Skip to main content
Glama
mkyrpychnyk

cherwell-mcp

by mkyrpychnyk

cherwell-mcp

A Model Context Protocol server (stdio) for the Cherwell CSM REST API. It lets MCP clients (Claude Code, Claude Desktop, etc.) create, read, update, delete and search Cherwell business objects — Incidents, Problems, Changes, or any custom object.

Requirements

  • Node.js ≥ 20

  • A Cherwell REST API client key (created in CSM Administrator → Security → Edit REST API client settings)

  • A Cherwell user account the server will act as

Related MCP server: Azure DevOps MCP Server

Configuration

All configuration is provided via environment variables — no config files, no CLI flags:

Variable

Required

Description

CHERWELL_BASE_URL

yes

CSM host root, e.g. https://csm.example.com

CHERWELL_CLIENT_ID

yes

REST API client key

CHERWELL_USERNAME

yes

Cherwell user login

CHERWELL_PASSWORD

yes

Cherwell user password

CHERWELL_AUTH_MODE

no

internal (default), windows, ldap, or saml

CHERWELL_TIMEOUT_MS

no

Per-request timeout in milliseconds, default 30000

The server exits with a descriptive error at startup if a required variable is missing.

Usage

Claude Code

claude mcp add cherwell \
  --env CHERWELL_BASE_URL=https://csm.example.com \
  --env CHERWELL_CLIENT_ID=<client-key> \
  --env CHERWELL_USERNAME=<user> \
  --env CHERWELL_PASSWORD=<password> \
  -- npx -y cherwell-mcp

Claude Desktop / generic MCP client

{
  "mcpServers": {
    "cherwell": {
      "command": "npx",
      "args": ["-y", "cherwell-mcp"],
      "env": {
        "CHERWELL_BASE_URL": "https://csm.example.com",
        "CHERWELL_CLIENT_ID": "<client-key>",
        "CHERWELL_USERNAME": "<user>",
        "CHERWELL_PASSWORD": "<password>"
      }
    }
  }
}

Tools

Tool

Purpose

list_business_object_summaries

Discover business objects and their IDs (Major, Supporting, Lookup, Groups, All)

get_business_object_template

Field schema of an object (names, IDs, required flags)

get_business_object

Read one record by record ID or public ID

create_business_object

Create a record from a {fieldName: value} map

update_business_object

Update selected fields of an existing record

delete_business_object

Permanently delete a record

search_business_objects

Filtered search with paging and field selection

Everywhere a business object is expected, tools accept either its name (Incident) or its 32-character busObId. Fields are addressed by name or display name; the server resolves them to Cherwell field IDs internally.

Example workflow

  1. list_business_object_summaries → find Incident

  2. get_business_object_template (requiredOnly: true) → see mandatory fields

  3. create_business_object with {"Description": "...", "Priority": "3", ...}

  4. search_business_objects with [{"fieldName": "Status", "operator": "eq", "value": "New"}]

  5. update_business_object / delete_business_object by the returned busObRecId

How it works

  • Authenticates with the OAuth password grant against POST /CherwellAPI/token (auth_mode configurable). The token is cached and refreshed 10 minutes before expiry; a 401 triggers one automatic re-login + retry.

  • Cherwell's in-band errors (HTTP 200 with hasError: true) are surfaced as tool errors.

  • Templates are cached per business object, so repeated saves/searches don't re-fetch schemas.

See ARCHITECTURE.md for the full design.

Development

npm install
npm run build     # compile to dist/
npm start         # run the compiled server (needs CHERWELL_* env vars)

Security notes

  • Credentials live only in environment variables and are never included in tool output or logs.

  • The account's Cherwell permissions bound what the tools can do — use a least-privilege account.

  • delete_business_object is irreversible; grant it deliberately.

License

MIT

Available Tools

7 tools
create_business_objectA

Create a new business object record. Pass field values as a map of field name (or display name) to value. Use get_business_object_template with requiredOnly=true to see which fields are mandatory. Returns the new record's busObRecId and public ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
fieldsYesField values, e.g. {"Description": "Printer is down", "Priority": "2"}.
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It usefully discloses the return values (busObRecId and public ID) and that field keys may be either field names or display names, but says nothing about failure behavior, validation errors for unknown fields, permission requirements, or what happens when required fields are omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, zero filler, front-loaded with the action. Each sentence adds a distinct piece of information: purpose, how to pass fields, prerequisite lookup, and return contract.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter create tool with full schema coverage and no output schema, the description covers the essential contract: what it creates, how to shape the fields map, how to discover required fields via a sibling, and what identifiers come back. Only error/validation semantics are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema: it clarifies that the fields map accepts either field names or display names, which the schema does not state, and names the concrete return identifiers. The businessObject parameter itself gets no extra explanation beyond the schema's own description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Create a new business object record') that immediately distinguishes it from siblings like update_business_object, delete_business_object, and search_business_objects. An agent can select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete prerequisite workflow: call get_business_object_template with requiredOnly=true to learn which fields are mandatory before creating. It does not state when-not to use it (e.g. use update_business_object for existing records), but the create-vs-update split is implied by the verb and sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_business_objectA

Permanently delete a business object record by its record ID (busObRecId). This cannot be undone.

