ConnectWise Manage

ConnectWise Manage MCP Server

Let your AI assistant work directly with ConnectWise Manage. Search tickets, log time, look up companies and contacts, manage projects — through natural conversation instead of clicking through the CWM interface.

This is a Model Context Protocol (MCP) server that gives Claude (or any MCP-compatible AI) 84 tools covering the daily operations ConnectWise Manage shops depend on. Works with both cloud-hosted and self-hosted CWM instances — just point it at your server.

Part of the [MSP Claude Plugins](https://github.com/wyre-technology/msp-claude-plugins) ecosystem — a growing suite of AI integrations for the MSP stack including Autotask, Datto RMM, IT Glue, HaloPSA, NinjaOne, Huntress, and more. Built by MSPs, for MSPs.

One-Click Deployment

Note on registry auth: This server depends only on public npm packages, so the Cloudflare and DigitalOcean cloud builders install its dependencies anonymously — no token is required for one-click deploy. (If a future release adds a private @wyre-ai/* dependency, you would supply a GitHub PAT with read:packages as a build variable — NODE_AUTH_TOKEN for Cloudflare Workers, a build-time GITHUB_TOKEN secret for DigitalOcean.)

Installing the published package: The released package is published to the GitHub Packages npm registry, which requires authentication on every install (even for public packages). To install it, authenticate npm to npm.pkg.github.com with a GitHub PAT that has read:packages:

`bash

export NODE_AUTH_TOKEN=$(gh auth token)

npm install @wyre-ai/connectwise-manage-mcp

`

For deploying to Azure Container Apps with Entra ID OAuth 2.1, see AZURE_ACA_DEPLOYMENT.md.

Configuration

Environment Variables

/health stays unauthenticated and does not read ConnectWise credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The header value is:

t=<unix seconds>,v1=<hex hmac-sha256>

v1 is HMAC-SHA256 (hex, lowercase) of the ASCII string t= , keyed with CONDUIT_S2S_SECRET. The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401. The process never writes the secret to logs.

X-Gateway-S2S: t=1710000000,v1=<hmac-sha256("t=1710000000")>

In AUTH_MODE=gateway, /mcp also requires X-CW-Company-Id, X-CW-Public-Key, X-CW-Private-Key, and X-CW-Client-Id (X-CW-URL is optional). Those headers are the credential source for that request. A request missing any required header returns 401.

Entra OAuth discovery routes stay available when MCP_OAUTH_ENABLED=true. POST /mcp still requires a valid X-Gateway-S2S header when the secret is set.

API Base URL (CW_MANAGE_URL)

For self-hosted instances, set CW_MANAGE_URL to your server's base URL. The server automatically appends /v4_6_release/apis/3.0 unless the URL already contains that path.

If your self-hosted instance uses a self-signed certificate, also set CW_MANAGE_REJECT_UNAUTHORIZED=false.

Getting Your API Keys

1. Log in to your ConnectWise Manage instance
2. Navigate to System > Members > API Members
3. Create a new API member with appropriate permissions
4. Generate API keys for the member
5. Get your Client ID from the ConnectWise Developer Portal

Available Tools

Interactive Ticket Card (MCP Apps)

cw_get_ticket renders as an interactive card in MCP Apps hosts (Claude Desktop/web) with an in-card "Add note" round-trip via cw_add_ticket_note that always posts internal-only (internalAnalysisFlag) notes; plain-JSON behavior is unchanged in other hosts. The card is neutral by default and brandable via window.__BRAND__ injection or MCP_BRAND_* env vars (MCP_BRAND_NAME, MCP_BRAND_LOGO_URL, MCP_BRAND_PRIMARY_COLOR, MCP_BRAND_ACCENT_COLOR, MCP_BRAND_BG, MCP_BRAND_TEXT) — no rebuild needed.

