Datto SaaS Protection

Official

by WYRE-AI · TypeScript

MCP server for Datto SaaS Protection — customers, seats, backup status, bulk seat licensing.

Datto SaaS Protection MCP Server (io.github.WYRE-AI/datto-saas-protection-mcp)

This MCP server exposes the Datto SaaS Protection (Backupify) API to Claude and other Model Context Protocol (MCP) clients. It focuses on SaaS backup, restore, and seat-related operations for M365 and Google Workspace (GWS).

🛠️ Key Features

Implements a Model Context Protocol (MCP) server
Exposes Datto SaaS Protection (Backupify) API
Supports M365/GWS backups, restores, and seats

🚀 Use Cases

Retrieve backup posture for M365/GWS environments
Perform restore workflows via MCP clients
Manage seat-related operations through the exposed API

⚡ Developer Benefits

Compatible with MCP clients (e.g., Claude)
Uses the Datto SaaS Protection (Backupify) API as the integration layer
Repository includes CI and is distributed under Apache 2.0

⚠️ Limitations

Source excerpt does not describe specific tool names, configuration, auth, or response schemas beyond backups/restores/seats

Topics

backupifyclaudedattokaseyam365mcpmodel-context-protocolmspsaas-backup

README.md2 KBView on GitHub

Datto SaaS Protection MCP Server

A Model Context Protocol server exposing the Datto SaaS Protection (Backupify) API to Claude and other MCP clients.

What it does

Surface SaaS backup posture for your M365 and Google Workspace tenants directly to AI assistants — list customer organizations, inspect protected domains and seats, browse backup history, queue restores, and audit activity logs and license usage.

Interactive Seat Card (MCP Apps): datto_saas_get_seat renders as an interactive backup-status card in MCP Apps hosts (Claude Desktop/web) — read-only, showing seat type, Active/Archived status, and last backup; neutral by default, brandable via window.__BRAND__ injection or MCP_BRAND_* env vars; plain-JSON behavior is unchanged in other hosts

Tools

Tool	Purpose
`datto_saas_list_clients`	List all customer organizations
`datto_saas_list_domains`	List protected domains under a client
`datto_saas_list_seats`	List seats in a domain (toggle archived)
`datto_saas_get_seat`	Fetch a single seat detail
`datto_saas_list_backups`	List backup runs for a seat
`datto_saas_queue_restore`	Queue a restore (DESTRUCTIVE — requires confirmation)
`datto_saas_get_restore_status`	Check restore progress
`datto_saas_list_activity`	Org activity log (date-range elicitation)
`datto_saas_get_license_usage`	Seat counts vs purchased

Credentials

Local (env mode)

export DATTO_SAAS_PUBLIC_KEY="..."
export DATTO_SAAS_SECRET_KEY="..."
export DATTO_SAAS_REGION="us"   # or "eu"

Hosted (gateway mode)

The WYRE MCP Gateway injects credentials per request via headers:

X-Datto-SaaS-Public-Key (required, secret)
X-Datto-SaaS-Secret-Key (required, secret)
X-Datto-SaaS-Region (optional, default us)

Run

npm install
npm run build
npm start                       # stdio
MCP_TRANSPORT=http npm start    # HTTP on :8080

License

Apache 2.0 — see LICENSE.

Install

Configuration

Environment variables

DATTO_SAAS_PUBLIC_KEYrequiredsecret

Datto REST API public key (Partner Portal > Admin > Integrations > API Keys)

DATTO_SAAS_SECRET_KEYrequiredsecret

Datto REST API secret key

MCP_TRANSPORTdefault stdio

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.

AUTH_MODEdefault env

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.

LOG_LEVELdefault info

Log verbosity: debug, info, warn, error

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "datto-saas-protection-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-ai/datto-saas-protection-mcp:v3.0.0"
      ],
      "env": {
        "DATTO_SAAS_PUBLIC_KEY": "<YOUR_DATTO_SAAS_PUBLIC_KEY>",
        "DATTO_SAAS_SECRET_KEY": "<YOUR_DATTO_SAAS_SECRET_KEY>",
        "MCP_TRANSPORT": "stdio",
        "AUTH_MODE": "env",
        "LOG_LEVEL": "info"
      }
    }
  }
}