hudu-mcp
OfficialThis server offers a comprehensive interface to the Hudu IT documentation API via 89 MCP tools, providing full create, read, update, and archive/delete operations for many resource types, as well as specialized functions for IPAM, rack management, website monitoring, and integration.
Companies: List, get, create, update, archive, restore; find by integration identifier; lookup integration cards.
Assets: List, get, create, update, archive, restore assets. List, get, create, update asset layouts to define custom fields.
Knowledge Base: List, get, create, update, archive, restore articles (with public sharing control). List, get, create, update folders.
Passwords: List, get, create, update, archive, restore password records (metadata only by default; secrets withheld unless configured). Read-only access to password folders.
Procedures: List and get procedure templates; kick off new processes.
IPAM: List, get, create, update networks (subnets) and individual IP addresses.
Racks: List, get, create, update rack storages and rack storage items (mounted equipment).
Website Monitoring: List, get, create, update website monitors, including SSL, WHOIS, and DNS checks.
Relations: List and create links between records.
Magic Dash: List and upsert magic dash tiles on company dashboards.
Integration Matchers: List and update matchers to map external records to Hudu companies.
Instance Info: Get API version and build info, list users, activity logs, and expirations.
Files & Photos: List and retrieve uploaded files and public photos (read-only).
Exports: Trigger bulk exports (if allowed).
Security Controls: Configurable environment variables enable read-only mode, allow destructive actions, password reveal, and exports, ensuring sensitive operations are opt-in.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@hudu-mcp List all knowledge base articles about VPN"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
hudu-mcp
hudu-mcp is a community Model Context Protocol
server for the Hudu IT documentation REST API. It exposes the
documented v1 API — companies, assets, knowledge base articles, credential
records, IPAM, racks, website monitors, relations, integrations, the audit trail
and the export triggers — as 89 MCP tools, and it withholds stored passwords and
TOTP secrets from every response unless an operator has explicitly turned that
off. It is aimed at MSPs and internal IT teams who want an assistant that can
read and maintain their Hudu tenant over a local stdio connection, using an API
key they scope themselves.
Before you install this, look at Hudu's own MCP server
Hudu ships a first-party MCP server built into the product. It is served from
your own instance at https://<your-instance>/mcp, it authenticates with Hudu
OAuth rather than a long-lived API key, and it is enabled from
Admin → External Apps → Model Context Protocol. Per Hudu's documentation it
covers articles (create, read, update), activity logs (read) and assets (read
only), and it deliberately excludes passwords, asset writes and deletions.
For a large number of people that is the better choice, and you should not install this project reflexively.
Hudu's MCP server |
| |
Maintained by | Hudu Technologies, Inc. | Zenix Solutions, community project |
Where it runs | Inside your Hudu instance, at | A local process next to your MCP client |
Transport | Remote HTTP, reachable from hosted clients | stdio only (see compatibility) |
Authentication | Hudu OAuth, per user | A Hudu API key you create and scope |
Enabled by | Admin → External Apps → Model Context Protocol | Installing and configuring this package |
Articles | Create, read, update | Create, read, update, archive, delete |
Assets | Read only | Full CRUD, plus archive and layouts |
Activity log | Read | Read, and purge behind two gates |
Passwords | Excluded entirely | Metadata by default; secrets and writes behind gates |
Deletions | Excluded entirely | Behind |
IPAM, racks, websites, relations, matchers, exports | Not covered | Covered |
Support | Hudu support | GitHub issues, best effort |
Use Hudu's server if what you need is article and asset reading with some article authoring, if you want per-user OAuth rather than a shared API key, if you need a hosted client to reach it over HTTP, or if you want something you can raise a support ticket about. Its narrower surface is a design decision, not an omission: a server that cannot delete anything and cannot read a password has a much smaller worst case than this one.
Use hudu-mcp if you need the parts of the API Hudu's server does not cover —
IPAM, racks, website monitors, relations, integration matchers, expirations,
users, the audit trail — or if you need asset and password writes, or if you want
capability gates you control from the environment rather than a fixed surface.
The two can coexist. Nothing here depends on Hudu's server being off.
Related MCP server: Hudu MCP Server
Quick start
Requires Node.js 20 or newer and a Hudu API key.
npx @zenixsolutions/hudu-mcp --versionConfigure your MCP client to launch it over stdio. The block below is the standard shape and works in Claude Desktop, Claude Code and any other client that starts a local stdio server:
{
"mcpServers": {
"hudu": {
"command": "npx",
"args": ["-y", "@zenixsolutions/hudu-mcp"],
"env": {
"HUDU_BASE_URL": "https://hudu.example.com",
"HUDU_API_KEY": "your-api-key",
"HUDU_READ_ONLY": "1"
}
}
}
}That configuration registers 40 read tools and nothing that can change or delete
anything. Drop HUDU_READ_ONLY when you want writes — that is 67 tools; see
Security model before you do.
Verify a configuration without starting a session:
HUDU_BASE_URL=https://hudu.example.com HUDU_API_KEY=... npx @zenixsolutions/hudu-mcp --check
HUDU_BASE_URL=https://hudu.example.com HUDU_API_KEY=... npx @zenixsolutions/hudu-mcp --list-tools--list-tools prints the tools that would be registered under the current
environment, plus the ones being withheld and why. It is the fastest way to
confirm a gate is set the way you think it is.
Longer walkthrough: docs/quickstart.md. Other install methods: docs/installation.md.
Getting an API key
Create the key in Hudu at Admin → Basic Information → API Keys.
Hudu's own API documentation lists five scoping options on a key:
Access to passwords, covering all REST actions on them
Ability to perform destructive actions, meaning
DELETEAbility to perform exports
Whitelisted IP addresses
Company scopes
These options can only be configured when the key is created. They cannot be changed afterwards; a different scope means a new key. Create the key with the least this server needs and no more:
Leave password access off unless you intend to set
HUDU_ALLOW_PASSWORD_REVEAL=1orHUDU_ALLOW_PASSWORD_WRITE=1. Hudu's key scope covers all REST actions on passwords, so it does not separate reading a credential from writing one; the two gates in this server do.Leave destructive actions off unless you intend to set
HUDU_ALLOW_DESTRUCTIVE=1.Leave export capability off unless you intend to set
HUDU_ALLOW_EXPORTS=1.Set the IP allowlist if the machine running this server has a stable address.