Tickets

• cw_search_tickets — Search service tickets with conditions
• cw_get_ticket — Get a ticket by ID
• cw_get_ticket_configurations — List configuration references associated with a service ticket (paged)
• cw_update_ticket_configurations — Add/remove ticket configuration associations in an ordered batch, reporting every outcome
• cw_create_ticket — Create a new service ticket. Optional parentTicketId (the same field cw_get_ticket returns) creates the ticket as a child of that parent.
• cw_update_ticket — Update a ticket (JSON Patch)
• cw_get_ticket_notes — Get all notes on a ticket (including child ticket notes)
• cw_add_ticket_note — Add a note to a ticket (discussion, internal, or resolution). Nothing is emailed unless `processNotifications` is true. emailContactFlag, emailResourceFlag, emailCcFlag, and emailCc are not ServiceNote fields and are not sent (posting them is a ConnectWise 400). A true flag only turns on processNotifications. Recipients come from the ticket automaticEmailContactFlag, automaticEmailResourceFlag, automaticEmailCcFlag, and automaticEmailCc. Optional memberId is sent as member.id and sets the author; omit it and Manage attributes the note to the API member. The create response reports internalFlag / externalFlag from the note type that was stored, so an internal note is not also reported as external.

Companies

• cw_search_companies — Search companies
• cw_get_company — Get a company by ID
• cw_create_company — Create a new company
• cw_update_company — Update a company (JSON Patch)

Contacts

• cw_search_contacts — Search contacts. Filter contact type with typeName, typeId, or childConditions (for example types/name = "Primary"). types / types/name in conditions is invalid and returns 400 ApiFindCondition because type is a child collection; the tool moves those clauses to childConditions. Contacts have firstName and lastName, not name. String values use double quotes (firstName = "Ada"); single quotes are accepted and rewritten.
• cw_get_contact — Get a contact by ID
• cw_create_contact — Create a new contact. Communication type names vary per tenant, so the email and phone types are resolved from GET /company/communicationTypes (emailFlag / phoneFlag, cached for 10 minutes per connection) instead of assuming "Email" / "Direct". Optional emailTypeId, emailTypeName, phoneTypeId, phoneTypeName override the lookup (an id wins over a name; an unknown name lists the available types).
• cw_list_communication_types — List the tenant's communication types (GET /company/communicationTypes) to find the ids for cw_create_contact and cw_update_contact
• cw_update_contact — Update a contact (JSON Patch on PATCH /company/contacts/{id}). Paths include firstName, lastName, title, inactiveFlag, site, communicationItems (email and phone; use type: { id } from cw_list_communication_types, since type names vary per tenant), and customFields. Contact types are not on this patch.
• cw_update_contact_types — Add or remove a contact type such as "Decision Maker" (POST / DELETE /company/contacts/{id}/typeAssociations). Adding a type the contact already has does not create a duplicate.

Projects

• cw_search_projects — Search projects
• cw_get_project — Get a project by ID
• cw_create_project — Create a new project
• cw_search_project_tickets — Search tickets under a project
• cw_get_project_ticket — Get a specific project ticket by ID
• cw_get_project_ticket_notes — Get all notes on a project ticket (including child ticket notes)
• cw_add_project_ticket_note — Add a note to a project ticket (discussion, internal, or resolution). Email flags are not sent. Optional memberId sets the author (member.id).

Time Entries

• cw_search_time_entries — Search time entries
• cw_get_time_entry — Get a time entry by ID
• cw_create_time_entry — Create a new time entry. ConnectWise ignores the entry's emailContactFlag, emailResourceFlag, and emailCcFlag on create and copies the ticket's automaticEmail* flags instead. For service and project tickets, each email flag left false (the default) has its matching ticket flag turned off for the create and then restored. If that toggle fails, the entry is not created. suppressTicketAutoEmail: false turns the toggle off. See Notes, time entries and customer email.
• cw_update_time_entry — Correct a time entry (JSON Patch on PATCH /time/entries/{id}). Use this to fix actualHours when a metered agreement rounds to 0.25.
• cw_delete_time_entry — Delete a time entry (DELETE /time/entries/{id}). Manage rejects deletes of entries that are already billed.

Schedule Entries

• `cw_search_s