Snipe-IT (unofficial)

the-real-snipeit-mcp

An unofficial MCP server for the Snipe-IT REST API: one generated tool for every operation in the vendored Snipe-IT OpenAPI 3.1 spec (read + write), hand-written wrappers for common workflows, stdio transport.

Unofficial, not affiliated with Snipe-IT/Grokability. This project is not affiliated with, endorsed by, sponsored by or supported by Grokability, Inc. or the Snipe-IT project. "Snipe-IT" is a trademark of its owner. The vendored API description and its license situation are described in NOTICE.

Three tool layers (183 tools):

• 37 hand-wrappers (snipeit_*): friendlier UX for common workflows
• 145 generated tools (snipeit_gen_*): one per operation of the vendored spec (vendor/snipe-it-rest-api.json, Snipe-IT 8.2.0)
• `snipeit_raw_request`: escape hatch for any method and path under SNIPEIT_API_BASE

Plus 3 resources and 3 prompts. The counts are held by tests/unit/docsFacts.test.ts.

Maintenance status

• Maintained on a best-effort basis by one maintainer (@mguttmann) in spare time. The author runs it in production behind a private MCP gateway. There is no support contract and no guaranteed response time.
• Security fixes take priority over features. Report vulnerabilities privately through GitHub Private Vulnerability Reporting, never in a public issue (see SECURITY.md).
• Dependency updates come from Dependabot; CI fails when a runtime dependency has a known high or critical advisory.
• Supported Node.js versions: 22.12 or newer (engines in package.json); CI tests Node 22, 24 and 26.
• Only the latest minor release gets fixes. Releases and their changes: CHANGELOG.md.
• Issues and pull requests are welcome; see CONTRIBUTING.md.

Install

Requires Node.js 22.12 or newer. The server needs SNIPEIT_API_BASE (your instance, including /api/v1) and SNIPEIT_API_TOKEN; all other variables are optional (see Configuration). Only the npm package the-real-snipeit-mcp and the MCP Registry name io.github.mguttmann/the-real-snipeit-mcp are this project.

npx (any stdio MCP host)

npx fetches and runs the package; no clone or build is needed. Attach it to Claude Code (type the token in your shell, never into a chat):

claude mcp add snipeit \

-e SNIPEIT_API_BASE=https://snipe-it.example.com/api/v1 \ -e SNIPEIT_API_TOKEN= \ -- npx -y the-real-snipeit-mcp

Any other stdio host takes the same command in its JSON configuration (Claude Desktop: claude_desktop_config.json):

{

"mcpServers": { "snipeit": { "command": "npx", "args": ["-y", "the-real-snipeit-mcp"], "env": { "SNIPEIT_API_BASE": "https://snipe-it.example.com/api/v1", "SNIPEIT_API_TOKEN": " " } } } }

A configuration file with these values holds the token: keep it readable for your user only and out of version control. the-real-snipeit-mcp@ pins a version.

Global install

npm install -g the-real-snipeit-mcp

The command is the-real-snipeit-mcp; use it as "command" in the host configuration above (without args).

From source

git clone https://github.com/mguttmann/the-real-snipeit-mcp.git

cd the-real-snipeit-mcp npm ci cp .env.example .env

edit .env: set SNIPEIT_API_BASE and SNIPEIT_API_TOKEN

npm run build # prebuild runs lint, typecheck and the unit tests first node --env-file=.env dist/index.js

npm run inspector opens the MCP Inspector against the built server.

Pinned install for gateways and servers

For an unattended host, install an exact version from a committed lockfile, without install scripts and without dev dependencies, and check the registry signatures and provenance attestations:

mkdir snipeit-mcp && cd snipeit-mcp

npm init -y npm install --save-exact --ignore-scripts the-real-snipeit-mcp@ # once; commit package.json and package-lock.json

on every deploy:

npm ci --omit=dev --ignore-scripts npm audit signatures node --env-file=/path/to/.env node_modules/the-real-snipeit-mcp/dist/index.js

Each release on GitHub Releases carries the npm tarball, a CycloneDX SBOM and SHA256SUMS; releases published by the release workflow carry an npm provenance statement and a GitHub build provenance attestation.

MCP Registry and Glama

Each stable release is listed in the official MCP Registry as io.github.mguttmann/the-real-snipeit-mcp (the npm package, with its environment variables). glama.json names the maintainer of the Glama listing.

Configuration

Variables come from the environment, from node --env-file= , or from a .env in the working directory (or DOTENV_CONFIG_PATH), which never overrides a variable that is already set. The names (never the values) of the variables a .env added are logged to stderr at startup.

Tool reference

Hand-wrappers (37 tools)

Identity (1)

Hardware / Assets (13)

Users (5)

Licenses (3)

Accessories / Consumables / Components (8)

Locations / Status-Labels / Maintenances (6)

Bulk (1)

| Tool | Behavior | Annotations