# Datto RMM MCP Server

A [Model Context Protocol](https://modelcontextprotocol.io) server for the [Datto RMM API v2](https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm), giving AI assistants full read/write access to devices, sites, alerts, audits, jobs, variables, filters, and activity logs.

Inspired by [wyre-technology/datto-rmm-mcp](https://github.com/wyre-technology/datto-rmm-mcp) (8 tools), this server covers the complete v2 API surface with **46 tools**, plus OAuth token caching, automatic 401 re-auth, and 429 rate-limit retry with backoff.

## Tools

### Account
| Tool | Description |
|---|---|
| `datto_get_account` | Account details |
| `datto_list_devices` | All devices, filterable by hostname, type, OS, site name, or filter ID |
| `datto_list_sites` | All sites, filterable by name |
| `datto_list_users` | Authentication users |
| `datto_list_components` | Automation components (for quick jobs) |
| `datto_list_dnet_site_mappings` | Datto Networking site mappings |
| `datto_list_account_variables` / `datto_create_account_variable` / `datto_update_account_variable` / `datto_delete_account_variable` | Account variable CRUD |

### Sites
| Tool | Description |
|---|---|
| `datto_get_site` | Site details with device counts |
| `datto_create_site` / `datto_update_site` | Create or update sites |
| `datto_list_site_devices` | Devices in a site |
| `datto_list_site_network_interfaces` | Device network interface info for a site |
| `datto_get_site_settings` | Site settings |
| `datto_list_site_filters` | Device filters visible for a site |
| `datto_set_site_proxy` / `datto_delete_site_proxy` | Site proxy management |
| `datto_list_site_variables` / `datto_create_site_variable` / `datto_update_site_variable` / `datto_delete_site_variable` | Site variable CRUD |

### Devices
| Tool | Description |
|---|---|
| `datto_get_device` / `datto_get_device_by_id` / `datto_get_device_by_mac` | Look up devices by UID, numeric ID, or MAC |
| `datto_run_quickjob` | Run a component on a device (with input variables) |
| `datto_move_device` | Move a device to another site |
| `datto_set_device_udf` | Set user-defined fields (udf1–udf30) |
| `datto_set_device_warranty` | Set warranty expiration date |

### Alerts
| Tool | Description |
|---|---|
| `datto_list_alerts` | Open/resolved alerts, scoped to account, site, or device |
| `datto_get_alert` | Single alert details |
| `datto_resolve_alert` | Resolve an alert |

### Audit
| Tool | Description |
|---|---|
| `datto_get_device_audit` | Full device audit (hardware, OS, network, patches) |
| `datto_get_device_software` | Installed software list |
| `datto_get_esxi_audit` / `datto_get_printer_audit` | ESXi host / printer audits |
| `datto_get_audit_by_mac` | Audit lookup by MAC address |

### Jobs
| Tool | Description |
|---|---|
| `datto_get_job` | Job status and details |
| `datto_get_job_components` | Job components |
| `datto_get_job_results` | Per-device job results |
| `datto_get_job_stdout` / `datto_get_job_stderr` | Job output streams |

### Other
| Tool | Description |
|---|---|
| `datto_list_filters` | Default or custom device filters |
| `datto_list_activity_logs` | Activity log search (date range, entities, free-text query) |
| `datto_get_system_info` | Platform status, pagination config, or current rate-limit usage |

## Setup

### 1. Get API credentials

In Datto RMM: **Setup > Users > [your user] > API keys**. Note your platform from your Datto RMM URL (e.g. `merlot.centrastage.net` → `merlot`).

### 2. Configure

Environment variables:

| Variable | Required | Description |
|---|---|---|
| `DATTO_API_KEY` | yes | API access key |
| `DATTO_API_SECRET` | yes | API secret key |
| `DATTO_PLATFORM` | yes* | One of `pinotage`, `merlot`, `concord`, `vidal`, `zinfandel`, `syrah` |
| `DATTO_API_URL` | no | Full base URL; overrides `DATTO_PLATFORM` |
| `MCP_TRANSPORT` | no | `stdio` (default) or `http` |
| `PORT` | no | HTTP port when `MCP_TRANSPORT=http` (default 3000) |

### 3. Run

```bash
npm install
npm run build
```

**Claude Desktop / Claude Code** (`claude_desktop_config.json` or `.mcp.json`):

```json
{
  "mcpServers": {
    "datto-rmm": {
      "command": "node",
      "args": ["/path/to/dattormm-mcp/dist/index.js"],
      "env": {
        "DATTO_API_KEY": "your-key",
        "DATTO_API_SECRET": "your-secret",
        "DATTO_PLATFORM": "merlot"
      }
    }
  }
}
```

**Docker (Streamable HTTP):**

```bash
docker build -t dattormm-mcp .
docker run -p 3000:3000 \
  -e DATTO_API_KEY=your-key \
  -e DATTO_API_SECRET=your-secret \
  -e DATTO_PLATFORM=merlot \
  -e MCP_TRANSPORT=http \
  dattormm-mcp
```

The HTTP transport runs stateless at `POST /` with a `GET /health` endpoint.

## Notes

- **Rate limits**: Datto allows 600 reads and 100 writes per 60 seconds. The client retries once on 429 honoring `Retry-After`; check live usage with `datto_get_system_info` (`request_rate`).
- **Pagination**: list endpoints return at most 250 records per page — responses include `pageDetails` with next-page info; pass `page`/`max` to the tools.
- **Auth**: OAuth tokens (100 h lifetime) are cached in-memory and transparently refreshed on expiry or 401.
- The `POST /v2/user/resetApiKeys` endpoint is intentionally not exposed — it would invalidate the credentials the server is running with.
- Alert mute/unmute endpoints are omitted: Datto removed alert muting in RMM 8.9.0.

## License

MIT