SaaS Alerts

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.2.4Updated Oct 24, 2026

MCP server for Kaseya SaaS Alerts — SaaS security monitoring for M365 & Google Workspace.

The publisher's own server: AlertsBar

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

MCP server for Kaseya SaaS Alerts that lets an assistant query M365 and Google Workspace security events and manage customers, devices, reports and billing.

What you can do
  • Query and count security events by severity, customer, user or event type, with advanced queries, scroll pagination and recommended actions
  • List, create, update and delete customers, and set IP, country and account whitelists
  • Look up MSP, partner and customer users
  • Inspect mapped, unmapped and ignored devices and device organizations
  • Review billing details and billing date history
  • List, get, create and delete scheduled reports, and read partner profile and branding settings
When to use it
Useful for managed service providers or security teams that want an assistant to triage SaaS security alerts, investigate events across customers, or maintain customer and device records in SaaS Alerts without leaving the chat.
Requirements
Runs as a local process (stdio) from the published container image, or over HTTP. Needs a SaaS Alerts API key in SAAS_ALERTS_API_KEY for stdio or AUTH_MODE=env; HTTP mode also requires CONDUIT_S2S_SECRET and X-Gateway-S2S signing, or gateway mode with the key sent as X-SaaS-Alerts-API-Key. Desktop only.
Before you install
The API key grants access to a security monitoring tenant, so keep it out of files and logs. Customer and scheduled report deletion are irreversible; confirmation is requested through MCP elicitation but proceeds if the client does not support it, so verify before invoking. HTTP mode without a real CONDUIT_S2S_SECRET is development-only and must not be exposed.

Installation

In SourceWeft

  1. Open SaaS Alerts in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

saas-alerts-mcp

Model Context Protocol server for Kaseya SaaS Alerts — a SaaS security monitoring platform for M365 and Google Workspace events.

Part of the WYRE Technology MCP fleet.

Features

Exposes the full SaaS Alerts External Partner API (v0.20.0) through 30 MCP tools organized by domain:

DomainTools
eventsQuery/count security events by severity, customer, user, event type; advanced Elasticsearch queries; scroll pagination; recommended actions
customersList, get, create, update, delete customers; set IP/country and account whitelists
usersMSP user info, partner users, customer users
devicesUnify mapped/unmapped/ignored devices, device organizations
billingBilling details by date, billing date history
reportsList/get/create/delete scheduled reports
partnerPartner profile, branding settings

Write/destructive tools require user confirmation via MCP elicitation (fail-open: proceeds if client doesn't support elicitation).

Authentication

SaaS Alerts uses an API key sent as the api_key HTTP header.

Generate your API key in the SaaS Alerts UI under Settings → API Keys.

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file and never commit a real value.

VariableRequiredDescription
SAAS_ALERTS_API_KEYFor stdio and AUTH_MODE=envSaaS Alerts API key. Gateway mode does not read it.
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENogateway (Docker image and Compose default) or env. Gateway mode requires X-SaaS-Alerts-API-Key on each /mcp request and never falls back to SAAS_ALERTS_API_KEY.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder (changeme, secret, your-s2s-secret, and the other example values). Compose will not start when it is unset. The value is never logged.
MCP_ALLOW_INSECURE_DEVNoSet to 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and listens on 127.0.0.1 only. A wider MCP_HTTP_HOST (including 0.0.0.0) is overridden. A placeholder secret is still rejected.
MCP_HTTP_HOSTNoBind address when a real CONDUIT_S2S_SECRET is set. Defaults to 127.0.0.1. The container image sets 0.0.0.0. Without a real secret the listener is forced to 127.0.0.1.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

X-Gateway-S2S signing

With MCP_TRANSPORT=http and a real CONDUIT_S2S_SECRET, every /mcp request must include X-Gateway-S2S. A missing or invalid header returns 401 before any vendor credential is read.

The header value is t=<unix seconds>,v1=<hex hmac-sha256>:

  1. Set t to the current unix time in seconds.
  2. Sign the ASCII message t=<unix seconds> with HMAC-SHA256, using CONDUIT_S2S_SECRET as the key.
  3. Hex-encode the digest (64 lowercase hex characters) and send t=<unix seconds>,v1=<hex>.

The timestamp must be within 300 seconds of the server clock. Example:

js
import { createHmac } from 'node:crypto';
const t = Math.floor(Date.now() / 1000);const v1 = createHmac('sha256', process.env.CONDUIT_S2S_SECRET).update(`t=${t}`).digest('hex');const xGatewayS2s = `t=${t},v1=${v1}`;

Local / stdio mode

bash
export SAAS_ALERTS_API_KEY=your-api-keynode dist/index.js

HTTP mode

CONDUIT_S2S_SECRET is required. If it is empty, the process logs an error and exits non-zero.

bash
export CONDUIT_S2S_SECRET="$(openssl rand -hex 32)"export SAAS_ALERTS_API_KEY=your-api-keyexport MCP_TRANSPORT=httpexport AUTH_MODE=envexport MCP_HTTP_PORT=8080node dist/http.js

Local HTTP without a secret is development-only. It binds 127.0.0.1 even if MCP_HTTP_HOST is 0.0.0.0, and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm run start:http

WYRE Gateway mode

When running behind the WYRE MCP Gateway, set AUTH_MODE=gateway (the image and Compose default). The gateway signs each request with X-Gateway-S2S and injects the API key via X-SaaS-Alerts-API-Key. A request missing that credential header returns 401 and does not use SAAS_ALERTS_API_KEY from the environment.

js
await fetch('http://127.0.0.1:8080/mcp', {  method: 'POST',  headers: {    'content-type': 'application/json',    accept: 'application/json, text/event-stream',    'x-gateway-s2s': xGatewayS2s,    'x-saas-alerts-api-key': apiKey,  },  body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),});

Running with Docker

The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode the SaaS Alerts API key arrives on each request; it is not read from the environment.

bash
docker build -t saas-alerts-mcp .docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -p 127.0.0.1:8080:8080 \  saas-alerts-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not pass SAAS_ALERTS_API_KEY into the gateway service:

bash
CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses SAAS_ALERTS_API_KEY:

bash
docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -e AUTH_MODE=env \  -e SAAS_ALERTS_API_KEY=your-key \  -p 127.0.0.1:8080:8080 \  ghcr.io/wyre-ai/saas-alerts-mcp:latest

Development

bash
npm installnpm run buildnpm testnpm run lintnode scripts/lint-destructive-warnings.mjs src

Destructive tool confirmation

Tools that permanently delete data (customer delete, scheduled report delete) carry:

  • ⚠ DESTRUCTIVE — IRREVERSIBLE description prefix
  • annotations.destructiveHint: true
  • Elicitation confirmation guard (additive — proceeds if client doesn't support elicitation)

Always confirm with the user before invoking these tools.

License

Apache-2.0 — see LICENSE.

Source: README.md at commit a3e43b5

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.4LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Alerts integrations

AlertsBar

bar.alertsOfficial publisher

Remote MCP server that gives an assistant free credential-exposure counts and small random samples for a domain, drawn from breaches, infostealers, ULP heaps…

Streamable HTTPWeb executable
Web Search & Scraping2 toolsOct 24, 2026

US Severe Weather Alerts MCP

Published by GitHub account donniertf-hub

Remote MCP server that gives an assistant active US National Weather Service alerts by ZIP code, by state, or across multiple sites.

Streamable HTTPWeb executable
Location & Lifestyle3 toolsOct 29, 2026

US Earthquake Risk & Alerts MCP

Published by GitHub account donniertf-hub

Remote MCP server that gives an assistant USGS earthquake data near any US ZIP code, with a free recent-quakes tool and paid history and multi-site tools.

Streamable HTTPWeb executable
Location & Lifestyle3 toolsOct 29, 2026

UK Tender Alerts MCP

Published by GitHub account donniertf-hub

Remote MCP server that surfaces live UK Contracts Finder public-sector tenders matched to your keywords and region, with deadlines and values.

Streamable HTTPWeb executable
Web Search & Scraping4 toolsOct 29, 2026

UK Insolvency Alerts MCP

Published by GitHub account donniertf-hub

Remote MCP server for checking UK company insolvency notices from the Gazette, with a free single-company check and paid batch and area tools.

Streamable HTTPWeb executable
Finance5 toolsOct 29, 2026