saas-alerts-mcp

Model Context Protocol server for Kaseya SaaS Alerts — a SaaS security monitoring platform for M365 and Google Workspace events.

Part of the WYRE Technology MCP fleet.

Features

Exposes the full SaaS Alerts External Partner API (v0.20.0) through 30 MCP tools organized by domain:

Write/destructive tools require user confirmation via MCP elicitation (fail-open: proceeds if client doesn't support elicitation).

Related MCP server: kaseya-vsa-mcp

Authentication

SaaS Alerts uses an API key sent as the api_key HTTP header.

Generate your API key in the SaaS Alerts UI under Settings → API Keys.

Copy .env.example. Leave CONDUIT_S2S_SECRET empty in that file and never commit a real value.

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

X-Gateway-S2S signing

With MCP_TRANSPORT=http and a real CONDUIT_S2S_SECRET, every /mcp request must include X-Gateway-S2S. A missing or invalid header returns 401 before any vendor credential is read.

The header value is t=<unix seconds>,v1=<hex hmac-sha256>:

1. Set t to the current unix time in seconds.

2. Sign the ASCII message t=<unix seconds> with HMAC-SHA256, using CONDUIT_S2S_SECRET as the key.

3. Hex-encode the digest (64 lowercase hex characters) and send t=<unix seconds>,v1=<hex>.

The timestamp must be within 300 seconds of the server clock. Example:

import { createHmac } from 'node:crypto';

const t = Math.floor(Date.now() / 1000);
const v1 = createHmac('sha256', process.env.CONDUIT_S2S_SECRET).update(`t=${t}`).digest('hex');
const xGatewayS2s = `t=${t},v1=${v1}`;

Local / stdio mode

export SAAS_ALERTS_API_KEY=your-api-key
node dist/index.js

HTTP mode

CONDUIT_S2S_SECRET is required. If it is empty, the process logs an error and exits non-zero.

export CONDUIT_S2S_SECRET="$(openssl rand -hex 32)"
export SAAS_ALERTS_API_KEY=your-api-key
export MCP_TRANSPORT=http
export AUTH_MODE=env
export MCP_HTTP_PORT=8080
node dist/http.js

Local HTTP without a secret is development-only. It binds 127.0.0.1 even if MCP_HTTP_HOST is 0.0.0.0, and logs a warning:

MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm run start:http

WYRE Gateway mode

When running behind the WYRE MCP Gateway, set AUTH_MODE=gateway (the image and Compose default). The gateway signs each request with X-Gateway-S2S and injects the API key via X-SaaS-Alerts-API-Key. A request missing that credential header returns 401 and does not use SAAS_ALERTS_API_KEY from the environment.

await fetch('http://127.0.0.1:8080/mcp', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    accept: 'application/json, text/event-stream',
    'x-gateway-s2s': xGatewayS2s,
    'x-saas-alerts-api-key': apiKey,
  },
  body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
});

Running with Docker

The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode the SaaS Alerts API key arrives on each request; it is not read from the environment.

docker build -t saas-alerts-mcp .
docker run \
  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \
  -p 127.0.0.1:8080:8080 \
  saas-alerts-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not pass SAAS_ALERTS_API_KEY into the gateway service:

CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses SAAS_ALERTS_API_KEY:

docker run \
  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \
  -e AUTH_MODE=env \
  -e SAAS_ALERTS_API_KEY=your-key \
  -p 127.0.0.1:8080:8080 \
  ghcr.io/wyre-ai/saas-alerts-mcp:latest

Development

npm install
npm run build
npm test
npm run lint
node scripts/lint-destructive-warnings.mjs src

Destructive tool confirmation

Tools that permanently delete data (customer delete, scheduled report delete) carry:

• ⚠ DESTRUCTIVE — IRREVERSIBLE description prefix

• annotations.destructiveHint: true

• Elicitation confirmation guard (additive — proceeds if client doesn't support elicitation)

Always confirm with the user before invoking these tools.

License

Apache-2.0 — see LICENSE.