trmm-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TRMM_API_URL | Yes | Backend base URL | |
| TRMM_MCP_TLS | No | Set false to fall back to plain HTTP | true |
| TRMM_MCP_MODE | No | `readonly`, `elevate` or `command` | readonly |
| TRMM_CA_BUNDLE | No | CA for the self-signed origin cert | /opt/trmm-certs/fullchain.pem |
| TRMM_VERIFY_SSL | No | Set false only to disable verification outright | true |
| TRMM_MCP_LOG_DIR | No | Where events.jsonl and server.log live | ./logs |
| TRMM_HTTP_TIMEOUT | No | Connect/write timeout, seconds | 60 |
| TRMM_MCP_AUDIT_LOG | No | Mutation log path | ./command-audit.log |
| TRMM_MCP_HTTP_HOST | No | HTTP listener host | 127.0.0.1 |
| TRMM_MCP_HTTP_PATH | No | HTTP listener path | /mcp |
| TRMM_MCP_HTTP_PORT | No | HTTP listener port | 8770 |
| TRMM_MCP_LOG_LEVEL | No | Diagnostic verbosity | INFO |
| TRMM_MCP_STATE_DIR | No | Where grants are persisted | ./state |
| TRMM_MCP_TRANSPORT | No | `stdio` or `streamable-http` | stdio |
| TRMM_MCP_AUTH_TOKEN | No | Bearer token for HTTP authentication | |
| TRMM_MCP_PUBLIC_URL | No | Approval URL shown to the user | |
| TRMM_COMMAND_API_KEY | Yes | Key used for executions in `elevate` and `command` modes | |
| TRMM_MCP_PENDING_TTL | No | Seconds an unapproved request stays open | 600 |
| TRMM_READONLY_API_KEY | Yes | Key used in read-only mode | |
| TRMM_HTTP_READ_TIMEOUT | No | Read timeout — must exceed the longest tool timeout, since synchronous runs hold the connection open | 300 |
| TRMM_MCP_LOG_MAX_BYTES | No | Log rotation size | 10485760 |
| TRMM_MCP_BLOCK_PATTERNS | No | Refused command regexes | |
| TRMM_MCP_STATELESS_HTTP | No | Whether to use stateless HTTP | true |
| TRMM_MCP_AGENT_ALLOWLIST | No | Restrict execution targets | |
| TRMM_MCP_LOG_MAX_BACKUPS | No | Log rotation backups | 5 |
| TRMM_MCP_APPROVAL_SESSION | No | Approval-page session lifetime, seconds | 43200 |
| TRMM_MCP_LOG_PAYLOAD_CHARS | No | Per-payload cap; `-1` unlimited, `0` sizes only | 4000 |
| TRMM_MCP_MAX_GRANT_SECONDS | No | Ceiling on any approval window | 3600 |
| TRMM_MCP_MAX_RESPONSE_CHARS | No | Truncation cap per tool result | 60000 |
| TRMM_MCP_APPROVAL_TOTP_SECRET | No | Base32 TOTP secret; set by the same script | |
| TRMM_MCP_APPROVAL_MAX_ATTEMPTS | No | Failed sign-ins before lockout | 5 |
| TRMM_MCP_APPROVAL_PASSWORD_HASH | No | PBKDF2 hash; set by `setup_approval_auth.py` |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| trmm_fleet_overviewA | Fleet health summary: agent counts by status, plus the machines that are offline, need a reboot, have failing checks, or have pending patches. The best first call when hunting for problems. |
| trmm_list_agentsA | List agents with their status. Filter by client/site id, monitoring type (server/workstation), online state, or a hostname substring. |
| trmm_get_agentA | Full detail for one agent: hardware, OS, disks, uptime, checks and policies. Heavy sections (services, wmi_detail, graphics, timezone list) are omitted unless named in |
| trmm_agent_servicesA | Windows services on an agent. Filter by name substring or state (running/stopped) to avoid pulling the whole list, which is large. |
| trmm_agent_processesA | Live process list from an agent, sorted by memory or CPU. Requires the agent to be online. |
| trmm_agent_event_logB | Windows event log entries from an agent. log_type is Application, System or Security. Filter by level (error/warning/information) and an optional message substring. |
| trmm_agent_checksB | Checks configured on an agent, with their current status. |
| trmm_agent_historyA | Recent command and script runs on an agent, including their captured output. Use this to see what was already tried, or to retrieve output from an asynchronous script run. |
| trmm_agent_softwareC | Installed software inventory for an agent. |
| trmm_agent_windows_updatesC | Windows update status for an agent. |
| trmm_list_clients_sitesA | All clients and their sites, with ids for filtering. |
| trmm_list_alertsB | Current alerts. By default returns the newest unresolved ones. severity may include 'error', 'warning', 'info'. |
| trmm_list_scriptsA | List scripts available in TRMM. Returns each script's id, which is what trmm_run_script needs. |
| trmm_get_scriptA | Full detail for one script including its source code. Read this before running an unfamiliar script on a machine. |
| trmm_agent_tasksC | Automated tasks configured on an agent. |
| trmm_pending_actionsA | Pending actions (queued agent work such as reboots or patch installs). Omit |
| trmm_audit_logA | Audit log: who did what in TRMM. Filter by days, agent, or username. Useful for correlating a change with when a problem started. |
| trmm_debug_logC | TRMM server debug log entries. |
| trmm_server_infoA | TRMM server version, settings and this MCP server's current mode. |
| trmm_api_getA | Escape hatch: issue a raw GET against any TRMM API path and return the JSON, for data with no dedicated tool. Example paths: /clients/, /checks/, /automation/policies/, /core/customfields/, /accounts/. Always permitted, in both modes. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 20 tools
Each tool targets a clearly distinct resource or action: fleet overview, agent list, agent detail, services, processes, event log, checks, history, software, updates, tasks, clients/sites, alerts, scripts, pending actions, logs, and server info. Even the status-related tools (fleet_overview, list_alerts, pending_actions) are separated by scope and description.
All tools share the trmm_ prefix, but the convention after that is inconsistent: some use list_/get_ verbs, others use bare agent_* resource names, and trmm_api_get puts the verb at the end. The names are still readable and grouped by resource, but the pattern is not uniform.
At 20 tools this sits in the heavy range, though the RMM domain is broad and most tools cover a distinct resource type. Some agent read tools could potentially be consolidated, but the count is not unreasonable for the breadth of data exposed.
The read/diagnostic side is well covered: fleet health, agent inventory, processes, event logs, software, updates, scripts, alerts, and logs. However, the script lifecycle is incomplete because trmm_list_scripts explicitly references trmm_run_script, yet no run/create/update/delete script tool exists, and the management/action side of an RMM is largely absent aside from a GET-only API escape hatch.