Set a company scope if the key only ever needs one customer.
A key created without password access is a harder boundary than any setting in
this software. HUDU_ALLOW_PASSWORD_REVEAL is a decision made by the operator in
an environment variable, and it is enforced by code in this repository — code
that can have bugs, and that runs in the same process as a model reading
attacker-influenced text. A key that Hudu will not let read /asset_passwords at
all is enforced by Hudu, on the other side of the network, where nothing in this
process can reach it. Prefer that boundary whenever you can live with it.
Hudu's API documentation notes that a key can be created and deleted at any time. Deleting the key is the fastest way to revoke this server's access.
Configuration
Everything is read from the environment. Nothing is read from disk, and no credential is accepted as a tool argument.
Variable | Default | What it does |
| required | Your Hudu instance origin, e.g. |
| required | The key from Admin → Basic Information → API Keys. Sent as the |
| off | Register only |
| off | Register the 16 delete and purge tools, including the activity-log purge. |
| off | Register |
| off | Register |
| off | Register the two bulk export tools. |
|
| Client-side request ceiling. Must be a positive integer no greater than 300, which is the limit Hudu documents. |
|
| Simultaneous in-flight requests. Maximum 32. |
|
| Per-request timeout in milliseconds. Maximum 600000. |
|
| Retries for transient failures (timeouts, network errors, |
The five gates are booleans. 1, true, yes and on (any case, surrounding
whitespace ignored) enable them; anything else, including an unset variable,
leaves them off.
Setting HUDU_READ_ONLY and HUDU_ALLOW_DESTRUCTIVE together is rejected at
startup with exit code 78 rather than silently resolved. Read-only would win, but
the combination almost always means someone believes a delete is available when
it is not.
Invalid configuration reports every problem at once and exits 78, so a misconfigured install is fixed in one pass rather than one variable per restart.
Security model
Read SECURITY.md for the reporting process and the full model, and docs/security.md for the threat model and residual risks. The short version:
Nothing permissive is on by default. Out of the box the server registers 67 tools: reads, creates, and updates that do not touch the credential vault. Deletions, password reveal, password writes and exports are all absent until an operator sets the matching variable. A gated tool is not registered at all rather than registered-and-refusing, because a tool a model cannot see is a tool it cannot be talked into calling.
Five gates, all environment-only. HUDU_READ_ONLY,
HUDU_ALLOW_DESTRUCTIVE, HUDU_ALLOW_PASSWORD_REVEAL,
HUDU_ALLOW_PASSWORD_WRITE and HUDU_ALLOW_EXPORTS are read in src/config.ts
and nowhere else. There is no tool argument that enables, overrides or softens
any of them.
Passwords are withheld because of how the Hudu API is shaped. The
Asset_Password model lists password ("The actual password string") and
otp_secret ("Secret key for one-time passwords") among its required
properties, and GET /asset_passwords returns an array of that model
(docs/reference/spec-defects.md A1). A single unfiltered list call therefore
returns every credential and every TOTP seed the key can see. This server strips
those two fields recursively from every tool result, centrally, in
executeTool, renders Markdown from the stripped payload rather than the raw
record, and scrubs the rendered text by value behind that. A withheld value
comes back as null beside a password_redacted: true (or
otp_secret_redacted: true) flag; a field that genuinely stores nothing comes
back null with no flag, so "no credential on file" and "credential withheld
from you" stay distinguishable. No field named password or otp_secret ever
holds a string. The only exception is hudu_reveal_password, which needs
HUDU_ALLOW_PASSWORD_REVEAL=1, an explicit confirm: true, and one specific
record id. There is no bulk reveal.
Writing a credential is gated separately from reading one.
HUDU_ALLOW_PASSWORD_WRITE registers hudu_create_password,
hudu_update_password and hudu_archive_password, and combines with
HUDU_ALLOW_DESTRUCTIVE on hudu_delete_password. It is a separate flag from
the reveal gate on purpose: overwriting the only copy of a working credential is
a real loss even though no secret leaves the building, and documenting a newly
issued credential without being able to read existing ones is a legitimate
posture. Neither gate opens the other. Until 0.2.0 nothing gated the write
direction at all, which left a deployment able to overwrite or archive a
credential it could not read.
Destructive work needs two independent keys. The operator's
HUDU_ALLOW_DESTRUCTIVE decides whether the 16 destructive tools exist at all;
the model's confirm: true argument then has to be supplied per call, with the
impact stated in the tool description. These are not redundant, and they are not
equal: confirm is supplied by the model, so it is a prompt-level speed bump. The
environment flag is the gate a confused or manipulated agent cannot open. The
same pair guards the two Admin-class export tools.
The API key's scope sits outside all of this and is the outermost boundary. See Getting an API key.
Tool surface
89 tools with every gate open, 67 with the defaults, 40 in read-only mode.
Resource group | Tools | Registered by default | In read-only mode |
Companies | 8 | 7 | 4 |
Assets | 7 | 6 | 3 |
Asset layouts | 4 | 4 | 2 |
Articles | 6 | 5 | 2 |
Folders | 5 | 4 | 2 |
Procedures | 3 | 3 | 2 |
Passwords and password folders | 9 | 4 | 4 |
Networks and IP addresses | 10 | 8 | 4 |
Racks and rack items | 10 | 8 | 4 |
Websites | 5 | 4 | 2 |
Relations | 3 | 2 | 1 |
Magic Dash | 4 | 2 | 1 |
Matchers | 3 | 2 | 1 |
Instance, users, audit trail, expirations | 6 | 5 | 5 |
Files and photos | 4 | 3 | 3 |
Exports | 2 | 0 | 0 |
Total | 89 | 67 | 40 |
The passwords row is the only one where the default and the read-only column
match: the four tools that survive both are the two list tools and the two get
tools. hudu_create_password, hudu_update_password and
hudu_archive_password need HUDU_ALLOW_PASSWORD_WRITE, hudu_delete_password
needs that and HUDU_ALLOW_DESTRUCTIVE, and hudu_reveal_password needs
HUDU_ALLOW_PASSWORD_REVEAL.
