Gorelo

io.github.WYRE-AIPublished by GitHub account WYRE-AIv1.1.1Updated Oct 29, 2026

MCP server for Gorelo's PSA ticket, client, contact, contract, asset, and time-tracking APIs.

VerifiedSTDIODesktop onlyProductivity & WorkflowSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Local MCP server exposing Gorelo's PSA REST API, letting an assistant read and manage tickets, clients, contacts, assets, projects, documents and billing.

What you can do
  • List, read, create and update tickets, comments, approvals and side conversations
  • Manage clients, contacts, locations, groups and users
  • Work with assets, custom assets, uptime checks and alerts
  • Browse and edit projects, sections, tasks, comments and approvals
  • Read and create documents, forms and form submission links
  • Read billing data (contracts, invoices, items, time entries) and optionally create invoices, payments and catalog items
When to use it
Useful for managed service providers or IT teams that run their service desk on Gorelo and want an assistant to look up tickets and clients, draft updates, log time, or summarise projects and billing without switching tools.
Requirements
Runs as a local process (stdio) from the published container image, or over HTTP for gateway hosting. Needs a Gorelo Public API key in GORELO_API_KEY (sent as the X-API-Key header) and the correct GORELO_REGION (us or au). HTTP mode additionally requires CONDUIT_S2S_SECRET. Network access to the Gorelo API is required.
Before you install
The API key grants access to tenant data and is sent on every request. Write tools create and change tickets, clients, contacts, projects and documents; DELETE tools are off unless GORELO_ENABLE_DESTRUCTIVE=true, and invoice, payment and item writes are off unless GORELO_ENABLE_BILLING_WRITES=true. Destructive actions cannot be undone from the server. Keep CONDUIT_S2S_SECRET out of commits and never use placeholder values.

Installation

In SourceWeft

  1. Open Gorelo in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Gorelo MCP Server

MCP server for Gorelo's PSA (Professional Services Automation) REST API - full Public API coverage (tickets, clients, contacts, assets, billing, projects, documents, alerts, and more) - for AI assistants and the WYRE Conduit gateway.

Authentication

Generate an API key for your Gorelo organization and send it as the X-API-Key header - this server handles that on every request. There is no token exchange.

Configuration

Copy .env.example and set the variables below.

Env varDescription
GORELO_API_KEYGorelo Public API key for stdio and AUTH_MODE=env. Not read by the gateway Compose service.
GORELO_REGIONus (default) or au - your account's regional API host. Not a credential.
MCP_TRANSPORTstdio (default) or http.
AUTH_MODEenv (default, reads the vars above) or gateway (credentials arrive per-request via X-Gorelo-* headers, injected by the Conduit gateway). Gateway mode never falls back to GORELO_API_KEY. The container image and Compose default to gateway.
CONDUIT_S2S_SECRETRequired to start the HTTP transport. The process logs an error and exits non-zero when this is empty or a known placeholder (changeme, change-me, secret, example, placeholder, replace-me, your-secret, your-s2s-secret, s2s-secret, replace-with-a-real-secret). Compose will not start without it. Never commit a real value. The value is never logged.
MCP_ALLOW_INSECURE_DEVSet to exactly 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST is overridden and logged. A placeholder secret still refuses to start.
MCP_HTTP_HOSTBind address when a secret is configured. Unset means 0.0.0.0. The container image sets 0.0.0.0. Ignored in favor of 127.0.0.1 when there is no secret.
MCP_HTTP_PORTHTTP port. Defaults to 8080.
GORELO_PRESET, GORELO_ENABLE_DESTRUCTIVE, GORELO_ENABLE_BILLING_WRITES, GORELO_TOOLS_INCLUDE, GORELO_TOOLS_EXCLUDETool selection; see Tool selection.
LOG_LEVELdebug | info (default) | warn | error.

/health stays unauthenticated, does not call getCredentials(), and does not return the API key. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The value is t=<unix seconds>,v1=<hex hmac-sha256>, where the HMAC is SHA-256 over the literal string t=<unix seconds> using CONDUIT_S2S_SECRET as the key. A missing or invalid header returns 401. The proof is valid for five minutes of clock skew.

