ConnectWise Automate MCP

Runtime-agnostic stdio MCP server for Automate client, location and endpoint inventory, available scripts, computer monitors, and script/monitor history. Every provider operation requires an explicit Alfe connectionId.

Create a ConnectWise Automate connection in Alfe using the public HTTPS server origin and an integrator username/password. Alfe supplies the vendor ClientID. This server reads Alfe configuration through @alfe.ai/config and resolves fresh connection credentials through AgentApiClient on every call. It requires no ConnectWise environment variables or copied secrets.

The integration manifest starts the first release with:

mcp_servers:
  - id: connectwise-automate
    command: npx
    args: ["-y", "@alfe.ai/[email protected]"]
    env: {}

Call automate_list_connections, then pass the chosen connectionId to:

• automate_check_connection
• automate_list_clients
• automate_list_locations
• automate_list_computers
• automate_list_scripts
• automate_list_monitor_history
• automate_list_internal_monitor_results
• automate_list_computer_monitors (also requires computerId)
• automate_list_computer_script_history (also requires computerId)

List tools accept a 1-based page, pageSize (1–200, default 50), and an Automate condition expression. They return { items, page, pageSize } for one page. Scripts are discovered and their execution history can be inspected; these tools do not execute scripts, reboot computers, or change monitors.

The server calls /cwa/api/v1/ on the selected origin. It caches bearer tokens per connection, refreshes while they are still valid, and reauthenticates after expiration or one failed GET. Credential rotation and revoked Alfe scope take effect on the next tool call. Interactive/2FA login challenges return an actionable connection error.

Private-network and loopback servers are unsupported. Each request resolves the hostname afresh, rejects any non-public DNS answer, and pins the HTTPS socket to a checked IP while retaining TLS hostname validation. Redirects are never followed. Requests, DNS, responses and tool results have explicit bounds; raw provider errors and credential-bearing fields are never forwarded.

API contract and verification

The primary API reference is the ConnectWise Automate developer portal, which requires a ConnectWise developer login. The implementation was checked against its exported Automate API v1 OpenAPI contracts, preserved in the System, Company, Computers, Scripts and Monitors files at that immutable mirror revision. The mirror is independently maintained; it is not a live contract obtained from the customer's server.

Tests exercise the token wire format/lifecycle, endpoint and pagination contracts, connection selection/rotation/revocation, DNS and response bounds, error redaction, and real in-memory MCP protocol requests. No live customer Automate server was available during implementation. Before declaring a deployment operational, configure a real vendor ClientID and integrator connection, run automate_check_connection, page each relevant inventory tool, and verify refresh against the installed Automate version. An account must have the corresponding Automate read permissions; permission failures are reported without widening access.