Kaseya VSA MCP Server
Model Context Protocol (MCP) server for the Kaseya VSA RMM API. Exposes managed endpoints, software / hardware inventory, patch state, agent procedures, alarms, Service Desk tickets, organizations, and machine groups to AI assistants.
Tools
| Tool | Description |
|---|---|
kaseya_vsa_list_agents | List managed endpoints (agents). Optional $filter. |
kaseya_vsa_get_agent | Get an agent's details by ID. |
kaseya_vsa_get_software_inventory | Installed software for an agent. |
kaseya_vsa_get_hardware_inventory | Hardware audit for an agent. |
kaseya_vsa_get_patch_status | Pending and installed patches for an agent. |
kaseya_vsa_deploy_patches_now | Force a patch deploy on an agent (destructive — confirmation required). |
kaseya_vsa_list_procedures | Agent procedures available to run. |
kaseya_vsa_run_procedure | Execute a procedure on an agent (destructive — confirmation required). |
kaseya_vsa_list_alarms | Open alarms (optional state filter; date-window elicitation if missing). |
kaseya_vsa_list_tickets | Service Desk tickets (returns a friendly message if SD module isn't enabled). |
kaseya_vsa_list_organizations | Tenant organizations. |
kaseya_vsa_list_machine_groups | Machine group hierarchy. |
When the user omits required filters or runs a destructive action, the server uses MCP elicitation to prompt for choices or confirm.
Configuration
Environment-variable mode (default)
| Variable | Required | Description |
|---|---|---|
KASEYA_VSA_TENANT_URL | yes | Full base URL incl. /api/v1.0 |
KASEYA_VSA_USERNAME | one of | Local-auth username |
KASEYA_VSA_PASSWORD | one of | Local-auth password (secret) |
KASEYA_VSA_K1_TOKEN | one of | Kaseya One SSO token (alternative to username + password) |
MCP_TRANSPORT | no | stdio (default) or http |
MCP_HTTP_PORT | no | HTTP listen port (default 8080) |
AUTH_MODE | no | env (default) or gateway |
Either the username + password pair OR the KASEYA_VSA_K1_TOKEN is required.
Gateway mode
When deployed behind the WYRE MCP Gateway, set AUTH_MODE=gateway and the
server will read credentials from per-request HTTP headers:
X-Kaseya-VSA-Tenant-Url(required)X-Kaseya-VSA-Username(with password)X-Kaseya-VSA-Password(with username)X-Kaseya-VSA-K1-Token(alternative to username + password)
Each request creates a fresh server instance with isolated credentials — no
cross-tenant process.env pollution.
Local development
npm install
npm run build
KASEYA_VSA_TENANT_URL=https://vsa.example.com/api/v1.0 \
KASEYA_VSA_USERNAME=... \
KASEYA_VSA_PASSWORD=... \
npm start
Run as HTTP for testing:
MCP_TRANSPORT=http npm start
curl http://localhost:8080/health
Docker
docker build -t kaseya-vsa-mcp .
docker run --rm -p 8080:8080 \
-e KASEYA_VSA_TENANT_URL=https://vsa.example.com/api/v1.0 \
-e KASEYA_VSA_USERNAME=... \
-e KASEYA_VSA_PASSWORD=... \
kaseya-vsa-mcp
License
Apache-2.0