ParametersJSON Schema
NameRequiredDescriptionDefault
recIdYesInternal record ID (busObRecId) of the record.
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses irreversibility ('This cannot be undone'), which is important for a destructive operation, but says nothing about required permissions, whether related records cascade, or what is returned on success.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the operation and scope, ending with the irreversibility warning. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter, fully documented delete with no output schema, the description covers the essential action and the key risk (permanence). It is nearly complete, with only auth/cascade behavior and error semantics left unaddressed — meaningful for a destructive op with no annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (recId and businessObject) are already documented in the schema, including the busObRecId naming and the object-name-or-id convention. The description restates the record-ID concept without adding format or validation detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Permanently delete a business object record') plus the identifying key (busObRecId), so the agent immediately knows what the tool does. The verb 'delete' cleanly separates it from the sibling set, which is otherwise all get/list/create/update/search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use or when-not-to-use guidance, no mention of prerequisites, permissions, or alternatives such as update_business_object for reversible modifications. At best the destructive verb implies intent; it is not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_business_objectA

Read a single business object record with all its field values, addressed by record ID (busObRecId) or public ID (e.g. incident number). Provide exactly one of recId / publicId.

ParametersJSON Schema
NameRequiredDescriptionDefault
recIdNoInternal record ID (busObRecId) of the record.
publicIdNoPublic ID of the record (e.g. incident number).
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a safe read and discloses that all field values are returned, which is useful, but says nothing about permissions, behavior when the ID is invalid, or record-not-found handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence that leads with the verb and resource, then the addressing options, then the exclusivity constraint. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-record read with no output schema, the description tells the agent what it gets back (all field values) and how to address the record. Adequate; only failure/permission behavior is unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the description adds the mutual-exclusivity rule ('exactly one of recId / publicId') that the schema does not encode as oneOf/anyOf. That is genuine added meaning beyond the structured fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) plus resource (a single business object record) and the addressing schemes (busObRecId or public ID). The singular 'single record / addressed by ID' framing contrasts implicitly with list_business_object_summaries and search_business_objects, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied (fetch one record when you already have its ID) but never contrasted with siblings like search_business_objects or list_business_object_summaries. The one explicit rule — 'Provide exactly one of recId / publicId' — is a parameter constraint rather than a when-to-use statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_business_object_templateA

Get the field schema (template) of a business object: field IDs, names, display names and required flags. Use this to learn which fields exist before creating, updating or searching records.

ParametersJSON Schema
NameRequiredDescriptionDefault
requiredOnlyNoIf true, return only the fields required to create a record.
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations the description carries the full behavioral burden; it correctly conveys a read-only retrieval and specifies the returned structure. It does not disclose error behavior for an unknown businessObject, whether the name lookup is case-sensitive, or any auth/permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler: the return payload is front-loaded, followed by the motivating use case. Nothing repeats the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but the description compensates by listing the return fields, so an agent knows what a call yields. The remaining gap is failure/pagination behavior for an invalid object name, which is minor for a read-only lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both businessObject and requiredOnly are fully documented in the schema itself. The description adds no syntax or format detail beyond that, which is the expected baseline when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Get the field schema (template) of a business object") and enumerates exactly what that schema contains: field IDs, names, display names and required flags. This differentiates it from get_business_object, which would not return the field template.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use this to learn which fields exist before creating, updating or searching records" gives a clear when-to-use context and implicitly ties the tool to the write/search siblings. It stops short of naming alternatives or stating when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_business_object_summariesA

List Cherwell business objects (names and busObIds). Use this to discover which objects exist and to find the busObId or exact name needed by the other tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNoWhich category of business objects to list. "Major" covers Incident, Problem, Change, etc.Major

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the response contents (names and busObIds), which is useful since no output schema exists, and 'List' implies a safe read. It says nothing about permissions, pagination, or result size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the purpose and the returned fields front-loaded, followed by the intended usage. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully names the fields returned, and the single parameter is fully documented in the schema. As a read-only discovery tool the remaining gap (pagination, auth) is modest.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: the single 'type' parameter has an enum, a default, and an explanatory description. The tool description adds no parameter-level detail beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('List Cherwell business objects') and names the returned fields (names and busObIds). It implicitly distinguishes itself from get/create/delete/update siblings by framing itself as a discovery operation, though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear use condition: discover which objects exist and obtain the busObId or exact name that other tools require. There is no explicit when-not guidance or named alternative, but the intended role in the workflow is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_business_objectsA

Search business object records with field filters. Filters on the SAME field are OR-ed together; filters on DIFFERENT fields are AND-ed (Cherwell semantics). Supports paging and an optional list of fields to return (defaults to all fields).