In AUTH_MODE=gateway, /mcp also requires X-Gorelo-Api-Key. X-Gorelo-Region is optional; when present it must be exactly us or au, and any other value returns 400. The API key header is the only credential source for the request. A missing key returns 401 and does not fall back to GORELO_API_KEY.

http
POST /mcp HTTP/1.1X-Gateway-S2S: t=1710000000,v1=<hmac-sha256 hex of "t=1710000000">X-Gorelo-Api-Key: <tenant api key>X-Gorelo-Region: us

Request limits

  • HTTP request bodies are capped at 256 KiB (262144 bytes). After the X-Gateway-S2S check passes, a Content-Length above the cap returns 413 with a JSON-RPC error; bodies without Content-Length are capped by the MCP SDK transport. Unauthenticated requests still get 401 first.
  • tools/call arguments are capped at 10,000 elements (every array item and object key at any depth). Larger inputs return an isError tool result and are never dispatched.

These limits address CVE-2026-111768 / GHSA-46jr-4wx8-v453 (memory exhaustion during validation) and GHSA-f897-62hf-6gxq (no request body / batch cap).

Tools

112 tools, generated at build time from Gorelo's OpenAPI spec (spec/gorelo-openapi.json, fetched 2026-10-20: 117 operations, 5 excluded). Names follow gorelo_<verb>_<noun>. The 24 read tools from earlier releases keep their names; their arguments are unchanged (camelCase filters such as pageSize/statusIds as arrays, and id for the get_client/get_contact/get_asset/get_time_entry tools).

Tiers follow the HTTP method:

TierMethodsCountAnnotationsDefault
readGET58readOnlyHint: trueon
writePOST / PUT / PATCH36readOnlyHint: false, destructiveHint: falseon (the gateway gates writes), except billing writes (below)
destructiveDELETE18readOnlyHint: false, destructiveHint: trueoff; set GORELO_ENABLE_DESTRUCTIVE=true

Write tools marked admin create or change clients, contacts, the item catalog, invoices or payments.

Money is read-only by default: the four billing writes (gorelo_create_invoice, gorelo_create_payment, gorelo_create_item, gorelo_update_item; every non-DELETE write under the Billing tag except time entries) are hidden from tools/list and refused at call time unless GORELO_ENABLE_BILLING_WRITES=true. The readonly preset hides them regardless. Billing DELETEs are ordinary destructive tools. Time entry create/update are unaffected.

The machine-readable classification (read / write / destructive / admin / billing_write / excluded_binary / excluded_sensitive) comes from node scripts/generate-tools.mjs --tiers <file>.

Request bodies are passed under a single body argument (the JSON object Gorelo documents for that endpoint). Multi-value filters (statusIds, clientIds, ...) take an array, which is sent comma-joined.

Alerts

ToolTierDescription
gorelo_list_alertsreadLists alerts in Gorelo across all your clients.
gorelo_create_alertwriteRaises a new alert against one of your clients in Gorelo, such as an alert from an outside monitoring tool.

Assets

ToolTierDescription
gorelo_get_assetreadGets a single agent (managed device) asset by id.
gorelo_get_custom_assetreadGets a single custom asset by id.
gorelo_get_uptime_checkreadGets a single uptime check by id.
gorelo_list_assetsreadLists agent (managed device) assets for the service provider using cursor pagination. Results are sorted by createdOn descending (newest first).
gorelo_list_custom_asset_hardware_typesreadLists the hardware types a custom asset can be given.
gorelo_list_custom_assetsreadLists custom (non-agent) assets for the service provider using cursor pagination. Results are sorted by createdOn descending (newest first).
gorelo_list_uptime_checksreadLists uptime checks for the service provider using cursor pagination. Results are sorted by createdOn descending (newest first).
gorelo_create_custom_assetwriteCreates a custom asset, meaning a device without the Gorelo agent, such as a printer or firewall. Use gorelo_list_custom_asset_hardware_types for valid hardware types.
gorelo_create_uptime_checkwriteCreates an uptime check that pings a host, requests a web address or connects to a TCP port on a schedule.
gorelo_update_custom_assetwriteUpdates a custom asset. Send only the fields you want to change.
gorelo_update_uptime_checkwriteUpdates an uptime check. Send only the fields you want to change.
gorelo_delete_assetdestructiveDeletes a managed device (agent asset) from Gorelo. This is destructive and can't be undone from Conduit.
gorelo_delete_custom_assetdestructiveDeletes a custom asset from Gorelo. This is destructive and can't be undone from Conduit.
gorelo_delete_uptime_checkdestructiveDeletes an uptime check, which stops that monitoring. This is destructive and can't be undone from Conduit.

