices781786+5
Fully updated devices580 (74.2%)612 (77.9%)+3.7 pp
Patches installed89.8%91.4%+1.6 pp
Patches not installed1,3101,212−98
Available, not deployed41048−362
Deployed, not installed8701,140+270
Failed3024−6

Most updates were deployed during the month but are waiting for a restart before they take effect. That matches the restart queue: 141 devices are waiting.

Most pending updates

ApplicationDevices
Google Chrome412
Microsoft Edge388
Mozilla Firefox96
Zoom64

Failed installs

ApplicationDevices
Adobe Acrobat Reader14
Java 8 Runtime10

Vulnerabilities

Oct 4Nov 2Change
Known vulnerabilities (CVE)3,9404,610+670 (+17%)
Critical (CVSS ≥ 9.0)212268+56
High1,8202,150+330
Medium / low1,700 / 2081,960 / 232+260 / +24
Known exploited (CISA)35+2
Devices with critical vulnerabilities8197+16
Exposure score6.16.4+0.3

Fixes are not reaching the devices fast enough. New vulnerabilities arrived with the monthly Microsoft updates and new browser versions, while the fixes are still waiting for a restart.

Where the most severe vulnerabilities are

ProductExampleFixed by
Chrome / Edge / WebView2Code execution outside the sandbox (CVSS 9.6–10)Pending browser updates + restart
FirefoxMemory corruption (CVSS 9.8)Pending update + restart
Office / OutlookRemote code execution, 2 known exploitedCurrent Office update channel

Other observations (outside patching)

AreaGoodFairPoorNo dataStatus
BitLocker encryption7408380Critical
Restart pending64514100Warning
Windows Update70271130Warning
Firewall780—60OK
Antivirus784020OK

Recommendations

  1. Force a restart with a deadline on the 141 devices, so the 1,140 pending updates are installed.
  2. Find the 23 devices with an old Office version and move them to the current update channel.
  3. Investigate the failed Adobe Acrobat Reader and Java installs for packaging errors.
  4. Fix BitLocker on the 38 devices.

This review only reads data. None of the steps above has been carried out.

Example report. Built from the data the CapaOne MCP Server returns: patch compliance with daily history, vulnerability scans and security posture. Example Organization is a fictional organization.

Example support case

From "my laptop is slow" to what to check next

  1. 01The ticket

    A user reports a slow laptop

    "My laptop has been slow all week."

  2. 02The agent asks

    The agent checks CapaOne

    Memory, free disk space, pending restarts, disk errors, drivers and crashes for that one device.

  3. 03The answer

    What CapaOne shows

    "The laptop has 8 GB of memory and has waited 23 days for a restart. The disk has logged paging errors since Tuesday, and the network driver is two versions behind. Check the disk first."

  4. 04Coming next

    The fix

    The agent proposes the restart and the driver update, and carries them out under your rules.

Today the agent reports what CapaOne data shows and suggests what to check next. Carrying out the fix comes next.

03 · Who It's For

One fleet, four kinds of answers

IT Administrators

What to fix next, in one list instead of filters and exports.

More for this role

IT Executives

Open exposure and baseline gaps for the CIO and CISO, with the data behind each answer.

More for this role

IT Managers

Where work stalls, and where the team's time should go.

More for this role

IT Support Teams

Context on one user's device before the remote session.

More for this role
04 · Where We're Heading

Ask today.
Act next.

The beta investigates and reports. Next, agents take over the routine work, within the rules your team sets.

Planned workflow. Actions that change devices are not part of the beta.

  1. Finds the affected devices and proposes a planThe AI
  2. Approve where your rules require itYou
  3. Fixes and verifies the resultThe AI

AI makes mistakes. Your rules decide how far a mistake can go.

  • Only what you allowThe agent can use only the actions your rules give it.
  • A person where it countsChanges you choose wait for someone on your team to approve them.
  • Every step on recordYou can see what the agent did, on which devices, and when.
  • Checked afterwardThe agent verifies the result, so a fix that fails does not go unnoticed.

More work you will hand to the agent

  • Package the latest AutoCAD and deploy it to Engineering.
  • Fix every failed install from last night.
  • Restart every laptop that has waited more than two weeks.
  • Update the outdated network drivers on the Sales laptops.
  • Remove local admin rights nobody has used in 90 days.
  • Get the new hire's laptop ready for Monday.
05 · Get Started

From sign-in to first answer in four steps

01Your AI

Add CapaOne to your AI

Add the CapaOne MCP Server as a connector in your AI assistant.

02Sign in

Sign in with CapaOne

Use your CapaOne login and allow access. No keys to copy.

03Beta

Ask in plain language

The agent picks the tools and answers from live data.

04Your rules

Stay in control

Disconnect at any time. Approval rules arrive with actions.

The Platform

Products that power this solution

Application Manager

Patch status per application and device your assistant can ask about today, and the packaging and deployment the agent takes on next.

Explore Application Manager

Security Monitor

Vulnerabilities, patch compliance and security posture your assistant can ask about.

Explore Security Monitor

Experience Monitor

The Windows crash and error events behind the questions support hears every day.

Explore Experience Monitor

Privilege Manager

Admin On Demand elevations per user, per process and per device.

Explore Privilege Manager
FAQ

Questions we get asked

Anything else? Talk to our team →

What Is an MCP Server for Endpoint Management?

An MCP server lets an AI agent call tools in another system through the open Model Context Protocol. The CapaOne MCP Server gives AI clients such as Claude, GitHub Copilot and Cursor tools to search devices and read inventory, patch compliance, vulnerabilities, security posture, events and Admin On Demand elevations from CapaOne.

Can AI Agents Change Devices Through CapaOne?

Not in the beta, which answers questions and builds reports. We are building toward packaging, deployment and patching, with your team deciding which actions need approval.

What Data Does the AI Agent Receive?

To answer a question, CapaOne returns the data the answer needs, such as device names, user names, installed software or event descriptions, to the AI client and model you connect. That provider then processes it under its own terms. Access is limited to one CapaOne organization and to the products it has a contract for. Connect only clients and models that your organization allows to process device and user data.

Which Devices Can I Ask About?

The Windows endpoints CapaOne manages. Answers come from the CapaOne products your organization has a contract for: vulnerabilities and security posture need Security Monitor, crash events need Experience Monitor, and Admin On Demand elevations need Privilege Manager.

How Do I Connect My AI Assistant to CapaOne?

Add the CapaOne MCP Server as a connector in your AI assistant and sign in with your CapaOne login. For clients and agent platforms that do not support sign-in, a user with the Manager role can create an API key in the CapaOne console instead. Keys expire after 30 days, 90 days or one year, and a revoked key stops working on the next request.

Ask your first question.

See the CapaOne MCP Server answer questions about a real Windows fleet, and ask us about joining the beta.

Book a DemoStart Free Trial