MCP server for Alloy Navigator's REST API - IT asset management, ITSM, and network inventory data (incidents, work orders, assets, software catalog, consumables, and more) for AI assistants and the WYRE Conduit gateway.
Alloy Navigator authenticates third-party applications with the OAuth2 client_credentials grant. An application account is registered in the Alloy Navigator Settings App under Services > API > Applications, which issues a client ID and client secret. This connector exchanges those for a bearer access token by POSTing to <base URL>/api/token, then sends Authorization: Bearer <token> on every subsequent request. Access tokens are valid for 8 hours per Alloy Navigator's own documentation; this connector caches a token per credential set and transparently re-authenticates once it's near expiry (see src/auth.ts).
Alloy Navigator has no fixed hosted API endpoint - every instance (on-premises, or a customer's own self-hosted-cloud tenant) is deployed at its own base URL, so this connector requires all three of a base URL, a client ID, and a client secret. In gateway mode all three arrive per-request via the X-Alloy-Base-Url, X-Alloy-Client-Id, and X-Alloy-Client-Secret headers; in local/stdio mode they're read once from ALLOY_BASE_URL, ALLOY_CLIENT_ID, and ALLOY_CLIENT_SECRET.
Alloy Navigator's API module (and this connector's application-account grant type specifically) requires the API Module to be installed and enabled on the target instance - see Alloy Navigator's own Installation Guide ("Installing and Configuring the API Module") if a client_credentials request returns a connection or 404 error rather than an auth error.
Vendor-documented, not independently verified against a live account (see Verification below for why): Alloy Navigator's API User's Guide describes application accounts as accounts used by "third-party applications that run without a signed-in user present," distinct from a regular technician (username/password) account, but does not document a way to scope an application account's read access below whatever object classes and fields the account otherwise has permission to see in Alloy Navigator's own security/role configuration. In practice this means the actual read-only guarantee is enforced by this connector's tool surface (GET-only, no workflow-action execution), not by the credential itself - Alloy Navigator's own workflow-action model means even a technically "read" API call executes through the same account whose role could, in principle, also be granted write/workflow-action permissions elsewhere. Customers should create a dedicated, minimally-privileged application account for this connector, matching the same practice recommended by other vendors in this fleet (e.g. PRTG) whose API keys inherit the creating account's full permission set.
This connector was built directly against Alloy Navigator's official API User's Guide (docs.alloysoftware.com/alloynavigator/docs/api-userguide/), not against secondary documentation or a naming convention - every tool below maps to one real, documented GET operation, with its exact query parameters and response shape verified against the guide's own worked examples (see each tool's JSDoc in src/client.ts for the source example it was checked against). What it is not is independently verified against a live Alloy Navigator instance: Alloy Navigator does not publish a public self-serve trial or sandbox instance, and provisioning one requires a live sales/licensing engagement this build environment could not complete. This is a build-environment limitation, not a vendor-side approval gate for a customer with an existing license.
Related MCP server: ServiceNow MCP Server
Env var | Description |
| Base URL of the Alloy Navigator server, e.g. |
| Application account client ID, issued under Settings App > Services > API > Applications. |
| Application account client secret, issued alongside the client ID. |
|
|
|
|
| When set, the HTTP transport requires a valid |
|
|
Alloy Navigator's API is class-generic rather than one fixed REST path per object type (unlike, say, PRTG's /devices, /sensors, etc.) - a single object class parameter (Incidents, Computers, Work Orders, Consumables, SoftwareCatalog, Purchase Order Items, and so on) selects what you're querying. This connector's 4 tools mirror that shape faithfully rather than inventing per-class tools Alloy Navigator's own API doesn't have.
alloy_list_objects - list/search objects of a given object class, with field selection, sorting, paging, free-text search, and per-field filters.
alloy_get_object - get every field of a single object by its OID (ticket number) or database record GUID.
alloy_get_object_activities - get the activity/history log entries recorded against a single object (status changes, assignment changes, system notes).
alloy_get_dictionary - get the allowed reference/classification values (e.g. valid Status or Types values) for a field on an object class.
This is a deliberately narrow, read-only v1 surface: 4 GET operations covering exactly Alloy Navigator's generic object query, single-object read, activity/history read, and reference-value lookup - nothing else. Alloy Navigator's API User's Guide documents a significantly larger surface built around workflow actions (Alloy Navigator does not create or update objects directly; every mutation runs as a named workflow action against an object). This connector excludes every one of those by design, not by oversight:
Hard-excluded (object creation and mutation - all mutation in Alloy Navigator's API model runs through workflow actions) - never implemented: POST /object/<oid>/action/<actionId> - executing a workflow action (the mechanism Alloy Navigator's own "Creating objects" documentation describes for creating new incidents, work orders, assets, and any other object) is a write by definition and is excluded outright, including any workflow action a customer's instance might label as innocuous-sounding (e.g. an "Acknowledge" or "Close" action) - this connector has no way to distinguish a read-flavored action from a real state-changing one, so none are exposed.
Hard-excluded (redundant POST-based retrieval) - never implemented: Alloy Navigator's guide documents POST variants of both the object-list and object-activities GET endpoints (POST /<objectClass>, POST /Activities/<oid>), intended to work around URL query-length limits when a caller constructs a raw URL by hand. This connector builds every request server-side from structured tool arguments rather than a hand-typed URL, so the length limit the POST variant exists to work around doesn't apply here - implementing it would add a second code path with identical behavior and no read/write distinction of its own, so it's excluded as redundant rather than as a scope boundary.
Hard-excluded (user/session/application administration - identity and credential management, not ITSM/asset data) - never implemented: the technician (username/password) authentication grant (POST /api/token with grant_type=password) - this connector only uses the application-account client_credentials grant, the shape intended for unattended service integrations - and any endpoint for managing application accounts, technician accounts, or sessions themselves.
Hard-excluded (out of ITSM/asset-data scope) - never implemented: GET /api/v2/GetAppConfig - configuration for a registered mobile scanner application (Settings App > Services > Mobile Applications), unrelated to IT asset/ITSM record data and dependent on a customer having registered a mobile app in the first place.
They can be added as a follow-up if there's demand, after a deliberate scope decision - not by default.
npm install
npm run build
npm test
npm run lint # tsc --noEmitdocker build -t alloy-navigator-mcp .
docker run -p 8080:8080 \
-e ALLOY_BASE_URL=https://alloy.example.com \
-e ALLOY_CLIENT_ID=... \
-e ALLOY_CLIENT_SECRET=... \
alloy-navigator-mcpGet the allowed reference/classification values for a field on an Alloy Navigator object class - e.g. the valid Status or Types values for Incidents or Computers. Useful for resolving what a status/type code means, or for building a valid filter value for alloy_list_objects.
| Name | Required | Description | Default |
|---|---|---|---|
| filters | No | Optional field-name/value pairs to filter the result, e.g. {"Priority": "High"}. Each pair is sent as a literal <fieldName>=<value> query parameter, matching Alloy Navigator's own filtering convention. | |
| refField | Yes | The reference field name, e.g. 'Status' or 'Types'. | |
| par_limit | No | Maximum number of records to return. | |
| par_fields | No | Comma-separated list of field names to include in the result. Omit to return every field. | |
| par_offset | No | Number of records to skip, for paging. | |
| objectClass | Yes | The Alloy Navigator object class the reference field belongs to, e.g. 'Computers'. | |
| par_sort_asc | No | Comma-separated list of field names to sort the result by, ascending. | |
| par_sort_desc | No | Comma-separated list of field names to sort the result by, descending. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the core function (getting dictionary values) and gives an example, but it does not disclose that this is a read-only operation, nor does it mention error behavior, response structure, or any side effects. It is adequate for a simple get but lacks depth beyond the core purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both dense and to the point. The first sentence states the purpose with examples; the second explains utility. No filler words, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 8 parameters and no output schema or annotations, the description provides the core purpose and use cases but does not describe the response format or how pagination/filtering behaves, leaving some inference to the agent. The schema covers parameters, but the overall context is only moderately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters clearly (objectClass, refField, filters, par_limit, etc.). The description adds no parameter-specific semantics beyond the schema, so it stays at the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb ('Get') and a specific resource ('allowed reference/classification values for a field on an Alloy Navigator object class') with concrete examples (Status, Types for Incidents or Computers). It clearly distinguishes itself from sibling list/get tools by its subject matter, though it does not explicitly name a sibling as a contrast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states two use cases: resolving what a status/type code means and building a valid filter value for alloy_list_objects. This gives an agent clear context for when to invoke this tool, but it does not explicitly mention when not to use it or name alternative tools as exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get every field of a single Alloy Navigator object by its OID (e.g. a ticket number like T000002) or database record GUID.
| Name | Required | Description | Default |
|---|---|---|---|
| oid | Yes | The object's OID or GUID (from alloy_list_objects). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states the action ('Get') and outcome ('every field'), but does not mention error handling, read-only safety, permissions, or response format. This is acceptable for a simple read operation but leaves some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the primary action and identifier type. Every word adds value—no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the description covers the essentials: what to pass and what to expect in return. It lacks error-handling behavior and explicit prerequisites, but the schema reference to alloy_list_objects partially addresses the workflow. Minor gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage for the 'oid' parameter with a description, but the tool description adds a concrete example (T000002) and clarifies the two accepted identifier forms (OID or database record GUID), enriching the schema's bare definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Get'), a specific resource ('Alloy Navigator object'), and the exact scope ('every field'), while also indicating the identifier type (OID/GUID). It clearly distinguishes itself from siblings like alloy_list_objects (listing) and alloy_get_object_activities (activities) by focusing on the full single object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes a clear use case: when you have an object's OID or GUID and need the complete record. It does not explicitly mention alternatives or exclusions, but the example and the emphasis on 'single object' make the intended context clear, leaving little ambiguity about when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the activity/history log entries recorded against a single Alloy Navigator object by its OID - e.g. status changes, assignment changes, and system-generated notes.
| Name | Required | Description | Default |
|---|---|---|---|
| oid | Yes | The object's OID (from alloy_list_objects or alloy_get_object). | |
| par_limit | No | Maximum number of records to return. | |
| par_fields | No | Comma-separated list of field names to include in the result. Omit to return every field. | |
| par_offset | No | Number of records to skip, for paging. | |
| par_sort_asc | No | Comma-separated list of field names to sort the result by, ascending. | |
| par_sort_desc | No | Comma-separated list of field names to sort the result by, descending. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It conveys that this is a read operation ('Get') and describes the kind of data returned, which is useful. However, it does not disclose absent-OID behavior, pagination implications, or any access requirements; it is adequate but not rich in behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the primary action and resource, followed by a compact list of illustrative examples. There is no filler or repetition of schema contents.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only history-log retrieval tool with a simple required parameter and fully documented optional parameters, the description plus schema is nearly complete. It is not fully complete because there is no output schema and no mention of edge cases or return shape, but the core invocation path is well covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains oid, par_limit, par_fields, par_offset, and sort parameters. The description adds no additional parameter semantics beyond echoing that the object is identified by OID, which is already present in the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Get the activity/history log entries recorded against a single Alloy Navigator object by its OID.' It also gives concrete examples (status changes, assignment changes, system-generated notes) and is clearly distinct from siblings like alloy_get_object, which returns the object itself, not its history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this when you need activity/history entries for a particular object, and you must identify that object by OID. It does not explicitly say 'use X instead' or list exclusions, but the purpose is clear enough to make the choice versus sibling tools obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List objects of a given Alloy Navigator object class (e.g. Incidents, Work Orders, Computers, Consumables, SoftwareCatalog, or 'Purchase Order Items' - Alloy Navigator does not publish one exhaustive class list; use the object class names configured in your instance, which typically match the module names shown in the Alloy Navigator client). Supports field selection, sorting, paging, free-text search, and per-field filters. Each returned object's OID chains into alloy_get_object and alloy_get_object_activities.
| Name | Required | Description | Default |
|---|---|---|---|
| filters | No | Optional field-name/value pairs to filter the result, e.g. {"Priority": "High"}. Each pair is sent as a literal <fieldName>=<value> query parameter, matching Alloy Navigator's own filtering convention. | |
| par_limit | No | Maximum number of records to return. | |
| par_fields | No | Comma-separated list of field names to include in the result. Omit to return every field. | |
| par_offset | No | Number of records to skip, for paging. | |
| objectClass | Yes | The Alloy Navigator object class to list, e.g. 'Incidents' or 'Computers'. | |
| par_sort_asc | No | Comma-separated list of field names to sort the result by, ascending. | |
| par_sort_desc | No | Comma-separated list of field names to sort the result by, descending. | |
| par_search_text | No | Free-text search string to narrow the returned objects. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the safety/behavior burden. It discloses the supported query features and the important caveat that object class names are not exhaustively published, but it doesn't mention default paging limits, return structure, or error behaviors. This is acceptable but not rich beyond what schema already implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry a clear operation, examples, a necessary configurability warning, capability list, and downstream integration note. The first sentence is slightly long due to the parenthetical, but every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complex tool with 8 parameters and no output schema, yet the description covers the central class-name ambiguity and how results chain into sibling tools. Missing details like pagination defaults, max page size, and expected response shape leave some ambiguity for an agent invoking it without examples.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description only summarizes capabilities already present in the schema (filtering, sorting, paging, search) and adds no new parameter-level detail, warranting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the operation verb 'List' and the resource ('objects of a given Alloy Navigator object class') with concrete examples. The chaining sentence also positions it as the entry point that yields OIDs for the sibling get tools, so an agent can distinguish list from fetch/detail actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description gives clear context for when to use: to enumerate objects by class, with filtering/paging/search. It doesn't explicitly say 'use this instead of alloy_get_object when you need many objects,' but the OID chaining note and sibling set make the intended workflow obvious. No explicit exclusions or alternative conditions, so not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0alloy_get_dictionaryalloy_get_objectalloy_get_object_activitiesalloy_list_objectsScored across 4 tools
Each tool has a clear, non-overlapping purpose: listing objects, fetching one object, retrieving its activity log, and looking up reference values. No tool could be confused with another.
All tool names follow the same alloy_ prefix with a verb_noun pattern: list_objects, get_object, get_object_activities, get_dictionary. The convention is uniform and predictable.
Four tools is a well-scoped set that covers the core object-read workflow without unnecessary bloat. Each tool serves a distinct need and fits within the ideal 3-15 range.
The set covers the main read-only lifecycle: list objects with filters, fetch full object details, get activity history, and resolve dictionary values. Minor gaps exist, such as no way to enumerate available object classes or perform create/update/delete operations, but these seem outside the server's clear query-focused purpose.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Connect AI assistants to Stellary projects, boards, documents, and governed agent workflows.
Secure Docusign Navigator integration for AI assistants to access and analyze agreement data.
Connect any AI assistant to Syncro: manage tickets, invoices, customers, assets, and more.
