Kaseya BMS

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.1.4Updated Oct 24, 2026

MCP server for Kaseya BMS PSA — tickets, accounts, time entries, contracts.

VerifiedSTDIODesktop onlyProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

Lets an assistant read and act on Kaseya BMS PSA data such as tickets, accounts, contacts, contracts, time entries, and knowledge base articles.

What you can do
Connects an AI assistant to the Kaseya BMS PSA API. Tools list and fetch tickets, create tickets, append ticket notes, list time entries by date range, and list accounts, contacts, contracts, and service catalog items, plus a knowledge base search. In MCP Apps hosts, ticket retrieval renders as an interactive card with an in-card add-note action; other hosts get plain JSON. When filters are missing or a destructive action is requested, the server prompts for choices or confirmation.
When to use it
Useful for support and service teams already running Kaseya BMS who want an assistant to look up tickets, accounts, and contracts, review time entries, search the knowledge base, or draft and log ticket updates without switching to the PSA interface.
Requirements
Runs as a local process over stdio, typically from the published container image. Requires the tenant subdomain in KASEYA_BMS_TENANT_SUBDOMAIN and either KASEYA_BMS_API_TOKEN or KASEYA_BMS_K1_TOKEN. AUTH_MODE selects local environment credentials or gateway header injection; MCP_TRANSPORT and MCP_HTTP_PORT control transport and port. Network access to the Kaseya BMS API is needed.
Before you install
The server handles PSA credentials: KASEYA_BMS_API_TOKEN or KASEYA_BMS_K1_TOKEN are secrets and should be supplied through environment variables or gateway headers, never committed. Creating tickets and adding ticket notes write to the PSA and are marked destructive, requiring confirmation. In gateway mode, credentials arrive in per-request headers such as X-Kaseya-BMS-API-Token, so header handling must be trusted.

Installation

In SourceWeft

  1. Open Kaseya BMS in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Kaseya BMS MCP Server

[Release] [License: Apache 2.0]

Model Context Protocol (MCP) server for the Kaseya BMS PSA API. Exposes tickets, accounts, contacts, contracts, time entries, the service catalog, and the knowledge base to AI assistants.

Tools

ToolDescription
kaseya_bms_list_ticketsList tickets. Optional $filter; status pick if omitted.
kaseya_bms_get_ticketGet a ticket by id.
kaseya_bms_create_ticketCreate a new ticket (destructive — confirmation required).
kaseya_bms_add_ticket_noteAppend a note to a ticket (destructive — confirmation required).
kaseya_bms_list_time_entriesTime entries by date range (24h / 7d / 30d / custom / all).
kaseya_bms_list_accountsAccounts (clients).
kaseya_bms_list_contactsContacts.
kaseya_bms_list_contractsContracts.
kaseya_bms_list_service_catalogService catalog items.
kaseya_bms_search_knowledge_baseKnowledge base search.

When the user omits required filters or runs a destructive action, the server uses MCP elicitation to prompt for choices or confirm.

Interactive Ticket Card (MCP Apps)

kaseya_bms_get_ticket renders as an interactive card in MCP Apps hosts (Claude Desktop/web) with an in-card "Add note" round-trip via kaseya_bms_add_ticket_note (always posted internal-only); plain-JSON behavior is unchanged in other hosts. The card is neutral by default and brandable via window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME, MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR, MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed. After editing ui/, regenerate the embedded bundle with npm run build:ui.

Configuration

Copy .env.example. Stdio and AUTH_MODE=env read the Kaseya BMS variables. Gateway mode does not.

VariableRequiredDescription
KASEYA_BMS_TENANT_SUBDOMAINFor stdio and AUTH_MODE=envTenant subdomain (e.g. yourcompany)
KASEYA_BMS_API_TOKENOne of, for stdio and AUTH_MODE=envBMS API token
KASEYA_BMS_K1_TOKENOne of, for stdio and AUTH_MODE=envKaseya One SSO token
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENoenv (default) or gateway. Gateway mode requires X-Kaseya-BMS-Tenant-Subdomain plus X-Kaseya-BMS-API-Token or X-Kaseya-BMS-K1-Token on each /mcp request and never falls back to KASEYA_BMS_*.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder. Compose will not start without it. Never commit a real value. Generate one with openssl rand -hex 32.
MCP_ALLOW_INSECURE_DEVNoSet to 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST refuses startup. A known placeholder secret is still refused.
MCP_HTTP_HOSTNoBind address when a real CONDUIT_S2S_SECRET is set. Unset keeps 0.0.0.0, which is what the container image sets, so container deploys stay on every interface inside the container. Without a secret the dev bypass binds 127.0.0.1 instead.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health stays unauthenticated and does not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The value is t=<unix seconds>,v1=<hex>, where v1 is HMAC-SHA256 of the exact string t=<unix seconds> keyed by CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The secret is never written to logs.

js
import { createHmac } from "node:crypto";
const t = Math.floor(Date.now() / 1000);const v1 = createHmac("sha256", process.env.CONDUIT_S2S_SECRET)  .update(`t=${t}`)  .digest("hex");const xGatewayS2s = `t=${t},v1=${v1}`;

In AUTH_MODE=gateway, /mcp also requires X-Kaseya-BMS-Tenant-Subdomain and either X-Kaseya-BMS-API-Token or X-Kaseya-BMS-K1-Token. Those headers are the only credential source for that request. A request missing them returns 401 and does not read KASEYA_BMS_* from the environment. Each request creates a fresh server instance with isolated credentials.

Docker Compose

The checked-in Compose service is gateway mode. It publishes 127.0.0.1:8080:8080, requires CONDUIT_S2S_SECRET, and does not set KASEYA_BMS_TENANT_SUBDOMAIN, KASEYA_BMS_API_TOKEN, KASEYA_BMS_K1_TOKEN, or env_file. The image build reads GitHub Packages credentials from the npmrc build secret (the repo .npmrc only sets the registry).

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up --build

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses KASEYA_BMS_*:

bash
docker build -t kaseya-bms-mcp .docker run --rm \  -e CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" \  -e AUTH_MODE=env \  -e KASEYA_BMS_TENANT_SUBDOMAIN=yourcompany \  -e KASEYA_BMS_API_TOKEN=... \  -p 127.0.0.1:8080:8080 \  kaseya-bms-mcp

Local development

bash
npm installnpm run buildKASEYA_BMS_TENANT_SUBDOMAIN=yourcompany \  KASEYA_BMS_API_TOKEN=... \  npm start

HTTP refuses to start until CONDUIT_S2S_SECRET is a real secret:

bash
MCP_TRANSPORT=http CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" npm startcurl http://127.0.0.1:8080/health

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

License

Apache-2.0

Source: README.md at commit 3ad28d3

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.1.4LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts