# SaaS Alerts MCP

Connects Claude Code to SaaS Alerts APIs for cross-tenant incident triage and approval queue tracking. Useful for MSP teams managing tenant security from their terminal.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 63
- Author: Servosity
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Servosity/msp-skills/tree/HEAD/skills/saas-alerts
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/saas-alerts-mcp

## What it does

This server bridges four SaaS Alerts interfaces: Reports, Manage, Respond, and Webhooks. Your coding assistant can sort security events across multiple client environments, inspect pending Respond approvals by deadline, and preview account containment steps prior to execution. The package is an independent community build without affiliation with Kaseya.

Setup delivers two binaries to your local bin path: the `saas-alerts-cli` utility and the `saas-alerts-mcp` server. Stdio transport is required. Avoid running the connector via `--transport http` even locally, because this build lacks request size caps and timeouts while holding active credentials to modify resources.

## Requirements
- Environment variables: `SAAS_ALERTS_BASE_URL`, `SAAS_ALERTS_API_KEY`, `SAAS_ALERTS_USER_AGENT`, `SAAS_ALERTS_MCP_READ_ONLY`, `SAAS_ALERTS_MCP_HTTP_TOKEN`, `PRINTING_PRESS_CLIENT_PROFILE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- triage security alerts across all customer tenants
- monitor the Respond approval backlog ordered by urgency
- preview account containment actions before taking action
- query SaaS Alerts APIs directly from the assistant prompt

## Example prompts
- List pending Respond approvals sorted by their deadline
- Review recent SaaS Alerts triggers across all client tenants
- Preview containment actions for the compromised user account

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

From the same set: [servosity/msp-skills](https://affpapa.org/en/nevibecode/by/servosity/msp-skills.md) — 73 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md