SaaS Alerts MCP — Claude Code MCP server: setup and features
Connects Claude Code to SaaS Alerts APIs for cross-tenant incident triage and approval queue tracking. Useful for MSP teams managing tenant security from their terminal.
Open on GitHubWhat SaaS Alerts MCP does
This server bridges four SaaS Alerts interfaces: Reports, Manage, Respond, and Webhooks. Your coding assistant can sort security events across multiple client environments, inspect pending Respond approvals by deadline, and preview account containment steps prior to execution. The package is an independent community build without affiliation with Kaseya.
Setup delivers two binaries to your local bin path: the saas-alerts-cli utility and the saas-alerts-mcp server. Stdio transport is required. Avoid running the connector via --transport http even locally, because this build lacks request size caps and timeouts while holding active credentials to modify resources.
What it helps with
- triage security alerts across all customer tenants
- monitor the Respond approval backlog ordered by urgency
- preview account containment actions before taking action
- query SaaS Alerts APIs directly from the assistant prompt
Example prompts for the agent
- List pending Respond approvals sorted by their deadline
- Review recent SaaS Alerts triggers across all client tenants
- Preview containment actions for the compromised user account
How to install SaaS Alerts MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about SaaS Alerts MCP
How to install SaaS Alerts MCP in Claude Code?
Register the marketplace with /plugin marketplace add Servosity/msp-skills and run /plugin install saas-alerts@msp-skills. Alternatively, execute the official shell installer bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/saas-alerts/install.sh).
What does SaaS Alerts MCP do?
It interfaces with SaaS Alerts endpoints for Reports, Manage, Respond, and Webhooks. This allows your coding agent to inspect tenant events and handle approval workflows.
Why is HTTP transport restricted?
The current release does not enforce request size boundaries or timeout protections in --transport http mode. Use the default stdio transport to prevent security issues when using credentials.