Billing

ToolTierDescription
gorelo_get_contractreadGets one contract, including the products and labor in each service line.
gorelo_get_invoicereadGets one invoice, with its attachments and line items.
gorelo_get_itemreadGets one catalog item (a product or a bundle) by ID.
gorelo_get_time_entryreadGets a single time entry by id.
gorelo_list_billing_rolesreadLists the billing roles configured for the service provider. Use a role's Id as BillingRoleId when logging time against a ticket.
gorelo_list_contractsreadLists billing contracts, each with the service lines it is made of.
gorelo_list_invoicesreadLists the service provider's invoices, filtered and sorted.
gorelo_list_item_categoriesreadLists the categories products are organised under, each with its subcategories.
gorelo_list_itemsreadLists the service provider's item catalog: products and bundles.
gorelo_list_taxesreadLists the tax rates configured for the service provider.
gorelo_list_time_entriesreadLists logged time across every ticket and task, narrowed by any of the filters.
gorelo_list_work_typesreadLists the work types configured for the service provider. Use a work type's Id as WorkTypeId when logging time against a ticket.
gorelo_create_invoicewrite (admin, billing)Raises a manual invoice against a client, with line items.
gorelo_create_itemwrite (admin, billing)Creates a product or a bundle in the item catalog.
gorelo_create_paymentwrite (admin, billing)Records a payment received outside Gorelo against an approved invoice.
gorelo_create_time_entrywriteLogs time against a ticket.
gorelo_update_itemwrite (admin, billing)Partially updates an item. Send only the fields you want to change.
gorelo_update_time_entrywritePartially updates a time entry. Send only the fields you want to change.
gorelo_delete_contractdestructiveDeletes a billing contract from Gorelo. This is destructive and can't be undone from Conduit.
gorelo_delete_invoicedestructiveDeletes or voids an invoice, depending on its status. This is destructive and can't be undone from Conduit.
gorelo_delete_itemdestructiveDeletes a product or bundle from the item catalog. This is destructive and can't be undone from Conduit.
gorelo_delete_paymentdestructiveDeletes a payment that was recorded through the Gorelo API, for example with gorelo_create_payment. This is destructive and can't be undone from Conduit.
gorelo_delete_time_entrydestructiveDeletes a logged time entry. This is destructive and can't be undone from Conduit.

Clients

ToolTierDescription
gorelo_get_clientreadGets a single client by id.
gorelo_list_client_locationsreadLists the locations for a given client.
gorelo_list_clientsreadLists clients for the service provider using cursor pagination. Results are sorted by client id ascending (oldest first).
gorelo_create_clientwrite (admin)Creates a client (and its default location) for the service provider.
gorelo_update_clientwrite (admin)Updates an existing client. Only supplied (non-null) fields are changed.
gorelo_delete_clientdestructiveDeletes a client from Gorelo. This is destructive and can't be undone from Conduit.

Contacts

ToolTierDescription
gorelo_get_contactreadGets a single contact by id.
gorelo_list_contactsreadLists contacts for the service provider using cursor pagination, optionally filtered by client. Results are sorted by contact id ascending (oldest first).
gorelo_create_contactwrite (admin)Creates a contact under a client, or a temporary contact when no client is given.
gorelo_update_contactwrite (admin)Updates a contact. Send only the fields you want to change.
gorelo_delete_contactdestructiveDeletes a contact from Gorelo. This is destructive and can't be undone from Conduit.

Deletions

ToolTierDescription
gorelo_list_deletionsreadLists records that have been deleted, so a copy kept in sync through this API can remove them. Results are sorted by DeletedOn ascending, then type id, then id, using cursor pagination.

Documents

ToolTierDescription
gorelo_get_documentreadGets a single document.
gorelo_get_document_versionreadGets one version of a document, with its body and attachments.
gorelo_list_document_related_itemsreadLists the records a document is related to.
gorelo_list_document_versionsreadLists a document's versions, newest first.
gorelo_list_documentsreadLists the service provider's documents.
gorelo_create_documentwriteCreates a document with an HTML body, either for a client or for internal use, optionally nested under another document.
gorelo_create_document_related_itemwriteRelates a document to other records.
gorelo_duplicate_documentwriteMakes a copy of a document as a new document.
gorelo_restore_document_versionwriteMakes an earlier version the current one.
gorelo_update_documentwriteUpdates a document's title, body or placement. Send only the fields you want to change.
gorelo_delete_document_related_itemdestructiveRemoves one related item from a document.

Forms

ToolTierDescription
gorelo_list_form_responsesreadLists a form's submitted responses, newest first.
gorelo_list_formsreadLists the service provider's forms, most recently updated first.
gorelo_create_form_submission_linkwriteCreates a link someone can use to fill in and submit this form.

