This MCP server exposes the Datto SaaS Protection (Backupify) API to Claude and other Model Context Protocol (MCP) clients. Its purpose is to surface SaaS backup posture for M365/GWS workflows, specifically around backups, restores, and seats, via the Datto SaaS Protection service.

🛠️ Key Features

MCP server for Datto SaaS Protection (Backupify) API access
Focus on M365/GWS backup posture
Supports backup, restore, and seat-related operations

🚀 Use Cases

Integrate Datto SaaS Protection (Backupify) with Claude and MCP clients
Retrieve information about M365/GWS SaaS backup posture
Trigger or support restores and manage seat-related data

⚡ Developer Benefits

Standardized integration via Model Context Protocol (MCP)
Client access to Datto SaaS Protection (Backupify) API through an MCP server
Project is Apache 2.0 licensed

⚠️ Limitations

Scope described as Datto SaaS Protection for M365/GWS backups, restores, and seats only
Tooling details beyond “exposing the API” are not provided in the source excerpt

What it does

Surface SaaS backup posture for your M365 and Google Workspace tenants directly to AI assistants — list customer organizations, inspect protected domains and seats, browse backup history, queue restores, and audit activity logs and license usage.

Interactive Seat Card (MCP Apps): datto_saas_get_seat renders as an interactive backup-status card in MCP Apps hosts (Claude Desktop/web) — read-only, showing seat type, Active/Archived status, and last backup; neutral by default, brandable via window.__BRAND__ injection or MCP_BRAND_* env vars; plain-JSON behavior is unchanged in other hosts

Tools

Tool

Purpose

datto_saas_list_clients

List all customer organizations

datto_saas_list_domains

List protected domains under a client

datto_saas_list_seats

List seats in a domain (toggle archived)

datto_saas_get_seat

Fetch a single seat detail

datto_saas_list_backups

List backup runs for a seat

datto_saas_queue_restore

Queue a restore (DESTRUCTIVE — requires confirmation)

datto_saas_get_restore_status

Check restore progress

datto_saas_list_activity

Org activity log (date-range elicitation)

datto_saas_get_license_usage

Seat counts vs purchased

Credentials

Local (env mode)

export DATTO_SAAS_PUBLIC_KEY="..."
export DATTO_SAAS_SECRET_KEY="..."
export DATTO_SAAS_REGION="us"   # or "eu"

Hosted (gateway mode)

The WYRE MCP Gateway injects credentials per request via headers:

X-Datto-SaaS-Public-Key (required, secret)

X-Datto-SaaS-Secret-Key (required, secret)

X-Datto-SaaS-Region (optional, default us)

Install

Configuration

Environment variables

DATTO_SAAS_API_KEYrequiredsecret

Datto SaaS Protection (Backupify) API key

DATTO_SAAS_REGIONdefault us

Region: 'us' (default) or 'eu'

MCP_TRANSPORTdefault stdio

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.

AUTH_MODEdefault env

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.

LOG_LEVELdefault info

Log verbosity: debug, info, warn, error

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "datto-saas-protection-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-technology/datto-saas-protection-mcp:v2.1.4"
      ],
      "env": {
        "DATTO_SAAS_API_KEY": "<YOUR_DATTO_SAAS_API_KEY>",
        "DATTO_SAAS_REGION": "us",
        "MCP_TRANSPORT": "stdio",
        "AUTH_MODE": "env",
        "LOG_LEVEL": "info"
      }
    }
  }
}

Datto SaaS Protection