Skip to main content
Glama

hudu-mcp

CI License: MIT

hudu-mcp is a community Model Context Protocol server for the Hudu IT documentation REST API. It exposes the documented v1 API — companies, assets, knowledge base articles, credential records, IPAM, racks, website monitors, relations, integrations, the audit trail and the export triggers — as 89 MCP tools, and it withholds stored passwords and TOTP secrets from every response unless an operator has explicitly turned that off. It is aimed at MSPs and internal IT teams who want an assistant that can read and maintain their Hudu tenant over a local stdio connection, using an API key they scope themselves.

Before you install this, look at Hudu's own MCP server

Hudu ships a first-party MCP server built into the product. It is served from your own instance at https://<your-instance>/mcp, it authenticates with Hudu OAuth rather than a long-lived API key, and it is enabled from Admin → External Apps → Model Context Protocol. Per Hudu's documentation it covers articles (create, read, update), activity logs (read) and assets (read only), and it deliberately excludes passwords, asset writes and deletions.

For a large number of people that is the better choice, and you should not install this project reflexively.

Hudu's MCP server

hudu-mcp (this project)

Maintained by

Hudu Technologies, Inc.

Zenix Solutions, community project

Where it runs

Inside your Hudu instance, at /mcp

A local process next to your MCP client

Transport

Remote HTTP, reachable from hosted clients

stdio only (see compatibility)

Authentication

Hudu OAuth, per user

A Hudu API key you create and scope

Enabled by

Admin → External Apps → Model Context Protocol

Installing and configuring this package

Articles

Create, read, update

Create, read, update, archive, delete

Assets

Read only

Full CRUD, plus archive and layouts

Activity log

Read

Read, and purge behind two gates

Passwords

Excluded entirely

Metadata by default; secrets and writes behind gates

Deletions

Excluded entirely

Behind HUDU_ALLOW_DESTRUCTIVE and confirm: true

IPAM, racks, websites, relations, matchers, exports

Not covered

Covered

Support

Hudu support

GitHub issues, best effort

Use Hudu's server if what you need is article and asset reading with some article authoring, if you want per-user OAuth rather than a shared API key, if you need a hosted client to reach it over HTTP, or if you want something you can raise a support ticket about. Its narrower surface is a design decision, not an omission: a server that cannot delete anything and cannot read a password has a much smaller worst case than this one.

Use hudu-mcp if you need the parts of the API Hudu's server does not cover — IPAM, racks, website monitors, relations, integration matchers, expirations, users, the audit trail — or if you need asset and password writes, or if you want capability gates you control from the environment rather than a fixed surface.

The two can coexist. Nothing here depends on Hudu's server being off.

Related MCP server: Hudu MCP Server

Quick start

Requires Node.js 20 or newer and a Hudu API key.

npx @zenixsolutions/hudu-mcp --version

Configure your MCP client to launch it over stdio. The block below is the standard shape and works in Claude Desktop, Claude Code and any other client that starts a local stdio server:

{
  "mcpServers": {
    "hudu": {
      "command": "npx",
      "args": ["-y", "@zenixsolutions/hudu-mcp"],
      "env": {
        "HUDU_BASE_URL": "https://hudu.example.com",
        "HUDU_API_KEY": "your-api-key",
        "HUDU_READ_ONLY": "1"
      }
    }
  }
}

That configuration registers 40 read tools and nothing that can change or delete anything. Drop HUDU_READ_ONLY when you want writes — that is 67 tools; see Security model before you do.

Verify a configuration without starting a session:

HUDU_BASE_URL=https://hudu.example.com HUDU_API_KEY=... npx @zenixsolutions/hudu-mcp --check
HUDU_BASE_URL=https://hudu.example.com HUDU_API_KEY=... npx @zenixsolutions/hudu-mcp --list-tools

--list-tools prints the tools that would be registered under the current environment, plus the ones being withheld and why. It is the fastest way to confirm a gate is set the way you think it is.

Longer walkthrough: docs/quickstart.md. Other install methods: docs/installation.md.

Getting an API key

Create the key in Hudu at Admin → Basic Information → API Keys.

Hudu's own API documentation lists five scoping options on a key:

  1. Access to passwords, covering all REST actions on them

  2. Ability to perform destructive actions, meaning DELETE

  3. Ability to perform exports

  4. Whitelisted IP addresses

  5. Company scopes

These options can only be configured when the key is created. They cannot be changed afterwards; a different scope means a new key. Create the key with the least this server needs and no more:

  • Leave password access off unless you intend to set HUDU_ALLOW_PASSWORD_REVEAL=1 or HUDU_ALLOW_PASSWORD_WRITE=1. Hudu's key scope covers all REST actions on passwords, so it does not separate reading a credential from writing one; the two gates in this server do.

  • Leave destructive actions off unless you intend to set HUDU_ALLOW_DESTRUCTIVE=1.

  • Leave export capability off unless you intend to set HUDU_ALLOW_EXPORTS=1.

  • Set the IP allowlist if the machine running this server has a stable address.

  • Set a company scope if the key only ever needs one customer.

A key created without password access is a harder boundary than any setting in this software. HUDU_ALLOW_PASSWORD_REVEAL is a decision made by the operator in an environment variable, and it is enforced by code in this repository — code that can have bugs, and that runs in the same process as a model reading attacker-influenced text. A key that Hudu will not let read /asset_passwords at all is enforced by Hudu, on the other side of the network, where nothing in this process can reach it. Prefer that boundary whenever you can live with it.

Hudu's API documentation notes that a key can be created and deleted at any time. Deleting the key is the fastest way to revoke this server's access.

Configuration

Everything is read from the environment. Nothing is read from disk, and no credential is accepted as a tool argument.

Variable

Default

What it does

HUDU_BASE_URL

required

Your Hudu instance origin, e.g. https://hudu.example.com. A trailing slash or a trailing /api/v1 is normalised away; the client adds /api/v1 itself.

HUDU_API_KEY

required

The key from Admin → Basic Information → API Keys. Sent as the x-api-key header.

HUDU_READ_ONLY

off

Register only Read tools. Nothing can create, update, archive, delete, export or purge. 40 tools instead of 67.

HUDU_ALLOW_DESTRUCTIVE

off

Register the 16 delete and purge tools, including the activity-log purge.

HUDU_ALLOW_PASSWORD_REVEAL

off

Register hudu_reveal_password, which returns one stored secret per call. Password metadata is available without it.

HUDU_ALLOW_PASSWORD_WRITE

off

Register hudu_create_password, hudu_update_password and hudu_archive_password. Also required, with HUDU_ALLOW_DESTRUCTIVE, by hudu_delete_password.

HUDU_ALLOW_EXPORTS

off

Register the two bulk export tools.

HUDU_RATE_LIMIT_PER_MINUTE

120

Client-side request ceiling. Must be a positive integer no greater than 300, which is the limit Hudu documents.

HUDU_MAX_CONCURRENCY

4

Simultaneous in-flight requests. Maximum 32.

HUDU_REQUEST_TIMEOUT_MS

30000

Per-request timeout in milliseconds. Maximum 600000.

HUDU_MAX_RETRIES

3

Retries for transient failures (timeouts, network errors, 429, 5xx), with full-jitter backoff. 0 to 10.

The five gates are booleans. 1, true, yes and on (any case, surrounding whitespace ignored) enable them; anything else, including an unset variable, leaves them off.

Setting HUDU_READ_ONLY and HUDU_ALLOW_DESTRUCTIVE together is rejected at startup with exit code 78 rather than silently resolved. Read-only would win, but the combination almost always means someone believes a delete is available when it is not.

Invalid configuration reports every problem at once and exits 78, so a misconfigured install is fixed in one pass rather than one variable per restart.

Security model

Read SECURITY.md for the reporting process and the full model, and docs/security.md for the threat model and residual risks. The short version:

Nothing permissive is on by default. Out of the box the server registers 67 tools: reads, creates, and updates that do not touch the credential vault. Deletions, password reveal, password writes and exports are all absent until an operator sets the matching variable. A gated tool is not registered at all rather than registered-and-refusing, because a tool a model cannot see is a tool it cannot be talked into calling.

Five gates, all environment-only. HUDU_READ_ONLY, HUDU_ALLOW_DESTRUCTIVE, HUDU_ALLOW_PASSWORD_REVEAL, HUDU_ALLOW_PASSWORD_WRITE and HUDU_ALLOW_EXPORTS are read in src/config.ts and nowhere else. There is no tool argument that enables, overrides or softens any of them.

Passwords are withheld because of how the Hudu API is shaped. The Asset_Password model lists password ("The actual password string") and otp_secret ("Secret key for one-time passwords") among its required properties, and GET /asset_passwords returns an array of that model (docs/reference/spec-defects.md A1). A single unfiltered list call therefore returns every credential and every TOTP seed the key can see. This server strips those two fields recursively from every tool result, centrally, in executeTool, renders Markdown from the stripped payload rather than the raw record, and scrubs the rendered text by value behind that. A withheld value comes back as null beside a password_redacted: true (or otp_secret_redacted: true) flag; a field that genuinely stores nothing comes back null with no flag, so "no credential on file" and "credential withheld from you" stay distinguishable. No field named password or otp_secret ever holds a string. The only exception is hudu_reveal_password, which needs HUDU_ALLOW_PASSWORD_REVEAL=1, an explicit confirm: true, and one specific record id. There is no bulk reveal.

Writing a credential is gated separately from reading one. HUDU_ALLOW_PASSWORD_WRITE registers hudu_create_password, hudu_update_password and hudu_archive_password, and combines with HUDU_ALLOW_DESTRUCTIVE on hudu_delete_password. It is a separate flag from the reveal gate on purpose: overwriting the only copy of a working credential is a real loss even though no secret leaves the building, and documenting a newly issued credential without being able to read existing ones is a legitimate posture. Neither gate opens the other. Until 0.2.0 nothing gated the write direction at all, which left a deployment able to overwrite or archive a credential it could not read.

Destructive work needs two independent keys. The operator's HUDU_ALLOW_DESTRUCTIVE decides whether the 16 destructive tools exist at all; the model's confirm: true argument then has to be supplied per call, with the impact stated in the tool description. These are not redundant, and they are not equal: confirm is supplied by the model, so it is a prompt-level speed bump. The environment flag is the gate a confused or manipulated agent cannot open. The same pair guards the two Admin-class export tools.

The API key's scope sits outside all of this and is the outermost boundary. See Getting an API key.

Tool surface

89 tools with every gate open, 67 with the defaults, 40 in read-only mode.

Resource group

Tools

Registered by default

In read-only mode

Companies

8

7

4

Assets

7

6

3

Asset layouts

4

4

2

Articles

6

5

2

Folders

5

4

2

Procedures

3

3

2

Passwords and password folders

9

4

4

Networks and IP addresses

10

8

4

Racks and rack items

10

8

4

Websites

5

4

2

Relations

3

2

1

Magic Dash

4

2

1

Matchers

3

2

1

Instance, users, audit trail, expirations

6

5

5

Files and photos

4

3

3

Exports

2

0

0

Total

89

67

40

The passwords row is the only one where the default and the read-only column match: the four tools that survive both are the two list tools and the two get tools. hudu_create_password, hudu_update_password and hudu_archive_password need HUDU_ALLOW_PASSWORD_WRITE, hudu_delete_password needs that and HUDU_ALLOW_DESTRUCTIVE, and hudu_reveal_password needs HUDU_ALLOW_PASSWORD_REVEAL.

By operation class: 41 Read, 13 Create, 17 Update, 16 Destructive, 2 Admin. hudu_reveal_password is classed Read because it does not modify Hudu, so it remains available in read-only mode when HUDU_ALLOW_PASSWORD_REVEAL is also set — read-only mode restricts writes, not disclosure.

MCP annotations are derived from the class rather than hand-set per tool. Read and Create carry destructiveHint: false; Update, Admin and Destructive carry destructiveHint: true. The protocol defines true as "may perform destructive updates" against false as "only additive", so an overwrite counts: a PUT replaces the prior value of every field it carries and this API offers no undo. Update also carries idempotentHint: true, which is a statement about replaying the same call, not about what the first one cost.

What a list tool returns

Every list tool returns an object with items plus these facts about them:

Field

Meaning

page, page_size

The page and size requested. page_size never changes to describe what came back.

count

The number of records in items, and nothing else.

page_was_full

The page came back full, so more records probably exist. Not a promise that they do.

next_page

The page to request next, or null.

pagination_supported

false when the endpoint documents no page parameter at all, so there is no further page to ask for.

pagination_note

Plain-language statement of what is and is not known. Regenerated if the response was truncated.

completeness_caveat

Present when the list is limited independently of paging — hudu_list_companies omits archived companies.

truncated

Present when this client cut records to fit its output budget.

records_on_page

Present alongside truncated: how many records the page held before the cut.

truncation_note

What was dropped and how to reach it.

There is deliberately no total and no has_more: no Hudu collection endpoint returns a count, so both would have to be invented. truncated, records_on_page and truncation_note are emitted before items, because clients clip long tool results and a correction printed below twenty-five kilobytes of records is not a correction.

Every tool, with its arguments and gates: docs/tool-reference.md. Task-oriented recipes: docs/user-guide.md.

Limitations

The Hudu v1 API cannot answer some questions that people reasonably expect it to, and this server reports those gaps rather than papering over them. The ones most likely to affect you:

  • No collection endpoint returns a total count — no total, no X-Total-Count, no Link header (C1). Ten collections wrap their array in a single-key envelope, but that envelope carries the array and nothing else, so it counts nothing either (F1). This server therefore emits neither total nor has_more. Read page_was_full and pagination_note, and never treat a full page as a complete list.

  • Five collections have no pagination at all — networks, IP addresses, racks, rack items and uploads (C2). They return everything matching your filters in one response, and if that response is trimmed to fit the output budget there is no next page to ask for. Where the endpoint also offers no narrow enough filter, the dropped records cannot be reached at all.

  • hudu_list_companies silently omits archived companies, and Hudu offers no parameter that includes them. On the measured instance 27 companies existed and the tool returned 22. hudu_get_company still reaches an archived company by id, and the list envelope carries a completeness_caveat saying so.

  • A rack storage item carries no rack id (C4), so hudu_list_rack_storage_items is instance-wide and cannot be grouped by cabinet. This is not the limitation it was once written up as: a rack's contents come back on the rack itself, as a per-unit front_items/rear_items elevation from hudu_get_rack_storage.

  • Exports can be started but never retrieved (C6). There is no status endpoint and no download URL in this API version.

  • File upload is not implemented (E1). The endpoints are multipart/form-data and the contract documents no request body for them.

  • A 403 is documented nowhere (A7), so a key-scope failure is hard to distinguish from a missing record.

The full list, with the evidence behind each item: docs/limitations.md.

Documentation

Document

Contents

docs/quickstart.md

Five minutes from nothing to a working tool call

docs/installation.md

npx, global install, from source, per-client configuration

docs/user-guide.md

MSP workflows, with the tool sequence for each

docs/tool-reference.md

All 89 tools: class, arguments, gates

docs/limitations.md

What this API cannot do, and why

docs/compatibility.md

Node versions, MCP protocol revisions, clients

docs/security.md

Threat model, controls, residual risks

docs/reference/spec-defects.md

Findings against the captured Hudu API contract

CHANGELOG.md

Release history

Contributing

See CONTRIBUTING.md. It states plainly which steps CI enforces and which are convention. Pre-1.0, the tool surface is not stable: a minor version may add, rename or remove tools.

Security reporting

Report vulnerabilities privately through GitHub Security Advisories, not as a public issue. See SECURITY.md.

Licence

MIT. See LICENSE.

Disclaimer

This project is not affiliated with, endorsed by, or supported by Hudu Technologies, Inc. "Hudu" is used nominatively, to identify the product this software interoperates with. Hudu is a trademark of its respective owner. For support of the Hudu platform itself, including its own MCP server, contact Hudu.

Available Tools

70 tools
hudu_archive_articleArchive or Restore ArticleA
Idempotent

Archive or unarchive a article. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.

This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.

Operation class: Update. Impact: Hides or restores this article. Reversible.

Inputs: id (required), archived (required).

hudu_archive_assetArchive or Restore AssetA
Idempotent

Archive or unarchive an asset. Archiving hides it from normal views and from the default listings without deleting anything, and is reversible by calling this tool again with archived: false. Archived assets are still readable through hudu_list_assets with archived: true.

Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.

This is the reversible alternative to hudu_delete_asset and should be preferred whenever the user wants a decommissioned machine "removed" without saying they want its documentation gone permanently.

Operation class: Update. Impact: Hides or restores this asset. Reversible.

Inputs: id (required), archived (required), company_id (required).

hudu_archive_companyArchive or Restore CompanyA
Idempotent

Archive or unarchive a company. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.

This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.

Operation class: Update. Impact: Hides or restores this company. Reversible.

Inputs: id (required), archived (required).

hudu_archive_passwordArchive or Restore PasswordA
Idempotent

Archive or unarchive a password. Archiving hides the record from normal views without deleting it, and is reversible by calling this tool again with archived: false.

This is the reversible alternative to deletion and should be preferred whenever the user wants something "removed" without saying they want it gone permanently.

Operation class: Update. Impact: Hides or restores this password. Reversible.

Inputs: id (required), archived (required).

hudu_create_articleCreate ArticleA

Create a new article in Hudu. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), content, folder_id, company_id, +1 more.

hudu_create_assetCreate AssetA

Create an asset inside a company. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.

Every asset belongs to exactly one company and there is no global create route, so company_id is required. Choose asset_layout_id before calling: the layout fixes which custom fields the asset can hold and Hudu will not infer one. hudu_list_asset_layouts lists the layouts and hudu_get_asset_layout shows the field labels a layout defines, which are the keys custom_fields expects.

Returns the created asset, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails, including when a custom field label does not exist on the chosen layout.

Operation class: Create.

Inputs: name (required), company_id (required), asset_layout_id (required), primary_mail, +4 more.

hudu_create_asset_layoutCreate Asset LayoutA

Create a new asset layout in Hudu. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), icon, color, fields, +6 more.

hudu_create_companyCreate CompanyA

Create a new company in Hudu. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), zip, city, notes, +11 more.

hudu_create_folderCreate FolderA

Create a new folder in Hudu. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), icon, company_id, description, +1 more.

hudu_create_ip_addressCreate IP AddressA

Create a new ip address in Hudu. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: address (required), fqdn, status, asset_id, +4 more.

hudu_create_networkCreate NetworkA

Create a new network in Hudu. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), address (required), company_id, description, +2 more.

hudu_create_passwordCreate PasswordA

Create a new password in Hudu. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), company_id (required), url, password, +9 more.

hudu_create_rack_storageCreate Rack StorageA

Create a new rack storage in Hudu. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: name (required), width, height, company_id, +4 more.

hudu_create_rack_storage_itemCreate Rack Storage ItemA

Create a new rack storage item in Hudu. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: side, status, asset_id, end_unit, +6 more.

hudu_create_relationCreate RelationA

Create a new relation in Hudu. A relation is a link between any two Hudu records — an asset to the password that opens it, an article to the company it documents — stored as a from/to pair of type-and-id. Hudu exposes no update route for relations, so changing one means deleting it and creating a replacement.

Returns the created record, including the id Hudu assigned. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create.

Inputs: toable_id (required), fromable_id (required), toable_type (required), fromable_type (required), +2 more.

hudu_create_websiteCreate Website MonitorA

Create a website monitor. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.

This is not a passive documentation record. From the moment it is created, the Hudu instance begins making repeated outbound requests to the host you name — HTTP polling plus TLS, WHOIS and DNS lookups — on Hudu's own schedule, and will raise alerts against the owning company when they fail. Point it only at hosts the customer actually owns or is contracted to watch, and use disable_ssl, disable_whois and disable_dns to turn off individual checks that would only produce noise. paused: true creates the record with every check dormant.

Hudu publishes no success response for this endpoint, so the created record may come back empty even though the write succeeded. When that happens this tool returns website: null — confirm with hudu_list_websites filtered by name rather than retrying, which would create a second monitor. Hudu answers 422 with the offending field named when validation fails.

Operation class: Create. Impact: Starts recurring outbound monitoring of an external host from the Hudu instance, and arms the alerts that go with it.

Inputs: name (required), notes, paused, company_id, +3 more.

hudu_find_company_by_integrationFind Company by Integration IdentifierA
Read-onlyIdempotent

Resolve a company in a connected integration (a PSA, RMM or similar) to its Hudu company record.

Use this when you arrive from another system holding that system's customer id rather than a Hudu id — for example a ticket that names its own account identifier. If you only have a customer name, use hudu_list_companies with search instead.

Operation class: Read.

Inputs: integration_slug (required), integration_id, response_format, integration_identifier.

hudu_get_api_infoGet Hudu API InfoA
Read-onlyIdempotent

Report the version and build date of the Hudu instance this server is pointed at. Returns version and date, nothing else.

Call this first whenever something behaves unexpectedly. The Hudu API changes between releases: several endpoints exist only on newer builds, and an older instance answers 404 for them — which is the same 404 it returns for a record that does not exist, so the two are indistinguishable without knowing the version. It is also the fastest way to confirm the base URL and API key are working at all, since it needs no ids and no permissions beyond a valid key.

Operation class: Read.

Inputs: response_format.

hudu_get_articleGet ArticleA
Read-onlyIdempotent

Fetch one article by its numeric id. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.

Use hudu_list_articles first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_assetGet AssetA
Read-onlyIdempotent

Fetch one asset with every value stored on it. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.

Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.

Layout-defined data comes back under fields: an array of {id, label, value, position} objects, one per field the layout defines. Read it here before any update, because a PUT replaces the values it is given.

Operation class: Read.

Inputs: id (required), company_id (required), response_format.

hudu_get_asset_layoutGet Asset LayoutA
Read-onlyIdempotent

Fetch one asset layout by its numeric id. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.

Use hudu_list_asset_layouts first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_companyGet CompanyA
Read-onlyIdempotent

Fetch one company by its numeric id. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.

Use hudu_list_companies first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_folderGet FolderA
Read-onlyIdempotent

Fetch one folder by its numeric id. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.

Use hudu_list_folders first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_ip_addressGet IP AddressA
Read-onlyIdempotent

Fetch one ip address by its numeric id. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.

Use hudu_list_ip_addresses first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_networkGet NetworkA
Read-onlyIdempotent

Fetch one network by its numeric id. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.

Use hudu_list_networks first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_passwordGet PasswordA
Read-onlyIdempotent

Fetch one password by its numeric id. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.

Use hudu_list_passwords first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_password_folderGet Password FolderA
Read-onlyIdempotent

Fetch one password folder by its numeric id. A folder that groups password records within a company. Folders in Hudu can also carry their own access restrictions, so which folder a credential sits in affects who can see it.

Use hudu_list_password_folders first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_procedureGet ProcedureA
Read-onlyIdempotent

Fetch one procedure by its numeric id. A procedure — called a Process in the Hudu interface — is an ordered checklist of tasks with a completion count, used for repeatable work such as onboarding, offboarding and server builds.

Use hudu_list_procedures first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_rack_storageGet Rack StorageA
Read-onlyIdempotent

Fetch one rack storage by its numeric id. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.

Use hudu_list_rack_storages first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_rack_storage_itemGet Rack Storage ItemA
Read-onlyIdempotent

Fetch one rack storage item by its numeric id. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.

Use hudu_list_rack_storage_items first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_uploadGet UploadA
Read-onlyIdempotent

Fetch one upload by its numeric id. An upload is a file attached to a Hudu record — an asset, website, procedure, password, company or article. Each carries a url, name, mime, size and the uploadable_type/uploadable_id pair naming what it is attached to.

Use hudu_list_uploads first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_userGet UserA
Read-onlyIdempotent

Fetch one user by its numeric id. A user is a person with access to Hudu: either a member of your own team, or a portal member belonging to one client company.

Use hudu_list_users first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_get_websiteGet WebsiteA
Read-onlyIdempotent

Fetch one website by its numeric id. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.

Use hudu_list_websites first if you only know a name — ids are not guessable, and Hudu answers 404 identically for a missing record and an unrouted path.

Operation class: Read.

Inputs: id (required), response_format.

hudu_kickoff_procedureStart a Process from a ProcedureA

Start a new process from an existing procedure. Hudu copies the procedure's task list into a new process record with its own id, slug and URL, and returns that new record. Afterwards the company has a live checklist that its users can work through and tick off; the procedure it came from is unchanged and can be kicked off again.

Attach the new process to an asset with asset_id when the work concerns one specific device or person — that is how an onboarding checklist ends up on the employee record it belongs to. Give it a name when several runs of the same procedure would otherwise be indistinguishable, e.g. "Onboarding — J. Okafor".

Find the procedure id with hudu_list_procedures. Both optional inputs are sent as query parameters because that is what Hudu documents for this endpoint; it accepts no request body. Success answers 200 rather than the 201 you might expect from a create, and 404 covers both a missing procedure and an unrouted path.

Operation class: Create. Impact: Creates a live process in Hudu, visible to the users of the company that owns the procedure and appearing in their process list as outstanding work.

Inputs: id (required), name, asset_id.

hudu_list_activity_logsList Activity LogsA
Read-onlyIdempotent

List activity logs in Hudu. The activity log is Hudu's audit trail: one entry per action, recording who did it, what they did it to, and when.

This is the tool for "who changed this, and when". Each entry carries user_id and user_email (the actor), resource_type and resource_id (what they touched), and an action_message describing the action.

Combine the filters to answer a real question rather than paging the whole log:

  • History of one record: resource_type plus resource_id together. Sending one without the other does nothing.

  • What one person did: user_id, or user_email if you only have the address.

  • A time window: start_date. There is no end-date filter, so a log is bounded at the start only; to look at "last week" specifically, set start_date to the beginning of that week and read forward.

  • One kind of action: action_message.

Entries are ordered by Hudu, not by this server, and no total count is returned — so to find the most recent change to a record, request a page and read it rather than assuming the first entry is newest.

Reading the log never alters it. Purging it is a separate tool, hudu_purge_activity_logs, and is destructive.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, fields, user_id, page_size, +6 more.

hudu_list_articlesList ArticlesA
Read-onlyIdempotent

List articles in Hudu. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.

Filter by company_id for one customer's knowledge base. Articles created without a company are global, and the API documents no filter that isolates those — request without company_id and select on a null company_id yourself.

enable_sharing: true returns only articles that currently have a public, unauthenticated share URL, which makes this the tool to answer "what of ours is exposed publicly?". draft: true returns unpublished work in progress.

Every record carries its full HTML content, which is large. Pass fields — for example ["id","name","company_id","folder_id","enable_sharing"] — when you are looking for an article rather than reading one, then fetch the body with hudu_get_article. Note also that no archived filter is documented, so archived articles cannot be selected for or against here.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, slug, draft, +7 more.

hudu_list_asset_layoutsList Asset LayoutsA
Read-onlyIdempotent

List asset layouts in Hudu. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.

Read this before writing any asset: the fields array on each layout gives the labels that hudu_create_asset and hudu_update_asset expect as custom_fields keys, in snake_case. This endpoint documents page but no page_size, so pages come back at the server's own size.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, slug, fields, +2 more.

hudu_list_assetsList AssetsA
Read-onlyIdempotent

List assets in Hudu. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.

This is the only route that reads assets across every company, and it is read-only: creating, updating, archiving and deleting an asset all happen under /companies/{company_id}/assets. Keep the company_id of any record you might write to — hudu_get_asset, hudu_create_asset, hudu_update_asset, hudu_archive_asset and hudu_delete_asset all require it, and it cannot be recovered from the asset id alone. If you narrow the response with fields, keep "company_id" in the list.

Custom field values come back under fields as {id, label, value, position} objects rather than as top-level keys. search is the right first filter for a hostname or a fragment of a name; id is how you turn a bare asset id into the company id needed to write to it.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: id, name, page, slug, +9 more.

hudu_list_companiesList CompaniesA
Read-onlyIdempotent

List companies in Hudu. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.

To find a company by name, prefer search (matches broadly) over name (matches the name field). If the API key was created with a company scope, only that company is visible here and everything else returns 404.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: city, name, page, slug, +10 more.

hudu_list_company_assetsList Assets for a CompanyA
Read-onlyIdempotent

List the assets belonging to one company. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.

This route accepts paging and the archived flag and nothing else. To filter by name, serial, layout or free text within a company, call hudu_list_assets with company_id set instead — it reaches the same records and supports the full filter set.

Returns an object with items plus pagination facts. Hudu returns no total count for any collection, so page_was_full is the only honest signal that more records exist.

Operation class: Read.

Inputs: company_id (required), page, fields, archived, +2 more.

hudu_list_expirationsList ExpirationsA
Read-onlyIdempotent

List expirations in Hudu. An expiration is a dated thing that will stop working: a domain registration, an SSL certificate, a hardware warranty, a date field on an asset, or an article review date.

This is the single call that answers "what is about to expire for this client". Hudu gathers expiry dates from across every module into one list, so you do not have to walk websites, then assets, then articles separately. Filter by company_id for one client and read the date field on each entry.

Each entry points at the thing that expires through expirationable_type and expirationable_id rather than embedding it — so once you have found the interesting entries, fetch the underlying record with the matching tool (hudu_get_website, hudu_get_asset, hudu_get_article) to get its name and details.

There is no date-range filter: Hudu returns the entries and this server passes them through unchanged, so compare date yourself rather than expecting the API to have narrowed to "the next 30 days". Entries are not filtered by whether they have already passed either — a date in the past means something has already expired.

Expirations are read-only through the API. To change one, edit the record that produced it: the website's expiry, the asset field's date, and so on.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, fields, page_size, company_id, +4 more.

hudu_list_foldersList FoldersA
Read-onlyIdempotent

List folders in Hudu. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.

These are article folders. Passwords are organised by a separate password_folders resource with its own tools; do not use these ids there.

The response is flat, not a tree — reconstruct the hierarchy yourself by following each folder's parent_folder_id, which is null at the top level.

On in_company, the API documents exactly one sentence: "When true, only returns company-specific KB articles." It says nothing about what false does, nor how it interacts with company_id. Read it as "restrict to company-scoped folders and exclude global ones", and check the returned company_id values rather than trusting that reading.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, fields, page_size, +3 more.

hudu_list_ip_addressesList IP AddressesA
Read-onlyIdempotent

List ip addresses in Hudu. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.

This endpoint documents neither page nor page_size, so there is no paging: the call returns everything matching your filters in a single response. If truncated comes back true the client cut records to stay inside its response budget, and because there is no next page the only ways to see the rest are narrower filters or a shorter fields list. That matters more here than anywhere else in this API: an unfiltered call against a large IPAM deployment returns every documented address in the instance, and a /16 that has been filled in can be tens of thousands of records. Always send a filter — network_id for one subnet, company_id for one customer, address or fqdn when you are chasing a single host.

address matches the stored text of one address, so it will not find every host in a subnet; use network_id for that. To go from an address to the machine, read asset_id and look it up with hudu_list_assets.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: fqdn, fields, status, address, +6 more.

hudu_list_magic_dash_itemsList Magic Dash ItemsA
Read-onlyIdempotent

List magic dash items in Hudu. A magic dash item is one of the coloured tiles across the top of a company page in Hudu — a title, a headline message, an optional shade and optional HTML detail. They are normally written by scripts and integrations to surface a live status ("Microsoft 365: 42 licences, 3 unassigned") next to the documentation.

The write endpoints identify the company by name, not by id — company_id is a read-side filter only, and there is no way to address a tile by company id when writing. The name has to match an existing Hudu company exactly. Take it from company_name on a listed item, or from name on the record hudu_list_companies returns.

There is no endpoint for fetching a single magic dash item, so this list is the only way to read one — filter by title and company_id to narrow to the tile you want and read its id and company_name from the result.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, title, fields, page_size, +2 more.

hudu_list_matchersList MatchersA
Read-onlyIdempotent

List matchers in Hudu. A matcher is one row in the mapping table between a connected integration (a PSA or RMM such as Autotask or ConnectWise) and Hudu's companies: it ties one customer record in that external system to one Hudu company, so synced data lands in the right place.

integration_id is required on every call here. It is the number in the address bar when you edit the integration in Hudu's admin UI (…/integrations/<integration_id>/edit); the API publishes no endpoint that lists integrations, so it has to come from the user or from a matcher you have already seen (integrator_id on the record).

The reason to call this is almost always matched: false, which returns the records the integration pulled in but could not tie to a Hudu company — the sync backlog someone has to work through. Each unmatched row carries the external name and, where Hudu guessed, a potential_company_id. Resolve them one at a time with hudu_update_matcher.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: integration_id (required), page, fields, matched, +5 more.

hudu_list_networksList NetworksA
Read-onlyIdempotent

List networks in Hudu. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.

This endpoint documents neither page nor page_size, so there is no paging: the call returns everything matching your filters in a single response. If truncated comes back true the client cut records to stay inside its response budget, and because there is no next page the only ways to see the rest are narrower filters or a shorter fields list.

Filter by company_id when you are working for one customer; instances that document every client hold networks for all of them here. address matches the stored CIDR text, so it finds a subnet you already know the notation of rather than telling you which network a given host falls in — Hudu does not offer containment search. To see what is allocated inside a network, call hudu_list_ip_addresses with network_id set.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, slug, fields, address, +6 more.

hudu_list_password_foldersList Password FoldersA
Read-onlyIdempotent

List password folders in Hudu. A folder that groups password records within a company. Folders in Hudu can also carry their own access restrictions, so which folder a credential sits in affects who can see it.

This API version exposes password folders as read-only — there is no create, update or delete endpoint for them. Folders are managed in the Hudu web interface.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, fields, search, +3 more.

hudu_list_passwordsList PasswordsA
Read-onlyIdempotent

List passwords in Hudu. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.

The secret value and any stored OTP seed are withheld from these results. Everything else — name, username, URL, company, folder, timestamps — is returned, which answers most questions ("does this client have a firewall admin credential documented, and when was it last rotated?") without exposing anything. To read an actual secret you need hudu_reveal_password, one record at a time, and the server operator must have enabled it.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, slug, fields, +6 more.

hudu_list_proceduresList ProceduresA
Read-onlyIdempotent

List procedures in Hudu. A procedure — called a Process in the Hudu interface — is an ordered checklist of tasks with a completion count, used for repeatable work such as onboarding, offboarding and server builds.

This API version exposes procedures read-only. There is no create, update or delete endpoint for them, so no such tool exists here and none is being withheld — process templates are authored in the Hudu web interface. The one write available is hudu_kickoff_procedure, which starts a new process from an existing template.

Results include both templates and processes already started from one: parent_procedure names the template a running process came from and is null on the template itself. total and completed count tasks, completion_percentage arrives as a string like "0%", and a non-null asset means the process is pinned to a specific device or person. For instructions that are read rather than worked through, look at articles instead (hudu_list_articles).

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, slug, fields, +3 more.

hudu_list_public_photosList Public PhotosA
Read-onlyIdempotent

List public photos in Hudu. A public photo is an image published at a public URL and attached to an article or an asset note, so it can be rendered inside that content.

Each entry gives the image url plus the record_type and record_id it belongs to. The URL is public: anyone holding it can fetch the image without authenticating, so treat these links as shareable-by-accident and do not paste them somewhere they will outlive the conversation.

There is no filter on this endpoint — page through and match record_id yourself to find the photos for one article.

Creating and re-pointing public photos needs multipart/form-data, which hudu-mcp 0.1.0 does not implement, so this list is the only public-photo operation available here. Use the Hudu web UI to add or change one.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, fields, page_size, response_format.

hudu_list_rack_storage_itemsList Rack Storage ItemsA
Read-onlyIdempotent

List rack storage items in Hudu. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.

Read this before answering a question about a specific rack: the API documents no way to list the items in one. The item schema has no rack field, and none of the filters scope to a rack — rack_storage_role_id filters by role, which is a classification, not the cabinet. The documented filters are role, asset, start_unit, end_unit, status, side and the two timestamps, all of them instance-wide. If you are asked what is in rack 12, say this API does not expose it rather than presenting an unscoped list as that rack's contents. It is worth reading one record with hudu_get_rack_storage_item to see whether your Hudu version returns a rack reference the published schema omits, but do not assume one is there.

To go the other way — from a device to where it is racked — filter by asset_id, which is the one filter that ties an item to something you can identify elsewhere in Hudu.

This endpoint documents neither page nor page_size, so this tool sends neither and Hudu answers with everything matching in one response. The envelope reports page_was_full: false and next_page: null accordingly — there is no second page to ask for, and what you get back is the complete set for the filters given. If the result comes back marked truncated, that is this server trimming the response to fit its output budget, not the end of the data; narrow the filters or use fields to see the rest.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: side, fields, status, asset_id, +6 more.

hudu_list_rack_storagesList Rack StoragesA
Read-onlyIdempotent

List rack storages in Hudu. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.

Filter by company_id for one customer's racks and location_id for one site. height, min_width and max_width filter on the rack dimensions, whose units the API never states — they are still usable for relative comparison against values already in the instance.

No name or free-text search filter is documented. To find a rack by name, list the company's racks and match the name field yourself.

This endpoint documents neither page nor page_size, so this tool sends neither and Hudu answers with everything matching in one response. The envelope reports page_was_full: false and next_page: null accordingly — there is no second page to ask for, and what you get back is the complete set for the filters given. If the result comes back marked truncated, that is this server trimming the response to fit its output budget, not the end of the data; narrow the filters or use fields to see the rest.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: fields, height, max_width, min_width, +5 more.

hudu_list_relationsList RelationsA
Read-onlyIdempotent

List relations in Hudu. A relation is a link between any two Hudu records — an asset to the password that opens it, an article to the company it documents — stored as a from/to pair of type-and-id. Hudu exposes no update route for relations, so changing one means deleting it and creating a replacement.

This endpoint takes no filters whatsoever — not by record, not by type, not by company. Finding the relations on one asset therefore means paging through the whole set and matching fromable_type/fromable_id (or the toable_ pair) yourself. Expect to see each link twice: creating a relation also creates its mirror in the opposite direction, and is_inverse: true marks the mirror copy. Use this list to read the exact fromable_type/toable_type strings your instance uses before creating one.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, fields, page_size, response_format.

hudu_list_uploadsList UploadsA
Read-onlyIdempotent

List uploads in Hudu. An upload is a file attached to a Hudu record — an asset, website, procedure, password, company or article. Each carries a url, name, mime, size and the uploadable_type/uploadable_id pair naming what it is attached to.

Hudu documents no filter and no pagination on this endpoint: it returns the uploads for the whole instance in one response, and there is no company_id or uploadable_id parameter to narrow it. On an instance with many attachments the response can be large and may be truncated by this server's output budget — check truncated before treating the list as complete. Filter client-side on uploadable_type and uploadable_id to find the attachments of one record.

This server cannot upload files. The Hudu upload endpoint takes multipart/form-data, which hudu-mcp 0.1.0 does not implement, so there is no create tool here and no way to add an attachment through this interface — tell the user to attach the file in the Hudu web UI. Do not claim a file was uploaded.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: fields, response_format.

hudu_list_usersList UsersA
Read-onlyIdempotent

List users in Hudu. A user is a person with access to Hudu: either a member of your own team, or a portal member belonging to one client company.

Always send at least one filter. search (first and last name), email and security_level narrow this to the person actually being asked about; calling it with no filter enumerates every account on the instance, which is rarely what the user meant and is exactly the shape of a reconnaissance sweep.

These records contain personal and security-relevant data — email, phone_number, last_sign_in_ip, last_sign_in_at, sign_in_count, currently_signed_in, otp_required_for_login and security_level. Answer the question that was asked and nothing more. Do not copy these fields into a Hudu article, a file, a ticket, a chat message or any other tool call; in particular, last_sign_in_ip and otp_required_for_login describe how an account can be attacked. Use fields to request only the columns you need.

Users cannot be created, changed or removed through the Hudu API — that is the web admin UI only.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: page, email, fields, search, +7 more.

hudu_list_websitesList WebsitesA
Read-onlyIdempotent

List websites in Hudu. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.

There is no company filter on this endpoint. To answer "what are we monitoring for Contoso?", list websites and match on company_id in the returned records, or try search. The monitoring state of each record is in monitoring_status ("up"/"down"), code (last HTTP status) and monitored_at (when it was last checked).

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Inputs: name, page, slug, fields, +4 more.

hudu_lookup_integration_cardsLook Up Integration CardsA
Read-onlyIdempotent

List the integration cards Hudu holds for a given external record. Cards are the link between a Hudu asset or company and its counterpart in a connected PSA or RMM, and they carry the synced fields shown on the record.

Use this to answer "what does Hudu know about this device from our RMM?" without opening the RMM itself.

Operation class: Read.

Inputs: integration_slug (required), integration_id, response_format, integration_identifier.

hudu_update_articleUpdate ArticleA
Idempotent

Update an existing article. An article is a knowledge-base document: HTML content, optionally filed in a folder and optionally scoped to one company. Articles with no company are global to the instance.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_article if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this article.

Inputs: id (required), name, content, folder_id, +2 more.

hudu_update_assetUpdate AssetA
Idempotent

Update an existing asset. An asset is any documented thing that belongs to a company — a server, a workstation, a firewall, a licence, a contact. The asset layout it was created from decides which custom fields it carries.

Assets are read globally but written per company. This tool needs the owning company id as well as the asset id, because Hudu exposes no /assets/{id} route. If you found the asset with hudu_list_assets, take company_id straight from that record; if all you have is an asset id, call hudu_list_assets with id set to it and read company_id off the result.

Only the arguments you supply are sent, but each one replaces the stored value outright — this is a PUT, not a merge. Read the asset with hudu_get_asset first whenever you intend to add to a field rather than overwrite it. The same applies to custom_fields: send the full label/value set you want the asset to end up with.

Operation class: Update. Impact: Overwrites the supplied fields on this asset with the values given.

Inputs: id (required), company_id (required), name, primary_mail, +5 more.

hudu_update_asset_layoutUpdate Asset LayoutA
Idempotent

Update an existing asset layout. An asset layout is the template behind an asset type: its icon and colour, whether its assets can hold passwords, photos, comments and files, and the set of custom fields every asset of that type carries. Layouts are instance-wide rather than per-company. Field definitions can be set when a layout is created; the documented shape for changing them afterwards contradicts the shape creation accepts, so this server does not expose field edits on update. There is no delete endpoint for layouts — set active: false to retire one.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_asset_layout if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this asset layout.

Inputs: id (required), icon, name, color, +7 more.

hudu_update_companyUpdate CompanyA
Idempotent

Update an existing company. A company is the top-level container in Hudu; every asset, article, password and website belongs to exactly one.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_company if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this company.

Inputs: id (required), zip, city, name, +12 more.

hudu_update_folderUpdate FolderA
Idempotent

Update an existing folder. A folder groups knowledge-base articles. Folders nest through parent_folder_id, and a folder carrying a company_id belongs to that company rather than to the global knowledge base.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_folder if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this folder.

Inputs: id (required), icon, name, company_id, +2 more.

hudu_update_ip_addressUpdate IP AddressA
Idempotent

Update an existing ip address. An ip_address record documents one address: its allocation status, its FQDN, the network it sits in and the asset it is configured on.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_ip_address if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this ip address.

Inputs: id (required), fqdn, status, address, +5 more.

hudu_update_matcherUpdate MatcherA
Idempotent

Point an integration record at a Hudu company, or correct which company it points at. A matcher is one row in the mapping table between a connected integration (a PSA or RMM such as Autotask or ConnectWise) and Hudu's companies: it ties one customer record in that external system to one Hudu company, so synced data lands in the right place.

This is how an unmatched record gets resolved, and it is the second half of a two-step job:

  1. Call hudu_list_matchers with the integration_id and matched: false to get the records the sync could not place. Each one gives you its id, the customer name as the external system spells it, and sometimes a potential_company_id that Hudu guessed at.

  2. Work out the right Hudu company — hudu_list_companies with search set to that name is the usual way — and call this tool with the matcher id and that company_id.

Matchers cannot be created through the API; they appear when an integration syncs. So this tool only ever edits rows that already exist, and a matcher id that returns 404 means the sync has not produced that record.

Only the fields you supply are sent, and each replaces the stored value outright.

Operation class: Update. Impact: Changes which Hudu company this integration record maps to, and therefore where future synced data from that record is filed.

Inputs: id (required), sync_id, company_id, identifier, +1 more.

hudu_update_networkUpdate NetworkA
Idempotent

Update an existing network. A network is one IP range documented in Hudu — a subnet in CIDR form, owned by a company, holding the individual ip_address records allocated inside it.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_network if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this network.

Inputs: id (required), name, address, company_id, +3 more.

hudu_update_passwordUpdate PasswordA
Idempotent

Update an existing password. A password record in Hudu — the credential vault entry for a company, optionally attached to a specific asset or website. Hudu calls these "AssetPassword" in the API and simply "Passwords" in its interface.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_password if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this password.

Inputs: id (required), url, name, password, +10 more.

hudu_update_rack_storageUpdate Rack StorageA
Idempotent

Update an existing rack storage. A rack storage is a physical rack — a cabinet in a server room — owned by a company and standing at a location, with a height, a width, a starting unit number and a maximum wattage. It is the container only: the equipment mounted in it is modelled separately as rack storage items, via the hudu_*_rack_storage_item tools.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_rack_storage if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this rack storage.

Inputs: id (required), name, width, height, +5 more.

hudu_update_rack_storage_itemUpdate Rack Storage ItemA
Idempotent

Update an existing rack storage item. A rack storage item is one thing mounted in a rack: it points at the Hudu asset it represents, occupies the units from start_unit to end_unit on one side of the rack, and carries its own power figures. The rack itself is a rack storage — use the hudu_*_rack_storage tools for the cabinet.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_rack_storage_item if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this rack storage item.

Inputs: id (required), side, status, asset_id, +7 more.

hudu_update_websiteUpdate WebsiteA
Idempotent

Update an existing website. A website in Hudu is a live monitor, not a documentation page: Hudu polls the host on a schedule and records its uptime, TLS certificate expiry, WHOIS registration and DNS records against the owning company.

Only the fields you supply are sent. Be aware that Hudu applies these as a PUT: for fields you do send, the new value replaces the old one outright — read the record first with hudu_get_website if you intend to append rather than overwrite.

Operation class: Update. Impact: Overwrites the supplied fields on this website.

Inputs: id (required), name, notes, paused, +4 more.

hudu_upsert_magic_dash_itemCreate or Replace Magic Dash ItemA
Idempotent

Create a magic dash tile, or replace the existing one with the same title on the same company. A magic dash item is one of the coloured tiles across the top of a company page in Hudu — a title, a headline message, an optional shade and optional HTML detail. They are normally written by scripts and integrations to surface a live status ("Microsoft 365: 42 licences, 3 unassigned") next to the documentation.

Read that first sentence carefully: this single endpoint does both. Hudu matches on title plus company_name, and if a tile with that pair already exists it is overwritten with what you send — no error, no warning, and no way to recover what it said before. Check hudu_list_magic_dash_items for the title on that company first whenever you are not deliberately refreshing a tile you own.

The replacement is wholesale rather than a merge: fields you omit are not carried over from the previous tile, so send the complete tile you want to end up with every time.

The write endpoints identify the company by name, not by id — company_id is a read-side filter only, and there is no way to address a tile by company id when writing. The name has to match an existing Hudu company exactly. Take it from company_name on a listed item, or from name on the record hudu_list_companies returns.

Operation class: Update. Impact: Overwrites any existing tile with the same title on the same company, wholesale and without confirmation. Creates a new tile only when no such pair exists.

Inputs: title (required), message (required), company_name (required), icon, +4 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.9/5.0

    Scored across 70 tools

    Disambiguation4/5

    Most tools follow a distinct resource+action pattern (list/get/create/update/archive per entity), making them easy to tell apart. A few overlaps exist, such as hudu_list_assets vs hudu_list_company_assets, and the large number of similar CRUD pairs could occasionally confuse an agent, but the descriptions consistently specify the resource and purpose.

    Naming Consistency5/5

    All tools use a consistent hudu_<verb>_<resource> snake_case convention. The few exceptions (hudu_find_company_by_integration, hudu_lookup_integration_cards, hudu_kickoff_procedure, hudu_upsert_magic_dash_item) are still predictable and follow the same verb-first style.

    Tool Count2/5

    At 70 tools, the server is extremely large. Even accounting for the broad Hudu domain, the surface is overwhelming and includes many repetitive CRUD pairs. This far exceeds the comfortable range and will likely cause navigation and selection overhead for agents.

    Completeness2/5

    The server covers many entity types, but there are significant dead ends: no delete tools for any resource (despite references to them in archive descriptions), no password-reveal tool (explicitly said to exist), and no relation delete (needed to change a relation). Agents performing common operations like deletion or secret retrieval will fail.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers