GLPI MCP Server

Connect AI assistants (Claude, ChatGPT, Copilot…) to GLPI through the Model Context Protocol (MCP): tickets, ITIL, projects, any itemtype, documents, massive actions, sessions and configuration — with safe defaults.

Português · Security · Changelog

Continues ageugyn/glpi-mcp-server by Ageu Bonfim (MIT), keeping its full history, with the goal of covering the whole GLPI legacy REST API.

Highlights

• 47 tools: tickets and ITIL, generic CRUD for any itemtype, project management (projects, subprojects, task trees, teams, states), session/profiles/entities, documents, massive actions.

• Safe by default: delete and massive actions are off; read-only mode; allow/deny tool patterns; secrets masked in every output; tokens sent in headers (not URLs); local files confined to one directory.

• Works with GLPI 10 and 11 (legacy REST API apirest.php, also shipped with GLPI 11).

Related MCP server: glpi-mcp-server

Supported versions

The generic, project, session, document and massive-action tools use the legacy API: keep GLPI_API_VERSION=10 (the default), which also works with GLPI 11.

Quick start

1. Enable the GLPI API

In GLPI: Setup → General → API → enable the REST API and "login with external token". Then get your API token: user preferences (or Administration → Users → your user) → Passwords and access keys → API token → regenerate. An App-Token is only needed if your API client requires one.

2. Install

Requires Node.js 20+.

git clone https://github.com/Alan-Gois/glpi-mcp.git
cd glpi-mcp
npm ci
npm run build

Or run straight from GitHub: npx -y github:Alan-Gois/glpi-mcp (builds on install).

3. Configure your MCP client

Claude Code — .mcp.json in your project (values come from your environment, not from the file):

{
  "mcpServers": {
    "glpi": {
      "command": "node",
      "args": ["/absolute/path/to/glpi-mcp/dist/index.js"],
      "env": {
        "GLPI_URL": "https://glpi.example.com",
        "GLPI_USER_TOKEN": "${GLPI_USER_TOKEN}",
        "GLPI_APP_TOKEN": "${GLPI_APP_TOKEN:-}"
      }
    }
  }
}

Claude Desktop — claude_desktop_config.json (macOS ~/Library/Application Support/Claude/, Windows %APPDATA%\Claude\, Linux ~/.config/Claude/):

{
  "mcpServers": {
    "glpi": {
      "command": "node",
      "args": ["/absolute/path/to/glpi-mcp/dist/index.js"],
      "env": {
        "GLPI_URL": "https://glpi.example.com",
        "GLPI_USER_TOKEN": "your_user_token",
        "GLPI_MCP_READ_ONLY": "true"
      }
    }
  }
}

Restart the client and the glpi_* tools appear. Start with GLPI_MCP_READ_ONLY=true and open up writes when you are comfortable.

Configuration

* Legacy API: GLPI_USER_TOKEN or GLPI_USERNAME + GLPI_PASSWORD.

Tools

Tickets and ITIL

glpi_list_tickets, glpi_get_ticket, glpi_create_ticket, glpi_update_ticket, glpi_add_followup, glpi_add_solution, glpi_add_task, glpi_get_ticket_tasks, glpi_request_validation, glpi_answer_validation, glpi_get_ticket_validations, glpi_create_change, glpi_create_problem, glpi_search (multi-criteria search on any itemtype), glpi_list_search_options, and GLPI 11 native forms: glpi_list_forms, glpi_get_form_details, glpi_submit_form.

Generic CRUD (any itemtype)

Projects

Dropdown fields come with the id and the name (projectstates_id + projectstates_id_name).

Session, profiles, entities and configuration

glpi_get_my_profiles, glpi_get_active_profile, glpi_change_active_profile, glpi_get_my_entities, glpi_get_active_entities, glpi_change_active_entities, glpi_get_full_session, glpi_get_glpi_config (use keys to limit large outputs). GLPI refusals are reported as errors. lostPassword is not exposed.

Documents

Massive actions

Example prompts

• "List the projects in progress and show the task tree of the biggest one."

• "Create project Office move with subprojects Network and Furniture, and a task Cabling of 16 hours."

• "Show open tickets of the last week and add a followup to #42."

• "Which computers in the Finance location run Windows 10?"

• "Attach report.pdf to ticket 120."

Security

See docs/security.md. In short: give the API user only the GLPI profile it needs, start in read-only mode, keep delete and massive actions off unless needed, and keep tokens in environment variables or a secret manager — never in files under version control.

Development

npm ci
npm run build
npm test
npx @modelcontextprotocol/inspector node dist/index.js

CI runs build, tests and npm audit on Node 20, 22 and 24.

Credits and license

MIT — see LICENSE. Original work by Ageu Bonfim (ageugyn/glpi-mcp-server); continued by Alan Gois.