ConnectWise ScreenConnect MCP

Runtime-independent stdio MCP server for ScreenConnect's RESTful API Manager extension. Alfe Connections supplies credentials at execution time. Every provider operation requires the exact connectionId returned by screenconnect_list_connections.

Setup

1. Install the RESTful API Manager extension in the ScreenConnect administration Extension Marketplace. This integration implements the documented 1.0.8 API contract (server 22.3 or newer); notes need 1.0.6+.

2. Set the extension's RESTfulAuthenticationSecret to a strong random secret and configure its execution user/permissions for the operations you need.

3. Leave RESTfulAllowedOrigin empty or set it to the ScreenConnect site's origin, such as https://support.example.com. The runtime sends that origin on requests.

4. Add a ConnectWise ScreenConnect connection in Alfe with that site's HTTPS origin and authentication secret, at a scope the agent can access.

5. The connection-driven integration launches the server automatically. For manual testing on an already configured agent:

   npx -y @alfe.ai/[email protected]

@alfe.ai/config supplies the Alfe API key and API URL from the normal agent configuration. No ScreenConnect credentials are passed through command-line arguments or integration environment variables. The binary is connectwise-screenconnect-mcp.

Tools

| Tool | Purpose | | --- | --- | | screenconnect_list_connections | Discover connections without exposing secrets | | screenconnect_check_connection | Verify extension access with a read that matches no sessions | | screenconnect_list_sessions | Query sessions by a required session filter | | screenconnect_find_sessions | Find sessions by name | | screenconnect_get_session | Retrieve a session by its GUID | | screenconnect_get_session_details | Inspect events and connections, omitting screenshot bytes | | screenconnect_create_session | Create Support or Meeting sessions | | screenconnect_rename_session | Replace a session's display name | | screenconnect_update_custom_properties | Replace up to eight positional custom properties | | screenconnect_add_note | Append a session note | | screenconnect_send_message | Send a message attributed to a host | | screenconnect_run_command | Queue a remote command with exact target/content confirmation | | screenconnect_run_toolbox_item | Queue an existing toolbox item with exact target/item confirmation |

The API has no session pagination. The required filter controls the provider query; limit (1–500, default 100) limits the returned tool result and reports truncation. Narrow filters when the provider response exceeds 5 MiB.

Create supports Support and Meeting, and private sessions require a join code. Access agent installation is a different API and is not exposed here. Custom-property updates replace the entire positional array, so read the current values and preserve those you want to keep.

Remote command/toolbox responses mean accepted, not completed. Inspect session details for execution results. Requests are never automatically retried; check the resulting session state before retrying a mutation after a timeout or transport error.

Request contract

All requests target the fixed extension prefix /App_Extensions/2d558935-686a-4bd0-9991-07539f5fe749/Service.ashx/. Read methods use GET and mutations use POST, with application/json positional array bodies and the CTRLAuthHeader authentication header. Node's HTTPS transport supports the documented GET request bodies.

Before every request, all DNS answers must be public. The connection is pinned to those checked addresses with the original TLS hostname/certificate checks. Redirects are never followed. DNS, connection, and response streaming share a 30-second deadline. Request bodies are capped at 128 KiB and responses at 5 MiB. Errors omit provider bodies, URLs, credential bundles, and original network exception causes.

Verification

pnpm --filter @alfe.ai/connectwise-screenconnect-mcp typecheck
pnpm --filter @alfe.ai/connectwise-screenconnect-mcp lint
pnpm --filter @alfe.ai/connectwise-screenconnect-mcp test
pnpm --filter @alfe.ai/connectwise-screenconnect-mcp build

Contract tests verify transport/authentication, pinned DNS and SSRF rejection, response bounds, no mutation retries, credential rotation/isolation, and real MCP client/server exchanges. These tests do not constitute live tenant verification. Before rollout, use an approved ScreenConnect test instance with the extension configured to verify creation, updates, notes, messaging, and command/toolbox execution against a disposable session.

Official references verified 2026-09-08:

• RESTful API Manager
• Session Manager API
• Session and session-details objects
• Extension release notes

The documentation site may redirect to ConnectWise University authentication. The protocol contract was also available through the official page's search index at implementation time.