IT Glue MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ITGLUE_LIVE | Yes | Must be `1`, or nothing is sent. `compose.yaml` sets it | |
| FASTMCP_HOME | No | Where the sign-in proxy keeps its state | /data |
| ITGLUE_WRITES | No | `1` allows creating, updating and publishing, within the write list | |
| ITGLUE_API_KEY | Yes | The IT Glue API key | |
| ITGLUE_DELETES | No | `1` also allows deleting. Needs `ITGLUE_WRITES=1` | |
| ITGLUE_BASE_URL | No | IT Glue's region: `https://api.itglue.com`, `https://api.eu.itglue.com` (default) or `https://api.au.itglue.com` | https://api.eu.itglue.com |
| ITGLUE_MCP_HOST | No | Where to listen | 127.0.0.1 |
| ITGLUE_MCP_PATH | No | Where to listen | /mcp |
| ITGLUE_MCP_PORT | No | Where to listen | 8000 |
| ITGLUE_READ_ORG_IDS | No | Organisation ids that may be read, separated by commas. Empty reads every organisation | |
| ITGLUE_WRITE_ORG_IDS | No | Organisation ids that may be written to. Empty writes none | |
| ITGLUE_ACCOUNT_WRITES | No | `1` also allows writing records that belong to no organisation, such as types and statuses. Needs `ITGLUE_WRITES=1` | |
| ITGLUE_MCP_PUBLIC_URL | No | Where clients reach the server, with no path, user or password. The Entra redirect URI is this plus `/auth/callback` | |
| ITGLUE_MCP_ENTRA_SCOPE | No | The delegated scope a person's token needs | mcp.access |
| ITGLUE_MCP_READER_ROLE | No | The app role value for readers | reader |
| ITGLUE_MCP_SIGNING_KEY | No | Optional, 32 characters or more. Signs the proxy's tokens and encrypts its state, instead of a key derived from the client secret | |
| ITGLUE_MCP_WRITER_ROLE | No | The app role value for writers | writer |
| ITGLUE_MCP_ENTRA_CLIENT_ID | No | The Entra app registration client id. Any of the Entra settings turns sign-in on, and then all three and `ITGLUE_MCP_PUBLIC_URL` are needed. | |
| ITGLUE_MCP_ENTRA_TENANT_ID | No | The Entra tenant id. Any of the Entra settings turns sign-in on, and then all three and `ITGLUE_MCP_PUBLIC_URL` are needed. | |
| ITGLUE_MCP_UNAUTHENTICATED | No | `1` accepts that nobody signs in, so that the server may listen on an address other machines can reach. Refused beside sign-in | |
| ITGLUE_MCP_SERVE_RESTRICTED | No | `1` serves records IT Glue marks restricted. Withheld by default | |
| ITGLUE_MCP_ENTRA_CLIENT_SECRET | No | The Entra app registration client secret. Any of the Entra settings turns sign-in on, and then all three and `ITGLUE_MCP_PUBLIC_URL` are needed. | |
| ITGLUE_MCP_ALLOWED_REDIRECT_URIS | No | Where the sign-in proxy may send a client back to, separated by commas, `*` for any port or the rest of a path: `https://` addresses, or `http://` on `localhost` or `127.0.0.1`. A wildcard host must be a single leading `*.` before a domain you own, as in `https://*.example.com/*` (the only form the sign-in proxy matches), with no empty labels or trailing dot: `https://*.com/*` and `https://*.*.example.com/*` are refused. The check has no public suffix list, only a short built-in one of common cases, so never wildcard a shared hosting domain such as `github.io` or `azurewebsites.net`. Empty: any loopback port, and Copilot Studio's connector redirect |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues