Axcient x360Recover

io.github.wyre-technology由 GitHub 帳號 wyre-technology 發布v1.0.1更新於 Oct 24, 2026

MCP server for Axcient x360Recover — BCDR clients, devices, jobs, vaults, and appliances.

已驗證STDIO僅桌面雲端與基礎設施安全與監控

概覽

AI 產生的概覽

針對 Axcient x360Recover 的 MCP 伺服器，讓助理透過 x360Portal API 檢視 BCDR 客戶、裝置、備份工作、儲存庫與設備節點。

可以做什麼
  • 驗證 API 金鑰並讀取其所屬組織
  • 列出並取得客戶（客戶／站點紀錄）
  • 列出並取得裝置，含依客戶查詢、AutoVerify 狀態與還原點
  • 依裝置列出備份工作，並檢視工作詳情與歷史
  • 列出並取得儲存庫，讀取或設定儲存庫連線閾值
  • 列出並取得設備節點，含依客戶查詢
適用情境
適合管理 Axcient x360Recover BCDR 環境、希望助理不必開啟入口網站就能查詢客戶、裝置、備份工作狀態、儲存庫或設備節點的情況。也方便檢查連線閾值，或在導入新代理時產生註冊權杖。
執行需求
以本機 stdio 程序執行（Docker 映像或從原始碼建置）。stdio 或 AUTH_MODE=env 模式需要 Axcient x360Portal API 金鑰，置於 AXCIENT_API_KEY。可選設定包括 AUTH_MODE、MCP_TRANSPORT、LOG_LEVEL。HTTP 託管另需 CONDUIT_S2S_SECRET 與 X-Gateway-S2S 簽章；閘道模式要求每個請求帶上 X-Axcient-Api-Key 標頭。
安裝前請注意
此 API 金鑰可存取你的 x360Recover 租戶資料，應視為機密保存，切勿提交至版本庫。設定儲存庫閾值的工具會變更儲存庫設定。D2C 代理權杖工具會產生可用於註冊新代理的權杖。HTTP 模式必須設定 CONDUIT_S2S_SECRET；不安全開發開關會停用 S2S 驗證，僅限本機使用。資料會傳送至 Axcient 的 API。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Axcient x360Recover，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

axcient-mcp

MCP server for Axcient x360Recover — BCDR clients, devices, backup jobs, vaults, and appliances. Built on @wyre-technology/node-axcient and the MCP v2 SDK, serving both the 2025-era initialize handshake and the 2026-07-28 stateless envelope from a single dual-era HTTP entrypoint.

Credentials

Generate an API key in the x360Portal: Settings → API Keys (see Axcient's key management guide).

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file.

  • Local / stdio (Claude Desktop, CLI): set AXCIENT_API_KEY. The stdio transport does not use CONDUIT_S2S_SECRET.
  • Hosted / gateway: the WYRE MCP Gateway injects X-Axcient-Api-Key per request (AUTH_MODE=gateway). The gateway compose service does not set AXCIENT_API_KEY and does not use env_file.
VariableRequiredDescription
AXCIENT_API_KEYFor stdio and AUTH_MODE=envx360Portal API key
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENogateway (Docker image and Compose default) or env. Gateway mode requires X-Axcient-Api-Key on each /mcp request and never falls back to AXCIENT_API_KEY. env uses that variable only after S2S auth succeeds.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder. Compose will not start without it. Never commit a real value. Generate one with openssl rand -hex 32.
MCP_ALLOW_INSECURE_DEVNoSet to 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A wider MCP_HTTP_HOST is ignored. A placeholder secret is still refused.
MCP_HTTP_HOSTNoBind address when a real CONDUIT_S2S_SECRET is set. Defaults to 127.0.0.1. The container image sets 0.0.0.0.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health and /healthz stay unauthenticated and do not read credentials.

X-Gateway-S2S signing

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S:

X-Gateway-S2S: t=<unix seconds>,v1=<hex hmac-sha256>

v1 is HMAC-SHA256 over the ASCII message t=<unix seconds>, keyed with CONDUIT_S2S_SECRET, hex-encoded. The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The secret is never logged.

js
import { createHmac } from "node:crypto";
const t = Math.floor(Date.now() / 1000);const v1 = createHmac("sha256", process.env.CONDUIT_S2S_SECRET).update(`t=${t}`).digest("hex");const xGatewayS2s = `t=${t},v1=${v1}`;

In AUTH_MODE=gateway, /mcp also requires X-Axcient-Api-Key. A request missing that header returns 401 and does not fall back to AXCIENT_API_KEY.

Run locally (stdio)

bash
npm installnpm run buildAXCIENT_API_KEY=your-key npm start

Run as HTTP (gateway / hosted)

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" MCP_TRANSPORT=http AUTH_MODE=env AXCIENT_API_KEY=your-key npm start# → http://127.0.0.1:8080/mcp, health at http://127.0.0.1:8080/health

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

Docker

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, the Axcient API key arrives on each request as X-Axcient-Api-Key; it is not read from the environment.

bash
docker build --platform linux/amd64 --build-arg GITHUB_TOKEN=$(gh auth token) -t axcient-mcp .docker run \  -e CONDUIT_S2S_SECRET=your-s2s-secret \  -p 127.0.0.1:8080:8080 \  axcient-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, runs AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not inject AXCIENT_API_KEY:

bash
CONDUIT_S2S_SECRET=your-s2s-secret GITHUB_TOKEN=$(gh auth token) docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses AXCIENT_API_KEY:

bash
docker run \  -e CONDUIT_S2S_SECRET=your-s2s-secret \  -e AUTH_MODE=env \  -e AXCIENT_API_KEY=your-key \  -p 127.0.0.1:8080:8080 \  axcient-mcp

Tools

20 tools, flat surface (no router — well under the fleet's ~25-tool threshold).

ToolDescription
axcient_test_connectionVerify the API key by fetching the organization record
axcient_get_organizationGet the organization for the API key
axcient_list_clients / axcient_get_clientClients (customer/site records)
axcient_get_d2c_agent_tokenMint a D2C agent enrollment token
axcient_list_devices / axcient_list_devices_by_client / axcient_get_deviceDevices
axcient_get_device_autoverify / axcient_get_device_restore_pointsAutoVerify + restore points
axcient_list_jobs_by_device / axcient_get_job / axcient_get_job_historyBackup jobs
axcient_list_vaults / axcient_get_vaultVaults
axcient_get_vault_threshold / axcient_set_vault_thresholdVault connectivity threshold
axcient_list_appliances / axcient_list_appliances_by_client / axcient_get_applianceAppliances

No destructive tools exist in this surface — the x360Recover public API (v0.3.1) has no delete/disable operations, so no confirmation/elicitation flow is wired up. See node-axcient's README for known API quirks (error-shape inconsistencies, list-endpoint schema documentation bugs) this server's error messages surface verbatim from the SDK.

License

Apache-2.0

來源：README.md，提交 48bdd1d

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v1.0.1最新Sep 16, 2026

評分

已滿足適用檢查項的 40%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。