By operation class: 41 Read, 13 Create, 17 Update, 16 Destructive, 2
Admin. hudu_reveal_password is classed Read because it does not modify
Hudu, so it remains available in read-only mode when
HUDU_ALLOW_PASSWORD_REVEAL is also set — read-only mode restricts writes, not
disclosure.
MCP annotations are derived from the class rather than hand-set per tool.
Read and Create carry destructiveHint: false; Update, Admin and
Destructive carry destructiveHint: true. The protocol defines true as "may
perform destructive updates" against false as "only additive", so an overwrite
counts: a PUT replaces the prior value of every field it carries and this API
offers no undo. Update also carries idempotentHint: true, which is a
statement about replaying the same call, not about what the first one cost.
What a list tool returns
Every list tool returns an object with items plus these facts about them:
Field | Meaning |
| The page and size requested. |
| The number of records in |
| The page came back full, so more records probably exist. Not a promise that they do. |
| The page to request next, or |
|
|
| Plain-language statement of what is and is not known. Regenerated if the response was truncated. |
| Present when the list is limited independently of paging — |
| Present when this client cut records to fit its output budget. |
| Present alongside |
| What was dropped and how to reach it. |
There is deliberately no total and no has_more: no Hudu collection endpoint
returns a count, so both would have to be invented. truncated,
records_on_page and truncation_note are emitted before items, because
clients clip long tool results and a correction printed below twenty-five
kilobytes of records is not a correction.
Every tool, with its arguments and gates: docs/tool-reference.md. Task-oriented recipes: docs/user-guide.md.
Limitations
The Hudu v1 API cannot answer some questions that people reasonably expect it to, and this server reports those gaps rather than papering over them. The ones most likely to affect you:
No collection endpoint returns a total count — no
total, noX-Total-Count, noLinkheader (C1). Ten collections wrap their array in a single-key envelope, but that envelope carries the array and nothing else, so it counts nothing either (F1). This server therefore emits neithertotalnorhas_more. Readpage_was_fullandpagination_note, and never treat a full page as a complete list.Five collections have no pagination at all — networks, IP addresses, racks, rack items and uploads (C2). They return everything matching your filters in one response, and if that response is trimmed to fit the output budget there is no next page to ask for. Where the endpoint also offers no narrow enough filter, the dropped records cannot be reached at all.
hudu_list_companiessilently omits archived companies, and Hudu offers no parameter that includes them. On the measured instance 27 companies existed and the tool returned 22.hudu_get_companystill reaches an archived company by id, and the list envelope carries acompleteness_caveatsaying so.A rack storage item carries no rack id (C4), so
hudu_list_rack_storage_itemsis instance-wide and cannot be grouped by cabinet. This is not the limitation it was once written up as: a rack's contents come back on the rack itself, as a per-unitfront_items/rear_itemselevation fromhudu_get_rack_storage.Exports can be started but never retrieved (C6). There is no status endpoint and no download URL in this API version.
File upload is not implemented (E1). The endpoints are
multipart/form-dataand the contract documents no request body for them.A 403 is documented nowhere (A7), so a key-scope failure is hard to distinguish from a missing record.
The full list, with the evidence behind each item: docs/limitations.md.
Documentation
Document | Contents |
Five minutes from nothing to a working tool call | |
npx, global install, from source, per-client configuration | |
MSP workflows, with the tool sequence for each | |
All 89 tools: class, arguments, gates | |
What this API cannot do, and why | |
Node versions, MCP protocol revisions, clients | |
Threat model, controls, residual risks | |
Findings against the captured Hudu API contract | |
Release history |
Contributing
See CONTRIBUTING.md. It states plainly which steps CI enforces and which are convention. Pre-1.0, the tool surface is not stable: a minor version may add, rename or remove tools.
Security reporting
Report vulnerabilities privately through GitHub Security Advisories, not as a public issue. See SECURITY.md.
Licence
MIT. See LICENSE.
Disclaimer
This project is not affiliated with, endorsed by, or supported by Hudu Technologies, Inc. "Hudu" is used nominatively, to identify the product this software interoperates with. Hudu is a trademark of its respective owner. For support of the Hudu platform itself, including its own MCP server, contact Hudu.
Available Tools
70 toolshudu_archive_articleArchive or Restore ArticleAIdempotent
Archive or unarchive a article. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.
This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.
Operation class: Update. Impact: Hides or restores this article. Reversible.
Inputs: id (required), archived (required).
hudu_archive_assetArchive or Restore AssetAIdempotent
Archive or unarchive an asset. Archiving hides it from normal views and from the default listings without deleting anything, and is reversible by calling this tool again with archived: false. Archived assets are still readable through hudu_list_assets with archived: true.
Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.
This is the reversible alternative to hudu_delete_asset and should be preferred whenever the user wants a decommissioned machine "removed" without saying they want its documentation gone permanently.
Operation class: Update. Impact: Hides or restores this asset. Reversible.
Inputs: id (required), archived (required), company_id (required).
hudu_archive_companyArchive or Restore CompanyAIdempotent
Archive or unarchive a company. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.
This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.
Operation class: Update. Impact: Hides or restores this company. Reversible.
Inputs: id (required), archived (required).
hudu_archive_passwordArchive or Restore PasswordAIdempotent
Archive or unarchive a password. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.
This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.
Operation class: Update. Impact: Hides or restores this password. Reversible.
Inputs: id (required), archived (required).
hudu_create_articleCreate ArticleA
Create a new article in Hudu. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), content, folder_id, company_id, +1 more.
hudu_create_assetCreate AssetA
Create an asset inside a company. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.
Every asset belongs to exactly one company and there is no global create route, so company_id is required. Choose asset_layout_id before calling: the layout fixes which custom fields the asset can hold and Hudu will not infer one. hudu_list_asset_layouts lists the layouts and hudu_get_asset_layout shows the field labels a layout defines, which are the keys custom_fields expects.
