MCP servers for MSPs: Autotask, ConnectWise, HaloPSA, IT Glue, NinjaOne, CIPP and more

We list only connectors we ship. We make no ranking claims about other servers. Where a vendor or the community publishes its own MCP server, it may suit a single-tool job, and the MCP server vs MCP gateway guide explains when each fits.

The MSP connectors, by job

Counts are actions in each connector's signed service file, counted on 22 October 2026. "Preview" means the connector ships a few actions today and is growing.

Accounting sits beside these: Xero, QuickBooks Online and others. That is what lets an agent compare what was worked with what was billed.

The Monday-morning questions

These are the questions MSP owners and service managers ask first. Each needs one or two of the tools above.

An agent answers single-system questions with do. For two systems it uses ask, which joins the rows on the shared company and returns only the answer. See cross-system questions.

Connect once, then give every technician a key

Connect each tool once, with an API user that has the access your agents need and no more. Then mint a key per technician's agent from the console, or with your root key over REST:

{
  "name": "tech-alex",
  "holder": "agent",
  "allowed_actions": [
    "autotask.read:*", "autotask.ticket_notes.create", "autotask.time_entries.create",
    "ninjaone.read:*", "itglue.read:*"
  ],
  "cap_calls": 3000,
  "confirm_policy": "human"
}

A technician's agent can now read the PSA, the RMM and the documentation, add notes and log time, and nothing else. itglue.read:* does not cover itglue.passwords.get: a read that reveals a stored secret needs a grant that names it, so a passwords grant is always a deliberate choice.

Approvals for the actions that hurt

Some MSP actions are hard to undo: resetting a password, revoking sessions, offboarding a user, deleting tickets. They are marked destructive in the service files, for example cipp.identity.exec_reset_pass, cipp.identity.exec_offboard_user and m365_graph_users.users_revoke_sessions. Under confirm_policy: human, a destructive action waits for a person. Add approval_rules to name who:

{
  "approval_rules": [
    { "match": "cipp.write:*", "approver": "[email protected]" },
    { "match": "autotask.tickets.delete", "approver": "[email protected]" }
  ]
}

The run waits. The approver gets an email with a signed link, or decides in the console. See human-in-the-loop approval.

Protect the vendor API limits

PSA and RMM vendors limit API requests per hour or per minute, per instance. Your own syncs and integrations share that limit with your agents. Three controls keep agents inside it:

• Caps per key in upstream calls, refused before the call is sent. A parent key's cap bounds every technician key under it.
• A cache. Repeated reads are answered without calling the vendor, and a cache hit costs nothing.
• Pacing. actionlake paces calls to each vendor's published rate limit.

Ready-made plans and schedules

The plan store holds 899 pre-written plans, including MSP ones such as halopsa-triage-open-tickets, autotask-log-time-against-ticket, connectwise_manage-close-resolved-tickets-with-approval and ninjaone-alert-storm-clear. Install one into your tenant:

{ "op": "plans.install", "slug": "halopsa-triage-open-tickets", "intent": "Weekly triage for the service desk." }

Then run it on a schedule. actionlake has no event triggers or webhooks by design; schedules and agents start the work. A plan that asks "what is new since the last run?" covers most trigger cases:

{
  "op": "schedules.save",
  "name": "monday-triage",
  "plan": "plan.halopsa-triage-open-tickets",
  "cron": "0 8 * * 1",
  "timezone": "Pacific/Auckland",
  "intent": "Monday 8am triage of open tickets for the service manager."
}

See agent plans.

Rolling it out to a service desk

Start with one PSA, read-only, for the service manager. The first week shows which questions people ask and how many calls they take. Then give each technician a key with notes and time entries. Add the RMM and documentation reads next. Leave CIPP and Microsoft 365 writes for last, behind approval rules naming your security lead. Each step is a key change; the connections stay as they are, and every step is in the ledger.

What to check in any MSP MCP setup