Axcient x360Recover

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.0.1Updated Oct 24, 2026

MCP server for Axcient x360Recover — BCDR clients, devices, jobs, vaults, and appliances.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

MCP server for Axcient x360Recover that lets an assistant inspect BCDR clients, devices, backup jobs, vaults and appliances through the x360Portal API.

What you can do
  • Verify the API key and read the organization tied to it
  • List and get clients (customer/site records)
  • List and get devices, including per-client listing, AutoVerify status and restore points
  • List backup jobs by device and read job details and job history
  • List and get vaults and read or set a vault connectivity threshold
  • List and get appliances, including per-client listing
When to use it
Useful when you manage Axcient x360Recover BCDR environments and want an assistant to look up clients, devices, backup job status, vaults or appliances without opening the portal. Also handy for checking connectivity thresholds or generating an agent enrollment token during onboarding.
Requirements
Runs as a local stdio process (Docker image or npm build from source). Needs an Axcient x360Portal API key in AXCIENT_API_KEY for stdio or AUTH_MODE=env. Optional settings include AUTH_MODE, MCP_TRANSPORT, LOG_LEVEL. HTTP hosting additionally requires CONDUIT_S2S_SECRET and X-Gateway-S2S signing; gateway mode expects the key per request in the X-Axcient-Api-Key header.
Before you install
The API key grants access to your x360Recover tenant data, so store it as a secret and never commit it. The set-vault-threshold tool changes a vault setting. The D2C agent token tool mints an enrollment token that can enroll new agents. HTTP mode requires CONDUIT_S2S_SECRET; the insecure dev flag disables S2S checks and should stay local only. Data is sent to Axcient's API.

Installation

In SourceWeft

  1. Open Axcient x360Recover in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

axcient-mcp

MCP server for Axcient x360Recover — BCDR clients, devices, backup jobs, vaults, and appliances. Built on @wyre-technology/node-axcient and the MCP v2 SDK, serving both the 2025-era initialize handshake and the 2026-07-28 stateless envelope from a single dual-era HTTP entrypoint.

Credentials

Generate an API key in the x360Portal: Settings → API Keys (see Axcient's key management guide).

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file.

  • Local / stdio (Claude Desktop, CLI): set AXCIENT_API_KEY. The stdio transport does not use CONDUIT_S2S_SECRET.
  • Hosted / gateway: the WYRE MCP Gateway injects X-Axcient-Api-Key per request (AUTH_MODE=gateway). The gateway compose service does not set AXCIENT_API_KEY and does not use env_file.
VariableRequiredDescription
AXCIENT_API_KEYFor stdio and AUTH_MODE=envx360Portal API key
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENogateway (Docker image and Compose default) or env. Gateway mode requires X-Axcient-Api-Key on each /mcp request and never falls back to AXCIENT_API_KEY. env uses that variable only after S2S auth succeeds.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder. Compose will not start without it. Never commit a real value. Generate one with openssl rand -hex 32.
MCP_ALLOW_INSECURE_DEVNoSet to 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A wider MCP_HTTP_HOST is ignored. A placeholder secret is still refused.
MCP_HTTP_HOSTNoBind address when a real CONDUIT_S2S_SECRET is set. Defaults to 127.0.0.1. The container image sets 0.0.0.0.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health and /healthz stay unauthenticated and do not read credentials.

X-Gateway-S2S signing

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S:

X-Gateway-S2S: t=<unix seconds>,v1=<hex hmac-sha256>

v1 is HMAC-SHA256 over the ASCII message t=<unix seconds>, keyed with CONDUIT_S2S_SECRET, hex-encoded. The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The secret is never logged.

js
import { createHmac } from "node:crypto";
const t = Math.floor(Date.now() / 1000);const v1 = createHmac("sha256", process.env.CONDUIT_S2S_SECRET).update(`t=${t}`).digest("hex");const xGatewayS2s = `t=${t},v1=${v1}`;

In AUTH_MODE=gateway, /mcp also requires X-Axcient-Api-Key. A request missing that header returns 401 and does not fall back to AXCIENT_API_KEY.

Run locally (stdio)

bash
npm installnpm run buildAXCIENT_API_KEY=your-key npm start

Run as HTTP (gateway / hosted)

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" MCP_TRANSPORT=http AUTH_MODE=env AXCIENT_API_KEY=your-key npm start# → http://127.0.0.1:8080/mcp, health at http://127.0.0.1:8080/health

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

Docker

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, the Axcient API key arrives on each request as X-Axcient-Api-Key; it is not read from the environment.

bash
docker build --platform linux/amd64 --build-arg GITHUB_TOKEN=$(gh auth token) -t axcient-mcp .docker run \  -e CONDUIT_S2S_SECRET=your-s2s-secret \  -p 127.0.0.1:8080:8080 \  axcient-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, runs AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not inject AXCIENT_API_KEY:

bash
CONDUIT_S2S_SECRET=your-s2s-secret GITHUB_TOKEN=$(gh auth token) docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses AXCIENT_API_KEY:

bash
docker run \  -e CONDUIT_S2S_SECRET=your-s2s-secret \  -e AUTH_MODE=env \  -e AXCIENT_API_KEY=your-key \  -p 127.0.0.1:8080:8080 \  axcient-mcp

Tools

20 tools, flat surface (no router — well under the fleet's ~25-tool threshold).

ToolDescription
axcient_test_connectionVerify the API key by fetching the organization record
axcient_get_organizationGet the organization for the API key
axcient_list_clients / axcient_get_clientClients (customer/site records)
axcient_get_d2c_agent_tokenMint a D2C agent enrollment token
axcient_list_devices / axcient_list_devices_by_client / axcient_get_deviceDevices
axcient_get_device_autoverify / axcient_get_device_restore_pointsAutoVerify + restore points
axcient_list_jobs_by_device / axcient_get_job / axcient_get_job_historyBackup jobs
axcient_list_vaults / axcient_get_vaultVaults
axcient_get_vault_threshold / axcient_set_vault_thresholdVault connectivity threshold
axcient_list_appliances / axcient_list_appliances_by_client / axcient_get_applianceAppliances

No destructive tools exist in this surface — the x360Recover public API (v0.3.1) has no delete/disable operations, so no confirmation/elicitation flow is wired up. See node-axcient's README for known API quirks (error-shape inconsistencies, list-endpoint schema documentation bugs) this server's error messages surface verbatim from the SDK.

License

Apache-2.0

Source: README.md at commit 48bdd1d

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.