Returns the created asset, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails, including when a custom field label does not exist on the chosen layout.
Operation class: Create.
Inputs: name (required), company_id (required), asset_layout_id (required), primary_mail, +4 more.
hudu_create_asset_layoutCreate Asset LayoutA
Create a new asset layout in Hudu. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), icon, color, fields, +6 more.
hudu_create_companyCreate CompanyA
Create a new company in Hudu. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), zip, city, notes, +11 more.
hudu_create_folderCreate FolderA
Create a new folder in Hudu. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), icon, company_id, description, +1 more.
hudu_create_ip_addressCreate IP AddressA
Create a new ip address in Hudu. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: address (required), fqdn, status, asset_id, +4 more.
hudu_create_networkCreate NetworkA
Create a new network in Hudu. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), address (required), company_id, description, +2 more.
hudu_create_passwordCreate PasswordA
Create a new password in Hudu. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), company_id (required), url, password, +9 more.
hudu_create_rack_storageCreate Rack StorageA
Create a new rack storage in Hudu. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: name (required), width, height, company_id, +4 more.
hudu_create_rack_storage_itemCreate Rack Storage ItemA
Create a new rack storage item in Hudu. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: side, status, asset_id, end_unit, +6 more.
hudu_create_relationCreate RelationA
Create a new relation in Hudu. A relation is a link between any two Hudu records — an asset to the password that opens it, an article to the company it documents — stored as a from/to pair of type-and-id. Hudu exposes no update route for relations, so changing one means deleting it and creating a replacement.
Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create.
Inputs: toable_id (required), fromable_id (required), toable_type (required), fromable_type (required), +2 more.
hudu_create_websiteCreate Website MonitorA
Create a website monitor. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.
This is not a passive documentation record. From the moment it is created, the Hudu instance begins making repeated outbound requests to the host you name — HTTP polling plus TLS, WHOIS and DNS lookups — on Hudu's own schedule, and will raise alerts against the owning company when they fail. Point it only at hosts the customer actually owns or is contracted to watch, and use disable_ssl, disable_whois and disable_dns to turn off individual checks that would only produce noise. paused: true creates the record with every check dormant.
Hudu publishes no success response for this endpoint, so the created record may come back empty even though the write succeeded. When that happens this tool returns website: null — confirm with hudu_list_websites filtered by name rather than retrying, which would create a second monitor. Hudu answers 422 with the offending field named when validation fails.
Operation class: Create. Impact: Starts recurring outbound monitoring of an external host from the Hudu instance, and arms the alerts that go with it.
Inputs: name (required), notes, paused, company_id, +3 more.
hudu_find_company_by_integrationFind Company by Integration IdentifierARead-onlyIdempotent
Resolve a company in a connected integration (a PSA, RMM or similar) to its Hudu company record.
Use this when you arrive from another system holding that system's customer id rather than a Hudu id — for example a ticket that names its own account identifier. If you only have a customer name, use hudu_list_companies with search instead.
Operation class: Read.
Inputs: integration_slug (required), integration_id, response_format, integration_identifier.
hudu_get_api_infoGet Hudu API InfoARead-onlyIdempotent
Report the version and build date of the Hudu instance this server is pointed at. Returns version and date, nothing else.
Call this first whenever something behaves unexpectedly. The Hudu API changes between releases: several endpoints exist only on newer builds, and an older instance answers 404 for them — which is the same 404 it returns for a record that does not exist, so the two are indistinguishable without knowing the version. It is also the fastest way to confirm the base URL and API key are working at all, since it needs no ids and no permissions beyond a valid key.
Operation class: Read.
Inputs: response_format.
hudu_get_articleGet ArticleARead-onlyIdempotent
Fetch one article by its numeric id. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.
Use hudu_list_articles first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_assetGet AssetARead-onlyIdempotent
Fetch one asset with every value stored on it. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.
Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.
Layout-defined data comes back under fields: an array of {id, label, value, position} objects, one per field the layout defines. Read it here before any update, because a PUT replaces the values it is given.
Operation class: Read.
Inputs: id (required), company_id (required), response_format.
hudu_get_asset_layoutGet Asset LayoutARead-onlyIdempotent
Fetch one asset layout by its numeric id. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.
Use hudu_list_asset_layouts first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_companyGet CompanyARead-onlyIdempotent
Fetch one company by its numeric id. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.
Use hudu_list_companies first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_folderGet FolderARead-onlyIdempotent
Fetch one folder by its numeric id. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.
Use hudu_list_folders first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_ip_addressGet IP AddressARead-onlyIdempotent
Fetch one ip address by its numeric id. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.
Use hudu_list_ip_addresses first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_networkGet NetworkARead-onlyIdempotent
Fetch one network by its numeric id. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.
Use hudu_list_networks first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_passwordGet PasswordARead-onlyIdempotent
Fetch one password by its numeric id. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.
Use hudu_list_passwords first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_password_folderGet Password FolderARead-onlyIdempotent
Fetch one password folder by its numeric id. A folder that groups password records within a company. Folders in Hudu can also carry their own access restrictions, so which folder a credential sits in affects who can see it.
Use hudu_list_password_folders first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_procedureGet ProcedureARead-onlyIdempotent
Fetch one procedure by its numeric id. A procedure — called a Process in the Hudu interface — is an ordered checklist of tasks with a completion count, used for repeatable work such as onboarding, offboarding and server builds.
Use hudu_list_procedures first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_rack_storageGet Rack StorageARead-onlyIdempotent
Fetch one rack storage by its numeric id. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.
Use hudu_list_rack_storages first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_rack_storage_itemGet Rack Storage ItemARead-onlyIdempotent
Fetch one rack storage item by its numeric id. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.
Use hudu_list_rack_storage_items first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_uploadGet UploadARead-onlyIdempotent
Fetch one upload by its numeric id. An upload is a file attached to a Hudu record — an asset, website, procedure, password, company or article. Each carries a url, name, mime, size and the uploadable_type/uploadable_id pair naming what it is attached to.
Use hudu_list_uploads first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_userGet UserARead-onlyIdempotent
Fetch one user by its numeric id. A user is a person with access to Hudu: either a member of your own team, or a portal member belonging to one client company.
Use hudu_list_users first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_get_websiteGet WebsiteARead-onlyIdempotent
Fetch one website by its numeric id. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.
Use hudu_list_websites first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.
Operation class: Read.
Inputs: id (required), response_format.
hudu_kickoff_procedureStart a Process from a ProcedureA
Start a new process from an existing procedure. Hudu copies the procedure's task list into a new process record with its own id, slug and URL, and returns that new record. Afterwards the company has a live checklist that its users can work through and tick off; the procedure it came from is unchanged and can be kicked off again.
Attach the new process to an asset with asset_id when the work concerns one specific device or person — that is how an onboarding checklist ends up on the employee record it belongs to. Give it a name when several runs of the same procedure would otherwise be indistinguishable, e.g. "Onboarding — J. Okafor".
Find the procedure id with hudu_list_procedures. Both optional inputs are sent as query parameters because that is what Hudu documents for this endpoint; it accepts no request body. Success answers 200 rather than the 201 you might expect from a create, and 404 covers both a missing procedure and an unrouted path.
Operation class: Create. Impact: Creates a live process in Hudu, visible to the users of the company that owns the procedure and appearing in their process list as outstanding work.
Inputs: id (required), name, asset_id.
hudu_list_activity_logsList Activity LogsARead-onlyIdempotent
List activity logs in Hudu. The activity log is Hudu's audit trail: one entry per action, recording who did it, what they did it to, and when.
This is the tool for "who changed this, and when". Each entry carries user_id and user_email (the actor), resource_type and resource_id (what they touched), and an action_message describing the action.
Combine the filters to answer a real question rather than paging the whole log:
History of one record:
resource_typeplusresource_idtogether. Sending one without the other does nothing.What one person did:
user_id, oruser_emailif you only have the address.A time window:
start_date. There is no end-date filter, so a log is bounded at the start only; to look at "last week" specifically, setstart_dateto the beginning of that week and read forward.One kind of action:
action_message.
Entries are ordered by Hudu, not by this server, and no total count is returned — so to find the most recent change to a record, request a page and read it rather than assuming the first entry is newest.
Reading the log never alters it. Purging it is a separate tool, hudu_purge_activity_logs, and is destructive.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, fields, user_id, page_size, +6 more.
hudu_list_articlesList ArticlesARead-onlyIdempotent
List articles in Hudu. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.
Filter by company_id for one customer's knowledge base. Articles created without a company are global, and the API documents no filter that isolates those — request without company_id and select on a null company_id yourself.
enable_sharing: true returns only articles that currently have a public, unauthenticated share URL, which makes this the tool to answer "what of ours is exposed publicly?". draft: true returns unpublished work in progress.
Every record carries its full HTML content, which is large. Pass fields — for example ["id","name","company_id","folder_id","enable_sharing"] — when you are looking for an article rather than reading one, then fetch the body with hudu_get_article. Note also that no archived filter is documented, so archived articles cannot be selected for or against here.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, slug, draft, +7 more.
hudu_list_asset_layoutsList Asset LayoutsARead-onlyIdempotent
List asset layouts in Hudu. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.
Read this before writing any asset: the fields array on each layout gives the labels that hudu_create_asset and hudu_update_asset expect as custom_fields keys, in snake_case. This endpoint documents page but no page_size, so pages come back at the server's own size.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, slug, fields, +2 more.
hudu_list_assetsList AssetsARead-onlyIdempotent
List assets in Hudu. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.
This is the only route that reads assets across every company, and it is read-only: creating, updating, archiving and deleting an asset all happen under /companies/{company_id}/assets. Keep the company_id of any record you might write to — hudu_get_asset, hudu_create_asset, hudu_update_asset, hudu_archive_asset and hudu_delete_asset all require it, and it cannot be recovered from the asset id alone. If you narrow the response with fields, keep "company_id" in the list.
Custom field values come back under fields as {id, label, value, position} objects rather than as top-level keys. search is the right first filter for a hostname or a fragment of a name; id is how you turn a bare asset id into the company id needed to write to it.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: id, name, page, slug, +9 more.
hudu_list_companiesList CompaniesARead-onlyIdempotent
List companies in Hudu. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.
To find a company by name, prefer search (matches broadly) over name (matches the name field). If the API key was created with a company scope, only that company is visible here and everything else returns 404.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: city, name, page, slug, +10 more.
hudu_list_company_assetsList Assets for a CompanyARead-onlyIdempotent
List the assets belonging to one company. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.
This route accepts paging and the archived flag and nothing else. To filter by name, serial, layout or free text within a company, call hudu_list_assets with company_id set instead — it reaches the same records and supports the full filter set.
Returns an object with items plus pagination facts. Hudu returns no total count for any collection, so page_was_full is the only honest signal that more records exist.
Operation class: Read.
Inputs: company_id (required), page, fields, archived, +2 more.
hudu_list_expirationsList ExpirationsARead-onlyIdempotent
List expirations in Hudu. An expiration is a dated thing that will stop working: a domain registration, an SSL certificate, a hardware warranty, a date field on an asset, or an article review date.
This is the single call that answers "what is about to expire for this client". Hudu gathers expiry dates from across every module into one list, so you do not have to walk websites, then assets, then articles separately. Filter by company_id for one client and read the date field on each entry.
Each entry points at the thing that expires through expirationable_type and expirationable_id rather than embedding it — so once you have found the interesting entries, fetch the underlying record with the matching tool (hudu_get_website, hudu_get_asset, hudu_get_article) to get its name and details.
There is no date-range filter: Hudu returns the entries and this server passes them through unchanged, so compare date yourself rather than expecting the API to have narrowed to "the next 30 days". Entries are not filtered by whether they have already passed either — a date in the past means something has already expired.
Expirations are read-only through the API. To change one, edit the record that produced it: the website's expiry, the asset field's date, and so on.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, fields, page_size, company_id, +4 more.
hudu_list_foldersList FoldersARead-onlyIdempotent
List folders in Hudu. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.
These are article folders. Passwords are organised by a separate password_folders resource with its own tools; do not use these ids there.
The response is flat, not a tree — reconstruct the hierarchy yourself by following each folder's parent_folder_id, which is null at the top level.
On in_company, the API documents exactly one sentence: "When true, only returns company-specific KB articles." It says nothing about what false does, nor how it interacts with company_id. Read it as "restrict to company-scoped folders and exclude global ones", and check the returned company_id values rather than trusting that reading.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, fields, page_size, +3 more.
hudu_list_ip_addressesList IP AddressesARead-onlyIdempotent
List ip addresses in Hudu. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.
This endpoint documents neither page nor page_size, so there is no paging: the call returns everything matching your filters in a single response. If truncated comes back true the client cut records to stay inside its response budget, and because there is no next page the only ways to see the rest are narrower filters or a shorter fields list. That matters more here than anywhere else in this API: an unfiltered call against a large IPAM deployment returns every documented address in the instance, and a /16 that has been filled in can be tens of thousands of records. Always send a filter — network_id for one subnet, company_id for one customer, address or fqdn when you are chasing a single host.
address matches the stored text of one address, so it will not find every host in a subnet; use network_id for that. To go from an address to the machine, read asset_id and look it up with hudu_list_assets.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: fqdn, fields, status, address, +6 more.
hudu_list_magic_dash_itemsList Magic Dash ItemsARead-onlyIdempotent
List magic dash items in Hudu. A magic dash item is one of the coloured tiles across the top of a company page in Hudu — a title, a headline message, an optional shade and optional HTML detail. They are normally written by scripts and integrations to surface a live status ("Microsoft 365: 42 licences, 3 unassigned") next to the documentation.
The write endpoints identify the company by name, not by id — company_id is a read-side filter only, and there is no way to address a tile by company id when writing. The name has to match an existing Hudu company exactly. Take it from company_name on a listed item, or from name on the record hudu_list_companies returns.
There is no endpoint for fetching a single magic dash item, so this list is the only way to read one — filter by title and company_id to narrow to the tile you want and read its id and company_name from the result.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, title, fields, page_size, +2 more.
hudu_list_matchersList MatchersARead-onlyIdempotent
List matchers in Hudu. A matcher is one row in the mapping table between a connected integration (a PSA or RMM such as Autotask or ConnectWise) and Hudu's companies: it ties one customer record in that external system to one Hudu company, so synced data lands in the right place.
integration_id is required on every call here. It is the number in the address bar when you edit the integration in Hudu's admin UI (…/integrations/<integration_id>/edit); the API publishes no endpoint that lists integrations, so it has to come from the user or from a matcher you have already seen (integrator_id on the record).
The reason to call this is almost always matched: false, which returns the records the integration pulled in but could not tie to a Hudu company — the sync backlog someone has to work through. Each unmatched row carries the external name and, where Hudu guessed, a potential_company_id. Resolve them one at a time with hudu_update_matcher.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: integration_id (required), page, fields, matched, +5 more.
hudu_list_networksList NetworksARead-onlyIdempotent
List networks in Hudu. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.
This endpoint documents neither page nor page_size, so there is no paging: the call returns everything matching your filters in a single response. If truncated comes back true the client cut records to stay inside its response budget, and because there is no next page the only ways to see the rest are narrower filters or a shorter fields list.
Filter by company_id when you are working for one customer; instances that document every client hold networks for all of them here. address matches the stored CIDR text, so it finds a subnet you already know the notation of rather than telling you which network a given host falls in — Hudu does not offer containment search. To see what is allocated inside a network, call hudu_list_ip_addresses with network_id set.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, slug, fields, address, +6 more.
hudu_list_password_foldersList Password FoldersARead-onlyIdempotent
List password folders in Hudu. A folder that groups password records within a company. Folders in Hudu can also carry their own access restrictions, so which folder a credential sits in affects who can see it.
This API version exposes password folders as read-only — there is no create, update or delete endpoint for them. Folders are managed in the Hudu web interface.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, fields, search, +3 more.
hudu_list_passwordsList PasswordsARead-onlyIdempotent
List passwords in Hudu. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.
The secret value and any stored OTP seed are withheld from these results. Everything else — name, username, URL, company, folder, timestamps — is returned, which answers most questions ("does this client have a firewall admin credential documented, and when was it last rotated?") without exposing anything. To read an actual secret you need hudu_reveal_password, one record at a time, and the server operator must have enabled it.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, slug, fields, +6 more.
hudu_list_proceduresList ProceduresARead-onlyIdempotent
List procedures in Hudu. A procedure — called a Process in the Hudu interface — is an ordered checklist of tasks with a completion count, used for repeatable work such as onboarding, offboarding and server builds.
This API version exposes procedures read-only. There is no create, update or delete endpoint for them, so no such tool exists here and none is being withheld — process templates are authored in the Hudu web interface. The one write available is hudu_kickoff_procedure, which starts a new process from an existing template.
Results include both templates and processes already started from one: parent_procedure names the template a running process came from and is null on the template itself. total and completed count tasks, completion_percentage arrives as a string like "0%", and a non-null asset means the process is pinned to a specific device or person. For instructions that are read rather than worked through, look at articles instead (hudu_list_articles).
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, slug, fields, +3 more.
hudu_list_public_photosList Public PhotosARead-onlyIdempotent
List public photos in Hudu. A public photo is an image published at a public URL and attached to an article or an asset note, so it can be rendered inside that content.
Each entry gives the image url plus the record_type and record_id it belongs to. The URL is public: anyone holding it can fetch the image without authenticating, so treat these links as shareable-by-accident and do not paste them somewhere they will outlive the conversation.
There is no filter on this endpoint — page through and match record_id yourself to find the photos for one article.
Creating and re-pointing public photos needs multipart/form-data, which hudu-mcp 0.1.0 does not implement, so this list is the only public-photo operation available here. Use the Hudu web UI to add or change one.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, fields, page_size, response_format.
hudu_list_rack_storage_itemsList Rack Storage ItemsARead-onlyIdempotent
List rack storage items in Hudu. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.
Read this before answering a question about a specific rack: the API documents no way to list the items in one. The item schema has no rack field, and none of the filters scope to a rack — rack_storage_role_id filters by role, which is a classification, not the cabinet. The documented filters are role, asset, start_unit, end_unit, status, side and the two timestamps, all of them instance-wide. If you are asked what is in rack 12, say this API does not expose it rather than presenting an unscoped list as that rack's contents. It is worth reading one record with hudu_get_rack_storage_item to see whether your Hudu version returns a rack reference the published schema omits, but do not assume one is there.
To go the other way — from a device to where it is racked — filter by asset_id, which is the one filter that ties an item to something you can identify elsewhere in Hudu.
This endpoint documents neither page nor page_size, so this tool sends neither and Hudu answers with everything matching in one response. The envelope reports page_was_full: false and next_page: null accordingly — there is no second page to ask for, and what you get back is the complete set for the filters given. If the result comes back marked truncated, that is this server trimming the response to fit its output budget, not the end of the data; narrow the filters or use fields to see the rest.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: side, fields, status, asset_id, +6 more.
hudu_list_rack_storagesList Rack StoragesARead-onlyIdempotent
List rack storages in Hudu. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.
Filter by company_id for one customer's racks and location_id for one site. height, min_width and max_width filter on the rack dimensions, whose units the API never states — they are still usable for relative comparison against values already in the instance.
No name or free-text search filter is documented. To find a rack by name, list the company's racks and match the name field yourself.
This endpoint documents neither page nor page_size, so this tool sends neither and Hudu answers with everything matching in one response. The envelope reports page_was_full: false and next_page: null accordingly — there is no second page to ask for, and what you get back is the complete set for the filters given. If the result comes back marked truncated, that is this server trimming the response to fit its output budget, not the end of the data; narrow the filters or use fields to see the rest.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: fields, height, max_width, min_width, +5 more.
hudu_list_relationsList RelationsARead-onlyIdempotent
List relations in Hudu. A relation is a link between any two Hudu records — an asset to the password that opens it, an article to the company it documents — stored as a from/to pair of type-and-id. Hudu exposes no update route for relations, so changing one means deleting it and creating a replacement.
This endpoint takes no filters whatsoever — not by record, not by type, not by company. Finding the relations on one asset therefore means paging through the whole set and matching fromable_type/fromable_id (or the toable_ pair) yourself. Expect to see each link twice: creating a relation also creates its mirror in the opposite direction, and is_inverse: true marks the mirror copy. Use this list to read the exact fromable_type/toable_type strings your instance uses before creating one.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, fields, page_size, response_format.
hudu_list_uploadsList UploadsARead-onlyIdempotent
List uploads in Hudu. An upload is a file attached to a Hudu record — an asset, website, procedure, password, company or article. Each carries a url, name, mime, size and the uploadable_type/uploadable_id pair naming what it is attached to.
Hudu documents no filter and no pagination on this endpoint: it returns the uploads for the whole instance in one response, and there is no company_id or uploadable_id parameter to narrow it. On an instance with many attachments the response can be large and may be truncated by this server's output budget — check truncated before treating the list as complete. Filter client-side on uploadable_type and uploadable_id to find the attachments of one record.
This server cannot upload files. The Hudu upload endpoint takes multipart/form-data, which hudu-mcp 0.1.0 does not implement, so there is no create tool here and no way to add an attachment through this interface — tell the user to attach the file in the Hudu web UI. Do not claim a file was uploaded.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: fields, response_format.
hudu_list_usersList UsersARead-onlyIdempotent
List users in Hudu. A user is a person with access to Hudu: either a member of your own team, or a portal member belonging to one client company.
Always send at least one filter. search (first and last name), email and security_level narrow this to the person actually being asked about; calling it with no filter enumerates every account on the instance, which is rarely what the user meant and is exactly the shape of a reconnaissance sweep.
These records contain personal and security-relevant data — email, phone_number, last_sign_in_ip, last_sign_in_at, sign_in_count, currently_signed_in, otp_required_for_login and security_level. Answer the question that was asked and nothing more. Do not copy these fields into a Hudu article, a file, a ticket, a chat message or any other tool call; in particular, last_sign_in_ip and otp_required_for_login describe how an account can be attacked. Use fields to request only the columns you need.
Users cannot be created, changed or removed through the Hudu API — that is the web admin UI only.
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: page, email, fields, search, +7 more.
hudu_list_websitesList WebsitesARead-onlyIdempotent
List websites in Hudu. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.
There is no company filter on this endpoint. To answer "what are we monitoring for Contoso?", list websites and match on company_id in the returned records, or try search. The monitoring state of each record is in monitoring_status ("up"/"down"), code (last HTTP status) and monitored_at (when it was last checked).
Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.
Operation class: Read.
Inputs: name, page, slug, fields, +4 more.
hudu_lookup_integration_cardsLook Up Integration CardsARead-onlyIdempotent
List the integration cards Hudu holds for a given external record. Cards are the link between a Hudu asset or company and its counterpart in a connected PSA or RMM, and they carry the synced fields shown on the record.
Use this to answer "what does Hudu know about this device from our RMM?" without opening the RMM itself.
Operation class: Read.
Inputs: integration_slug (required), integration_id, response_format, integration_identifier.
hudu_update_articleUpdate ArticleAIdempotent
Update an existing article. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_article if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this article.
Inputs: id (required), name, content, folder_id, +2 more.
hudu_update_assetUpdate AssetAIdempotent
Update an existing asset. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.
Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.
Only the arguments you supply are sent, but each one replaces the stored value outright — this is a PUT, not a merge. Read the asset with hudu_get_asset first whenever you intend to add to a field rather than overwrite it. The same applies to custom_fields: send the full label/value set you want the asset to end up with.
Operation class: Update. Impact: Overwrites the supplied fields on this asset with the values given.