Organization

ToolTierDescription
gorelo_list_api_keysreadLists your Gorelo API keys, newest first. Shows names and details only, never the key values.
gorelo_list_groupsreadLists the technician groups configured for the service provider.
gorelo_list_usersreadLists users (technicians) for the service provider using cursor pagination. Results are sorted by user id ascending (oldest first).

Projects

ToolTierDescription
gorelo_get_projectreadGets a single project.
gorelo_get_project_commentreadReturns one comment on a project.
gorelo_get_project_taskreadReturns one task in full.
gorelo_get_project_task_approvalreadGets one approval on a task, with its approvers.
gorelo_get_project_task_commentreadReturns one comment on a task.
gorelo_list_project_commentsreadReturns a project's comments, newest first.
gorelo_list_project_sectionsreadLists a project's sections.
gorelo_list_project_tagsreadLists the project tags configured for the service provider.
gorelo_list_project_task_commentsreadReturns a task's comments, newest first.
gorelo_list_project_task_conversationsreadLists the conversations on a task.
gorelo_list_project_tasksreadLists a project's tasks.
gorelo_list_project_typesreadLists the project types configured for the service provider.
gorelo_list_projectsreadLists projects, newest activity first.
gorelo_create_projectwriteCreates a project in Gorelo.
gorelo_create_project_commentwritePosts a comment on a project.
gorelo_create_project_sectionwriteAdds a section to a project.
gorelo_create_project_taskwriteCreates a task on a project's board.
gorelo_create_project_task_approvalwriteAsks contacts to approve something on a task.
gorelo_create_project_task_commentwritePosts a comment on a task.
gorelo_create_project_task_side_conversationwriteStarts a side conversation on a task.
gorelo_update_projectwriteUpdates a project. Send only the fields you want to change.
gorelo_update_project_sectionwriteUpdates a section's title or colour. Send only the fields you want to change.
gorelo_update_project_taskwriteUpdates a task. Send only the fields you want to change.
gorelo_delete_projectdestructiveDeletes a project and every task in it. This is destructive and can't be undone from Conduit.
gorelo_delete_project_commentdestructiveDeletes one comment on a project. This is destructive and can't be undone from Conduit.
gorelo_delete_project_sectiondestructiveDeletes a project section and every task in it. This is destructive and can't be undone from Conduit.
gorelo_delete_project_taskdestructiveDeletes a project task. This is destructive and can't be undone from Conduit.
gorelo_delete_project_task_commentdestructiveDeletes one comment on a task. This is destructive and can't be undone from Conduit.

Tickets

ToolTierDescription
gorelo_get_ticketreadGets a single ticket.
gorelo_get_ticket_approvalreadGets a single approval on a ticket, with its approvers. This is where approval status lives — the conversations list stays lean and does not carry it.
gorelo_get_ticket_commentreadGets a single comment on a ticket. Same shape as a comments-list item except that the full BodyHtml is always included, so there is no BodyTruncated field.
gorelo_list_ticket_commentsreadLists the comments on a ticket using cursor pagination. Comments read oldest-first by default, like a conversation top to bottom.
gorelo_list_ticket_conversationsreadLists the conversations on a ticket.
gorelo_list_ticket_statusesreadLists the ticket statuses configured for the service provider.
gorelo_list_ticket_tagsreadLists the ticket tags configured for the service provider.
gorelo_list_ticket_typesreadLists the ticket types configured for the service provider.
gorelo_list_ticketsreadLists tickets for the service provider using cursor pagination. Default sort is updatedOn desc.
gorelo_create_ticketwriteCreates a ticket in Gorelo.
gorelo_create_ticket_approvalwriteCreates an approval on a ticket. Every listed contact starts Pending.
gorelo_create_ticket_commentwriteAdds a comment to a ticket. Gorelo shows it as posted by the API, not by you, and To and Cc come from the ticket's conversation.
gorelo_create_ticket_side_conversationwriteCreates a side conversation on a ticket. Post a comment into it afterward using this conversation's returned Id as conversationId with conversationType=3.
gorelo_update_ticketwritePartially updates a ticket. Send only the fields you want to change.
gorelo_delete_ticketdestructiveDeletes a ticket and its time entries. This is destructive and can't be undone from Conduit.
gorelo_delete_ticket_commentdestructiveDeletes a private comment from a ticket. This is destructive and can't be undone from Conduit.

tools/list size

Measured as the JSON size of the tools/list result (names, descriptions, input schemas, annotations):

ConfigurationToolsBytes
GORELO_PRESET=readonly5839,718
default (read + write, no billing writes)9087,530
GORELO_ENABLE_DESTRUCTIVE=true + GORELO_ENABLE_BILLING_WRITES=true (everything)112102,064

Use a preset or GORELO_TOOLS_INCLUDE to shrink the list for clients with tight context budgets.

