Kaseya BMS

io.github.WYRE-AIPublished by GitHub account WYRE-AIv1.1.6Updated Oct 27, 2026

MCP server for Kaseya BMS PSA — tickets, accounts, time entries, contracts.

VerifiedSTDIODesktop onlyProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

MCP server for Kaseya BMS PSA that lets an assistant list and read tickets, accounts, contacts, contracts, time entries, service catalog items and knowledge…

What you can do
  • List and read tickets, including filtering by status or a custom filter
  • Create tickets and append internal notes to them, with confirmation prompts
  • Review time entries by date range, plus accounts, contacts and contracts
  • Browse service catalog items and search the knowledge base
  • Render a ticket as an interactive card in MCP Apps hosts with an in-card add-note action
When to use it
Useful for managed service provider teams that run their PSA on Kaseya BMS and want an assistant to look up tickets, clients, contracts and time entries, or to draft new tickets and notes without switching tools.
Requirements
Runs as a local stdio process (Docker image or npm build). Needs KASEYA_BMS_TENANT_SUBDOMAIN plus either KASEYA_BMS_API_TOKEN or KASEYA_BMS_K1_TOKEN when AUTH_MODE=env. HTTP mode additionally requires CONDUIT_S2S_SECRET and an X-Gateway-S2S signed header; gateway mode takes tenant and token from request headers instead.
Before you install
Requires a Kaseya BMS API or Kaseya One SSO token that grants access to PSA data. Creating tickets and adding notes write to the PSA; notes are always posted internal-only. HTTP mode needs CONDUIT_S2S_SECRET, which must never be committed, and MCP_ALLOW_INSECURE_DEV=1 disables request authentication for local development only.

Installation

In SourceWeft

  1. Open Kaseya BMS in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Kaseya BMS MCP Server

[Release] [License: Apache 2.0]

Model Context Protocol (MCP) server for the Kaseya BMS PSA API. Exposes tickets, accounts, contacts, contracts, time entries, the service catalog, and the knowledge base to AI assistants.

Tools

ToolDescription
kaseya_bms_list_ticketsList tickets. Optional $filter; status pick if omitted.
kaseya_bms_get_ticketGet a ticket by id.
kaseya_bms_create_ticketCreate a new ticket (destructive — confirmation required).
kaseya_bms_add_ticket_noteAppend a note to a ticket (destructive — confirmation required).
kaseya_bms_list_time_entriesTime entries by date range (24h / 7d / 30d / custom / all).
kaseya_bms_list_accountsAccounts (clients).
kaseya_bms_list_contactsContacts.
kaseya_bms_list_contractsContracts.
kaseya_bms_list_service_catalogService catalog items.
kaseya_bms_search_knowledge_baseKnowledge base search.

When the user omits required filters or runs a destructive action, the server uses MCP elicitation to prompt for choices or confirm.

Interactive Ticket Card (MCP Apps)

kaseya_bms_get_ticket renders as an interactive card in MCP Apps hosts (Claude Desktop/web) with an in-card "Add note" round-trip via kaseya_bms_add_ticket_note (always posted internal-only); plain-JSON behavior is unchanged in other hosts. The card is neutral by default and brandable via window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME, MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR, MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed. After editing ui/, regenerate the embedded bundle with npm run build:ui.

Configuration

Copy .env.example. Stdio and AUTH_MODE=env read the Kaseya BMS variables. Gateway mode does not.

VariableRequiredDescription
KASEYA_BMS_TENANT_SUBDOMAINFor stdio and AUTH_MODE=envTenant subdomain (e.g. yourcompany)
KASEYA_BMS_API_TOKENOne of, for stdio and AUTH_MODE=envBMS API token
KASEYA_BMS_K1_TOKENOne of, for stdio and AUTH_MODE=envKaseya One SSO token
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENoenv (default) or gateway. Gateway mode requires X-Kaseya-BMS-Tenant-Subdomain plus X-Kaseya-BMS-API-Token or X-Kaseya-BMS-K1-Token on each /mcp request and never falls back to KASEYA_BMS_*.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder. Compose will not start without it. Never commit a real value. Generate one with openssl rand -hex 32.
MCP_ALLOW_INSECURE_DEVNoSet to 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST refuses startup. A known placeholder secret is still refused.
MCP_HTTP_HOSTNoBind address when a real CONDUIT_S2S_SECRET is set. Unset keeps 0.0.0.0, which is what the container image sets, so container deploys stay on every interface inside the container. Without a secret the dev bypass binds 127.0.0.1 instead.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health stays unauthenticated and does not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The value is t=<unix seconds>,v1=<hex>, where v1 is HMAC-SHA256 of the exact string t=<unix seconds> keyed by CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The secret is never written to logs.

js
import { createHmac } from "node:crypto";
const t = Math.floor(Date.now() / 1000);const v1 = createHmac("sha256", process.env.CONDUIT_S2S_SECRET)  .update(`t=${t}`)  .digest("hex");const xGatewayS2s = `t=${t},v1=${v1}`;

In AUTH_MODE=gateway, /mcp also requires X-Kaseya-BMS-Tenant-Subdomain and either X-Kaseya-BMS-API-Token or X-Kaseya-BMS-K1-Token. Those headers are the only credential source for that request. A request missing them returns 401 and does not read KASEYA_BMS_* from the environment. Each request creates a fresh server instance with isolated credentials.

Docker Compose

The checked-in Compose service is gateway mode. It publishes 127.0.0.1:8080:8080, requires CONDUIT_S2S_SECRET, and does not set KASEYA_BMS_TENANT_SUBDOMAIN, KASEYA_BMS_API_TOKEN, KASEYA_BMS_K1_TOKEN, or env_file. The image build reads GitHub Packages credentials from the npmrc build secret (the repo .npmrc only sets the registry).

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up --build

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses KASEYA_BMS_*:

bash
docker build -t kaseya-bms-mcp .docker run --rm \  -e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \  -e AUTH_MODE=env \  -e KASEYA_BMS_TENANT_SUBDOMAIN=yourcompany \  -e KASEYA_BMS_API_TOKEN=... \  -p 127.0.0.1:8080:8080 \  kaseya-bms-mcp

Local development

bash
npm installnpm run buildKASEYA_BMS_TENANT_SUBDOMAIN=yourcompany \  KASEYA_BMS_API_TOKEN=... \  npm start

HTTP refuses to start until CONDUIT_S2S_SECRET is a real secret:

bash
MCP_TRANSPORT=http CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" npm startcurl http://127.0.0.1:8080/health

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

License

Apache-2.0

Source: README.md at commit 3ad28d3

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v1.1.6LatestOct 14, 2026
  2. v1.1.5Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts