cherwell-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cherwell-mcplist all open Priority 1 incidents assigned to me"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
cherwell-mcp
A Model Context Protocol server (stdio) for the Cherwell CSM REST API. It lets MCP clients (Claude Code, Claude Desktop, etc.) create, read, update, delete and search Cherwell business objects — Incidents, Problems, Changes, or any custom object.
Requirements
Node.js ≥ 20
A Cherwell REST API client key (created in CSM Administrator → Security → Edit REST API client settings)
A Cherwell user account the server will act as
Related MCP server: Azure DevOps MCP Server
Configuration
All configuration is provided via environment variables — no config files, no CLI flags:
Variable | Required | Description |
| yes | CSM host root, e.g. |
| yes | REST API client key |
| yes | Cherwell user login |
| yes | Cherwell user password |
| no |
|
| no | Per-request timeout in milliseconds, default |
The server exits with a descriptive error at startup if a required variable is missing.
Usage
Claude Code
claude mcp add cherwell \
--env CHERWELL_BASE_URL=https://csm.example.com \
--env CHERWELL_CLIENT_ID=<client-key> \
--env CHERWELL_USERNAME=<user> \
--env CHERWELL_PASSWORD=<password> \
-- npx -y cherwell-mcpClaude Desktop / generic MCP client
{
"mcpServers": {
"cherwell": {
"command": "npx",
"args": ["-y", "cherwell-mcp"],
"env": {
"CHERWELL_BASE_URL": "https://csm.example.com",
"CHERWELL_CLIENT_ID": "<client-key>",
"CHERWELL_USERNAME": "<user>",
"CHERWELL_PASSWORD": "<password>"
}
}
}
}Tools
Tool | Purpose |
| Discover business objects and their IDs ( |
| Field schema of an object (names, IDs, required flags) |
| Read one record by record ID or public ID |
| Create a record from a |
| Update selected fields of an existing record |
| Permanently delete a record |
| Filtered search with paging and field selection |
Everywhere a business object is expected, tools accept either its name (Incident) or its
32-character busObId. Fields are addressed by name or display name; the server resolves
them to Cherwell field IDs internally.
Example workflow
list_business_object_summaries→ findIncidentget_business_object_template(requiredOnly: true) → see mandatory fieldscreate_business_objectwith{"Description": "...", "Priority": "3", ...}search_business_objectswith[{"fieldName": "Status", "operator": "eq", "value": "New"}]update_business_object/delete_business_objectby the returnedbusObRecId
How it works
Authenticates with the OAuth password grant against
POST /CherwellAPI/token(auth_modeconfigurable). The token is cached and refreshed 10 minutes before expiry; a401triggers one automatic re-login + retry.Cherwell's in-band errors (HTTP 200 with
hasError: true) are surfaced as tool errors.Templates are cached per business object, so repeated saves/searches don't re-fetch schemas.
See ARCHITECTURE.md for the full design.
Development
npm install
npm run build # compile to dist/
npm start # run the compiled server (needs CHERWELL_* env vars)Security notes
Credentials live only in environment variables and are never included in tool output or logs.
The account's Cherwell permissions bound what the tools can do — use a least-privilege account.
delete_business_objectis irreversible; grant it deliberately.
License
MIT
Available Tools
7 toolscreate_business_objectA
Create a new business object record. Pass field values as a map of field name (or display name) to value. Use get_business_object_template with requiredOnly=true to see which fields are mandatory. Returns the new record's busObRecId and public ID.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | Field values, e.g. {"Description": "Printer is down", "Priority": "2"}. | |
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the return values (busObRecId and public ID) and that field keys may be either field names or display names, but says nothing about failure behavior, validation errors for unknown fields, permission requirements, or what happens when required fields are omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, zero filler, front-loaded with the action. Each sentence adds a distinct piece of information: purpose, how to pass fields, prerequisite lookup, and return contract.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter create tool with full schema coverage and no output schema, the description covers the essential contract: what it creates, how to shape the fields map, how to discover required fields via a sibling, and what identifiers come back. Only error/validation semantics are absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema: it clarifies that the fields map accepts either field names or display names, which the schema does not state, and names the concrete return identifiers. The businessObject parameter itself gets no extra explanation beyond the schema's own description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Create a new business object record') that immediately distinguishes it from siblings like update_business_object, delete_business_object, and search_business_objects. An agent can select it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete prerequisite workflow: call get_business_object_template with requiredOnly=true to learn which fields are mandatory before creating. It does not state when-not to use it (e.g. use update_business_object for existing records), but the create-vs-update split is implied by the verb and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_business_objectA
Permanently delete a business object record by its record ID (busObRecId). This cannot be undone.
| Name | Required | Description | Default |
|---|---|---|---|
| recId | Yes | Internal record ID (busObRecId) of the record. | |
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses irreversibility ('This cannot be undone'), which is important for a destructive operation, but says nothing about required permissions, whether related records cascade, or what is returned on success.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the operation and scope, ending with the irreversibility warning. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter, fully documented delete with no output schema, the description covers the essential action and the key risk (permanence). It is nearly complete, with only auth/cascade behavior and error semantics left unaddressed — meaningful for a destructive op with no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (recId and businessObject) are already documented in the schema, including the busObRecId naming and the object-name-or-id convention. The description restates the record-ID concept without adding format or validation detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Permanently delete a business object record') plus the identifying key (busObRecId), so the agent immediately knows what the tool does. The verb 'delete' cleanly separates it from the sibling set, which is otherwise all get/list/create/update/search tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use or when-not-to-use guidance, no mention of prerequisites, permissions, or alternatives such as update_business_object for reversible modifications. At best the destructive verb implies intent; it is not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_business_objectA
Read a single business object record with all its field values, addressed by record ID (busObRecId) or public ID (e.g. incident number). Provide exactly one of recId / publicId.
| Name | Required | Description | Default |
|---|---|---|---|
| recId | No | Internal record ID (busObRecId) of the record. | |
| publicId | No | Public ID of the record (e.g. incident number). | |
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a safe read and discloses that all field values are returned, which is useful, but says nothing about permissions, behavior when the ID is invalid, or record-not-found handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence that leads with the verb and resource, then the addressing options, then the exclusivity constraint. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-record read with no output schema, the description tells the agent what it gets back (all field values) and how to address the record. Adequate; only failure/permission behavior is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the description adds the mutual-exclusivity rule ('exactly one of recId / publicId') that the schema does not encode as oneOf/anyOf. That is genuine added meaning beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) plus resource (a single business object record) and the addressing schemes (busObRecId or public ID). The singular 'single record / addressed by ID' framing contrasts implicitly with list_business_object_summaries and search_business_objects, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied (fetch one record when you already have its ID) but never contrasted with siblings like search_business_objects or list_business_object_summaries. The one explicit rule — 'Provide exactly one of recId / publicId' — is a parameter constraint rather than a when-to-use statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_business_object_templateA
Get the field schema (template) of a business object: field IDs, names, display names and required flags. Use this to learn which fields exist before creating, updating or searching records.
| Name | Required | Description | Default |
|---|---|---|---|
| requiredOnly | No | If true, return only the fields required to create a record. | |
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full behavioral burden; it correctly conveys a read-only retrieval and specifies the returned structure. It does not disclose error behavior for an unknown businessObject, whether the name lookup is case-sensitive, or any auth/permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler: the return payload is front-loaded, followed by the motivating use case. Nothing repeats the name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, but the description compensates by listing the return fields, so an agent knows what a call yields. The remaining gap is failure/pagination behavior for an invalid object name, which is minor for a read-only lookup.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both businessObject and requiredOnly are fully documented in the schema itself. The description adds no syntax or format detail beyond that, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Get the field schema (template) of a business object") and enumerates exactly what that schema contains: field IDs, names, display names and required flags. This differentiates it from get_business_object, which would not return the field template.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this to learn which fields exist before creating, updating or searching records" gives a clear when-to-use context and implicitly ties the tool to the write/search siblings. It stops short of naming alternatives or stating when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_business_object_summariesA
List Cherwell business objects (names and busObIds). Use this to discover which objects exist and to find the busObId or exact name needed by the other tools.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | Which category of business objects to list. "Major" covers Incident, Problem, Change, etc. | Major |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the response contents (names and busObIds), which is useful since no output schema exists, and 'List' implies a safe read. It says nothing about permissions, pagination, or result size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the purpose and the returned fields front-loaded, followed by the intended usage. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully names the fields returned, and the single parameter is fully documented in the schema. As a read-only discovery tool the remaining gap (pagination, auth) is modest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the single 'type' parameter has an enum, a default, and an explanatory description. The tool description adds no parameter-level detail beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List Cherwell business objects') and names the returned fields (names and busObIds). It implicitly distinguishes itself from get/create/delete/update siblings by framing itself as a discovery operation, though it never names a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear use condition: discover which objects exist and obtain the busObId or exact name that other tools require. There is no explicit when-not guidance or named alternative, but the intended role in the workflow is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_business_objectsA
Search business object records with field filters. Filters on the SAME field are OR-ed together; filters on DIFFERENT fields are AND-ed (Cherwell semantics). Supports paging and an optional list of fields to return (defaults to all fields).
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Field names to include in results. Omit to return all fields. | |
| filters | Yes | One or more field filters. | |
| pageSize | No | ||
| pageNumber | No | ||
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the Cherwell AND/OR filter-combination semantics, paging support, and the default-all-fields return behavior, but says nothing about permissions, result-size implications, or the shape of returned results. Adequate but incomplete for an annotation-free tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences, front-loaded with the operation and immediately followed by the most error-prone detail (filter combination semantics). No filler, though the parenthetical '(Cherwell semantics)' is mildly redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter search tool with no output schema and no annotations, the description covers query construction and field selection but omits the returned result structure (e.g., whether total counts or paging metadata come back). The gaps are moderate rather than severe since the query semantics, the trickiest part, are covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 60%, and the description compensates well: it explains the AND/OR semantics of the filters array, which the schema does not convey, and notes that the fields list defaults to all fields. pageSize/pageNumber behavior is left to the schema, which documents defaults and bounds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: search business object records with field filters. This differentiates it from the CRUD siblings (get/create/update/delete_business_object), though it does not name an alternative explicitly. The core purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage through its filter semantics (OR within a field, AND across fields), which tells the agent how to build a query, but it never states when to prefer this tool over siblings like list_business_object_summaries or get_business_object. No when-not or exclusion guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_business_objectB
Update fields of an existing business object record, addressed by record ID (busObRecId) or public ID. Only the provided fields are changed. Provide exactly one of recId / publicId.
| Name | Required | Description | Default |
|---|---|---|---|
| recId | No | Internal record ID (busObRecId) of the record. | |
| fields | Yes | Field values to change, e.g. {"Status": "Resolved"}. | |
| publicId | No | Public ID of the record (e.g. incident number). | |
| businessObject | Yes | Business object name (e.g. "Incident") or its 32-character busObId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It valuably discloses partial-update semantics ('Only the provided fields are changed'), but says nothing about permission requirements, error behavior when neither/both IDs are supplied, or the effect of unknown field names. Meaningful but incomplete for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the action and addressing mechanism, then the partial-update rule and the ID exclusivity rule. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A mutation tool with no annotations and no output schema relies on the description, which covers addressing and partial-update behavior but omits permissions, failure modes, and return expectations. Adequate but with clear gaps for a write operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so baseline is 3, but the description contributes information the schema does not express: the mutual-exclusivity rule for recId/publicId (the schema has no oneOf). That added constraint meaningfully improves correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource ('Update fields of an existing business object record') and clarifies the addressing scheme (busObRecId or public ID). It's clear what the tool does, though it does not explicitly contrast itself with siblings like create_business_object or delete_business_object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use/when-not-to-use guidance and never names an alternative tool. The 'exactly one of recId / publicId' note is an argument constraint, not usage routing, so an agent must infer that this is the mutation counterpart to create/delete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
create_business_object - First observed
delete_business_object - First observed
get_business_object - First observed
get_business_object_template - First observed
list_business_object_summaries - First observed
search_business_objects - First observed
update_business_object
TDQS
Scored across 7 tools
Each tool targets a clearly distinct action: listing object types, reading one record, creating, deleting, getting schema, updating, and searching. The descriptions explicitly clarify boundaries, such as get_business_object_template for schema versus get_business_object for record data. No two tools appear interchangeable.
All tool names use snake_case and a consistent verb_noun pattern: list_, get_, create_, delete_, update_, search_. The minor extra suffixes (summaries, template) still follow the same predictable style.
Seven tools is well-scoped for a Cherwell business-object CRUD surface. Each tool covers a necessary operation without redundancy or bloat.
The set provides full lifecycle coverage for business object records: discovery, schema inspection, create, read, update, delete, and search. No obvious operational gap exists for the stated domain.
Maintenance
Related MCP Connectors
- OneOAuthai.withone
Search, document and execute authenticated API calls across 700+ apps via one MCP server
Query, browse, and automate OmegaAI workspaces from any MCP client. Streamable HTTP with OAuth 2.0.
Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.
Authenticated MCP server for ClearPolicy policy and compliance workflows.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables MCP clients to interact with Microsoft Dynamics 365 Business Central entities, providing tools to get schemas, list, create, update, and delete records.6MIT
- AlicenseNot gradedqualityDmaintenanceEnables reading and updating Azure DevOps work items, comments, metadata, and relations from an MCP-compatible client.884 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to access and manage Microsoft Dynamics 365 Business Central entities, such as creating sales orders, via a modern async MCP server.MIT
- FlicenseNot gradedqualityCmaintenanceEnables interaction with SAP Business One Service Layer through MCP, providing tools for querying entities, checking sessions, and executing OData requests with optional write protection.-