Inputs: id (required), company_id (required), name, primary_mail, +5 more.
hudu_update_asset_layoutUpdate Asset LayoutAIdempotent
Update an existing asset layout. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_asset_layout if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this asset layout.
Inputs: id (required), icon, name, color, +7 more.
hudu_update_companyUpdate CompanyAIdempotent
Update an existing company. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_company if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this company.
Inputs: id (required), zip, city, name, +12 more.
hudu_update_folderUpdate FolderAIdempotent
Update an existing folder. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_folder if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this folder.
Inputs: id (required), icon, name, company_id, +2 more.
hudu_update_ip_addressUpdate IP AddressAIdempotent
Update an existing ip address. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_ip_address if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this ip address.
Inputs: id (required), fqdn, status, address, +5 more.
hudu_update_matcherUpdate MatcherAIdempotent
Point an integration record at a Hudu company, or correct which company it points at. A matcher is one row in the mapping table between a connected integration (a PSA or RMM such as Autotask or ConnectWise) and Hudu's companies: it ties one customer record in that external system to one Hudu company, so synced data lands in the right place.
This is how an unmatched record gets resolved, and it is the second half of a two-step job:
Call hudu_list_matchers with the
integration_idandmatched: falseto get the records the sync could not place. Each one gives you itsid, the customernameas the external system spells it, and sometimes apotential_company_idthat Hudu guessed at.Work out the right Hudu company — hudu_list_companies with
searchset to that name is the usual way — and call this tool with the matcheridand thatcompany_id.
Matchers cannot be created through the API; they appear when an integration syncs. So this tool only ever edits rows that already exist, and a matcher id that returns 404 means the sync has not produced that record.
Only the fields you supply are sent, and each replaces the stored value outright.
Operation class: Update. Impact: Changes which Hudu company this integration record maps to, and therefore where future synced data from that record is filed.
Inputs: id (required), sync_id, company_id, identifier, +1 more.
hudu_update_networkUpdate NetworkAIdempotent
Update an existing network. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_network if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this network.
Inputs: id (required), name, address, company_id, +3 more.
hudu_update_passwordUpdate PasswordAIdempotent
Update an existing password. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_password if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this password.
Inputs: id (required), url, name, password, +10 more.
hudu_update_rack_storageUpdate Rack StorageAIdempotent
Update an existing rack storage. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_rack_storage if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this rack storage.
Inputs: id (required), name, width, height, +5 more.
hudu_update_rack_storage_itemUpdate Rack Storage ItemAIdempotent
Update an existing rack storage item. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_rack_storage_item if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this rack storage item.
Inputs: id (required), side, status, asset_id, +7 more.
hudu_update_websiteUpdate WebsiteAIdempotent
Update an existing website. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.
Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_website if you intend to append rather than overwrite.
Operation class: Update. Impact: Overwrites the supplied fields on this website.
Inputs: id (required), name, notes, paused, +4 more.
hudu_upsert_magic_dash_itemCreate or Replace Magic Dash ItemAIdempotent
Create a magic dash tile, or replace the existing one with the same title on the same company. A magic dash item is one of the coloured tiles across the top of a company page in Hudu — a title, a headline message, an optional shade and optional HTML detail. They are normally written by scripts and integrations to surface a live status ("Microsoft 365: 42 licences, 3 unassigned") next to the documentation.
Read that first sentence carefully: this single endpoint does both. Hudu matches on title plus company_name, and if a tile with that pair already exists it is overwritten with what you send — no error, no warning, and no way to recover what it said before. Check hudu_list_magic_dash_items for the title on that company first whenever you are not deliberately refreshing a tile you own.
The replacement is wholesale rather than a merge: fields you omit are not carried over from the previous tile, so send the complete tile you want to end up with every time.
The write endpoints identify the company by name, not by id — company_id is a read-side filter only, and there is no way to address a tile by company id when writing. The name has to match an existing Hudu company exactly. Take it from company_name on a listed item, or from name on the record hudu_list_companies returns.
Operation class: Update. Impact: Overwrites any existing tile with the same title on the same company, wholesale and without confirmation. Creates a new tile only when no such pair exists.
Inputs: title (required), message (required), company_name (required), icon, +4 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 70 tools
Most tools follow a distinct resource+action pattern (list/get/create/update/archive per entity), making them easy to tell apart. A few overlaps exist, such as hudu_list_assets vs hudu_list_company_assets, and the large number of similar CRUD pairs could occasionally confuse an agent, but the descriptions consistently specify the resource and purpose.
All tools use a consistent hudu_<verb>_<resource> snake_case convention. The few exceptions (hudu_find_company_by_integration, hudu_lookup_integration_cards, hudu_kickoff_procedure, hudu_upsert_magic_dash_item) are still predictable and follow the same verb-first style.
At 70 tools, the server is extremely large. Even accounting for the broad Hudu domain, the surface is overwhelming and includes many repetitive CRUD pairs. This far exceeds the comfortable range and will likely cause navigation and selection overhead for agents.
The server covers many entity types, but there are significant dead ends: no delete tools for any resource (despite references to them in archive descriptions), no password-reveal tool (explicitly said to exist), and no relation delete (needed to change a relation). Agents performing common operations like deletion or secret retrieval will fail.
Maintenance
Related MCP Connectors
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Find, write, publish and check pages and API references in your DeveloperHub docs from an AI client
Connect AI agents to 1000+ apps with managed authentication and tool-calling.
Enables AI assistants to retrieve event data and execute event management operations in Nunify.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables interaction with HUDU technical documentation and customer management platform through API integration. Supports retrieving company information, searching knowledge base articles, and managing assets and credentials.8MIT
- FlicenseCqualityDmaintenanceEnables Claude to interact with Hudu IT documentation, including searching, reading, creating, and updating articles, assets, passwords, companies, and more.100-
- AlicenseNot gradedqualityBmaintenanceConnects AI assistants to Hudu IT documentation platform with 43 tools, Markdown output, and multi-tenant support for MSPs.3MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to work directly with ConnectWise Manage through natural conversation, offering tools to search and update tickets, log time, manage companies, contacts, projects, and more across cloud and self-hosted instances.Apache 2.0