IT Glue

IT Glue MCP Server

A Model Context Protocol (MCP) server that provides Claude with access to IT Glue documentation and asset management.

One-Click Deployment

[!NOTE]

Unlike the other Wyre MCP servers, this one talks to the IT Glue API directly and

has **no private @wyre-ai/* runtime dependency**, so the one-click build

does not need a GitHub Packages token — the cloud builder's npm ci only pulls

public packages. (A read:packages token is only needed to install the published

@wyre-ai/itglue-mcp package itself; see Installation.)

The DigitalOcean target builds the full Docker image and runs the complete MCP

server over HTTP and is the recommended path; this repo does not ship a Workers

entrypoint (src/worker.ts), so prefer DigitalOcean or the prebuilt container

image (ghcr.io/wyre-ai/itglue-mcp).

Installation

This package is published to the GitHub Packages npm registry, which requires a token even for public packages. Authenticate npm once, then install:

# Authenticate npm to GitHub Packages (token needs the read:packages scope)

export NODE_AUTH_TOKEN=$(gh auth token) # or a PAT with read:packages

npm install @wyre-ai/itglue-mcp

The repo's .npmrc already points the @wyre-ai scope at GitHub Packages and reads the token from NODE_AUTH_TOKEN, so no further config is needed. The same applies to npx @wyre-ai/itglue-mcp.

Or use the Docker image:

docker pull ghcr.io/wyre-ai/itglue-mcp:latest

Configuration

Copy .env.example and set the variables below. Leave CONDUIT_S2S_SECRET empty in that file; never commit a real value.

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

When AUTH_MODE=gateway, the MCP Gateway injects credentials per request via HTTP headers instead of environment variables. See HTTP authentication and Remote Deployment.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t= ,v1= , where the hex is HMAC-SHA256 of the literal string t= keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header is HTTP 401, before vendor credentials are read.

TS=$(date +%s)

SIG=$(printf 't=%s' "$TS" | openssl dgst -sha256 -hmac "$CONDUIT_S2S_SECRET" -hex | awk '{print $NF}') curl -sS http://127.0.0.1:8080/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H "X-Gateway-S2S: t=${TS},v1=${SIG}" \ -H "X-ITGlue-API-Key: $ITGLUE_API_KEY" \ -H "X-ITGlue-Region: us" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

In AUTH_MODE=gateway, /mcp also requires X-ITGlue-API-Key (or X-API-Key) or X-ITGlue-JWT. Those headers are the only credential source for that request. AUTH_MODE=env still requires the signed X-Gateway-S2S header, then uses ITGLUE_API_KEY and ITGLUE_JWT from the environment.

JWT fallback for document-folder operations

A JWT is optional — it is only needed if your tenant's API key can't access Document Folders yet. Every folder-related path tries your API key first:

• search_documents — defaults to a folder-inclusive listing (filter[document_folder_id]=null returns all documents, foldered ones included; each result carries its documentFolderId). If the tenant's API rejects that filter, the server retries the [ne] filter form and finally degrades to the legacy root-only listing, saying so in the result. No JWT is involved at any layer.
• list_document_folders — IT Glue's public (API-key) API now documents a Document Folders resource, which is rolling out across tenants through 2026. The server tries the API key first (on the organization-relationship path, then the top-level /document_folders path) and only falls back to a JWT if the key is rejected.
• create_document — the name-based folder picker uses the same API-key-first enumeration, then a configured JWT; if neither can list folders, it prompts for a folder URL / sibling-document URL / numeric folder ID as the last resort.

If you do need the JWT fallback, provide it in whichever way matches your deployment:

Headless deployments (Docker, cloud): there is no one to answer the interactive prompt, so if your tenant's API key cannot enumerate folders you must set ITGLUE_JWT (env mode) or send X-ITGlue-JWT (gateway mode) for folder enumeration to work.

Retrieving a JWT from your browser:

1. Sign in to IT Glue in your browser.
2. Open DevTools → Network tab.
3. Click any request to itg-api-*.itglue.com.
4. Copy the value of the Authorization: Bearer request header — the part is your JWT.

Expiry: IT Glue JWTs are short-lived (~2 hours). A JWT placed in ITGLUE_JWT on a long-running container will go stale and the JWT fallback will start failing until it is refreshed. Interactive clients are simply re-prompted on expiry. API-key operations are unaffected.

Available Tools

Organizations

• search_organizations - Search for organizations with optional filtering by name, type, status, or PSA ID
• get_organization - Get a specific organization by ID

Configurations (Devices/Assets)

• search_configurations - Search for configurations with filtering by organization, name, type, status, serial number, RMM ID, or PSA ID
• get_configuration - Get a specific configuration by ID
• archive_configuration - Archive a configuration (soft delete — hides it from normal views but keeps it recoverable). Reversible with unarchive_configuration. Configurations synced from a PSA/RMM integration (psaIntegration: enabled / syncActive: true) may be restored or updated by the next sync, so tidy up the source system (Autotask / Datto RMM) first
• unarchive_configuration - Restore a previously archived configuration so it appears in normal views again

Locations (Addresses/Sites)

• search_locations - Search an organization's locations (built-in address/site records), filtering by organization, name, city, region, or country. Results include the address fields and phone number.
• get_location - Get a specific location by ID, including its full address and phone number
• create_location - Create a new location for an organization (requires name, typically country_id)
• update_location - Update an existing location; only the fields you supply are changed

Passwords

• search_passwords - Search for password entries (metadata only, no actual passwords in results)
• get_password - Get a specific password entry including the actual password value

Documents

• search_documents - Search for documents with filtering by organization, name, or folder. Defaults to a folder-inclusive listing (each result carries its documentFolderId), degrading gracefully to a root-only listing on tenants whose API rejects the folder filter
• get_document - Get a specific document by ID, including its sectioned body. Renders as an interactive card in MCP Apps hosts — see Interactive Document Card
• list_document_folders - List an organization's document folders (names and IDs). Works with an API key on tenants where IT Glue exposes the Document Folders resource; falls back to a JWT otherwise — see JWT fallback for document-folder operations
• create_document - Create a document in an organization, optionally with body content. Prompts for a folder if none is given; pass skip_folder_prompt=true to create at the organization root
• update_document - Rename a document. Only the name you supply is changed. Folder moves are not supported: IT Glue's Documents API marks document_folder_id as not permitted on PUT/PATCH
• list_document_sections - List a document's sections in order, before editing
• create_document_section - Add a heading or text section. Call publish_document after editing
• update_document_section - Replace a section's content. Call publish_document after editing
• delete_document_section - ⚠ Permanently delete one section (irreversible). Call publish_document after editing
• publish_document - Publish section changes so they become visible
• archive_document - Soft-delete a document (hidden from normal views, recoverable with unarchive_document)
• unarchive_document - Restore a previously archived document
• delete_document - ⚠ Permanently delete a document and all its sections (irreversible — prefer archive_document if it may be needed again)

Attachments

• create_attachment - Attach a file to a checklist, checklist template, configuration, contact, document, domain, flexible asset, location, password, SSL certificate or ticket. Base64 in. Also the only supported route to a picture in a document body — see Images in documents
• list_attachments - List a record's attachments, with their