Tool selection

Env varDescription
GORELO_PRESETall (default: read + write), readonly (read only), crm (Clients, Contacts, Organization), tickets (Tickets, Contacts, Clients), monitoring (Alerts, Assets). Tag presets match any of an operation's OpenAPI tags. Unknown values refuse to start.
GORELO_ENABLE_DESTRUCTIVEtrue enables the DELETE tools. Anything else leaves them off. Presets and filters never enable them.
GORELO_ENABLE_BILLING_WRITEStrue enables invoice, payment and item create/update. Default off; presets and filters never enable them.
GORELO_TOOLS_INCLUDEComma-separated name globs (*, ?); keep only matching tools, e.g. gorelo_*_ticket*,gorelo_list_clients.
GORELO_TOOLS_EXCLUDEComma-separated name globs; drop matching tools.

Presets and filters only narrow the set. A tool hidden from tools/list is also refused if called by name. Selection that leaves zero tools refuses to start.

Exclusions

Five operations are deliberately not exposed. Three because the Conduit gateway has no confirmed binary tool-result or upload path:

OperationReason
POST /v1/attachmentsmultipart file upload
GET /v1/invoices/{invoiceId}/pdfreturns a binary PDF
GET /v1/documents/{documentId}/pdfreturns a binary PDF

The list lives in EXCLUDED_BINARY in scripts/generate-tools.mjs.

Two more are never exposed under any configuration: POST /v1/api-keys and DELETE /v1/api-keys/{apiKeyId} (EXCLUDED_SENSITIVE; credential minting/revocation is out of scope for an AI tool surface). gorelo_list_api_keys stays: it returns key metadata only (id, name, scopes, dates), never the key value.

Behavior

  • One generic executor runs every tool: path parameters are URL-encoded, the host is always the region's fixed base URL (us / au), and redirects are refused.
  • HTTP 429 is retried up to 3 times (honoring Retry-After, capped at 15s, else exponential backoff).
  • Responses over 100KB are truncated with an explicit [TRUNCATED: ...] marker; narrow with filters or pageSize and follow the cursor.
  • 403 returns The Gorelo API key for this connection doesn't have permission to run <tool> (HTTP 403). An admin can check the key's permissions in Gorelo under Settings → Integrations. 401, 404 and 422 have their own messages. The API key is never included in errors or logs.

Regenerating

bash
npm run generate         # rewrite src/generated/tools.ts from spec/gorelo-openapi.jsonnpm run generate:check   # exit 1 if the committed file is stale (also enforced by a test and CI)

To pick up a new Gorelo API version, replace spec/gorelo-openapi.json, run npm run generate, review the diff (new operations need no code unless they use a body format other than JSON, which the generator rejects loudly), and commit both files.

Attribution

The operation-to-tool approach, retry/backoff and size-guard logic are adapted from peetinc/gorelo-mcp-all (MIT, Copyright (c) 2026 peetinc). See THIRD_PARTY_NOTICES.md.

Development

bash
npm installnpm run generate   # only after changing spec/gorelo-openapi.jsonnpm run buildnpm testnpm run lint   # tsc --noEmit

Docker

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass a real S2S secret. In gateway mode, the Gorelo API key arrives on each request as X-Gorelo-Api-Key; it is not read from the environment. Do not pass a known placeholder such as your-s2s-secret or changeme. Startup treats those as unset and exits.

bash
docker build -t gorelo-mcp .docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -p 127.0.0.1:8080:8080 \  gorelo-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, does not pass GORELO_API_KEY, and publishes 127.0.0.1:8080:8080. A project .env is interpolation only. Do not add env_file to the gateway service.

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses GORELO_API_KEY:

bash
docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -e AUTH_MODE=env \  -e GORELO_API_KEY=your-value \  -e GORELO_REGION=us \  -p 127.0.0.1:8080:8080 \  gorelo-mcp

Local HTTP without a secret is development-only. It binds 127.0.0.1 even if MCP_HTTP_HOST is 0.0.0.0, and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm run start:http

Source: README.md at commit bf4e924

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package type cannot run in the sandbox.

Version history

4
  1. v1.1.1LatestOct 22, 2026
  2. v1.1.0Oct 20, 2026
  3. v1.0.1Oct 14, 2026
  4. v1.0.0Sep 20, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.