ParametersJSON Schema
NameRequiredDescriptionDefault
fieldsNoField names to include in results. Omit to return all fields.
filtersYesOne or more field filters.
pageSizeNo
pageNumberNo
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the Cherwell AND/OR filter-combination semantics, paging support, and the default-all-fields return behavior, but says nothing about permissions, result-size implications, or the shape of returned results. Adequate but incomplete for an annotation-free tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences, front-loaded with the operation and immediately followed by the most error-prone detail (filter combination semantics). No filler, though the parenthetical '(Cherwell semantics)' is mildly redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter search tool with no output schema and no annotations, the description covers query construction and field selection but omits the returned result structure (e.g., whether total counts or paging metadata come back). The gaps are moderate rather than severe since the query semantics, the trickiest part, are covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 60%, and the description compensates well: it explains the AND/OR semantics of the filters array, which the schema does not convey, and notes that the fields list defaults to all fields. pageSize/pageNumber behavior is left to the schema, which documents defaults and bounds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: search business object records with field filters. This differentiates it from the CRUD siblings (get/create/update/delete_business_object), though it does not name an alternative explicitly. The core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through its filter semantics (OR within a field, AND across fields), which tells the agent how to build a query, but it never states when to prefer this tool over siblings like list_business_object_summaries or get_business_object. No when-not or exclusion guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_business_objectB

Update fields of an existing business object record, addressed by record ID (busObRecId) or public ID. Only the provided fields are changed. Provide exactly one of recId / publicId.

ParametersJSON Schema
NameRequiredDescriptionDefault
recIdNoInternal record ID (busObRecId) of the record.
fieldsYesField values to change, e.g. {"Status": "Resolved"}.
publicIdNoPublic ID of the record (e.g. incident number).
businessObjectYesBusiness object name (e.g. "Incident") or its 32-character busObId.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It valuably discloses partial-update semantics ('Only the provided fields are changed'), but says nothing about permission requirements, error behavior when neither/both IDs are supplied, or the effect of unknown field names. Meaningful but incomplete for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the action and addressing mechanism, then the partial-update rule and the ID exclusivity rule. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A mutation tool with no annotations and no output schema relies on the description, which covers addressing and partial-update behavior but omits permissions, failure modes, and return expectations. Adequate but with clear gaps for a write operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so baseline is 3, but the description contributes information the schema does not express: the mutual-exclusivity rule for recId/publicId (the schema has no oneOf). That added constraint meaningfully improves correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource ('Update fields of an existing business object record') and clarifies the addressing scheme (busObRecId or public ID). It's clear what the tool does, though it does not explicitly contrast itself with siblings like create_business_object or delete_business_object.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use/when-not-to-use guidance and never names an alternative tool. The 'exactly one of recId / publicId' note is an argument constraint, not usage routing, so an agent must infer that this is the mutation counterpart to create/delete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedcreate_business_object
    • First observeddelete_business_object
    • First observedget_business_object
    • First observedget_business_object_template
    • First observedlist_business_object_summaries
    • First observedsearch_business_objects
    • First observedupdate_business_object

TDQS

A4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a clearly distinct action: listing object types, reading one record, creating, deleting, getting schema, updating, and searching. The descriptions explicitly clarify boundaries, such as get_business_object_template for schema versus get_business_object for record data. No two tools appear interchangeable.

Naming Consistency5/5

All tool names use snake_case and a consistent verb_noun pattern: list_, get_, create_, delete_, update_, search_. The minor extra suffixes (summaries, template) still follow the same predictable style.

Tool Count5/5

Seven tools is well-scoped for a Cherwell business-object CRUD surface. Each tool covers a necessary operation without redundancy or bloat.

Completeness5/5

The set provides full lifecycle coverage for business object records: discovery, schema inspection, create, read, update, delete, and search. No obvious operational gap exists for the stated domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables MCP clients to access and manage Microsoft Dynamics 365 Business Central entities, such as creating sales orders, via a modern async MCP server.
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables interaction with SAP Business One Service Layer through MCP, providing tools for querying entities, checking sessions, and executing OData requests with optional write protection.
    -