{
  "markdown": "# saas-alerts-mcp\n\nModel Context Protocol server for [Kaseya SaaS Alerts](https://saasalerts.com/) — a SaaS security monitoring platform for M365 and Google Workspace events.\n\nPart of the [WYRE Technology MCP fleet](https://github.com/WYRE-AI).\n\n## Features\n\nExposes the full SaaS Alerts External Partner API (v0.20.0) through 30 MCP tools organized by domain:\n\n| Domain | Tools |\n|--------|-------|\n| **events** | Query/count security events by severity, customer, user, event type; advanced Elasticsearch queries; scroll pagination; recommended actions |\n| **customers** | List, get, create, update, delete customers; set IP/country and account whitelists |\n| **users** | MSP user info, partner users, customer users |\n| **devices** | Unify mapped/unmapped/ignored devices, device organizations |\n| **billing** | Billing details by date, billing date history |\n| **reports** | List/get/create/delete scheduled reports |\n| **partner** | Partner profile, branding settings |\n\nWrite/destructive tools require user confirmation via MCP elicitation (fail-open: proceeds if client doesn't support elicitation).\n\n## Authentication\n\nSaaS Alerts uses an API key sent as the `api_key` HTTP header.\n\nGenerate your API key in the SaaS Alerts UI under **Settings → API Keys**.\n\n### Local / stdio mode\n\n```bash\nexport SAAS_ALERTS_API_KEY=your-api-key\nnode dist/index.js\n```\n\n### HTTP mode\n\n```bash\nexport SAAS_ALERTS_API_KEY=your-api-key\nexport MCP_TRANSPORT=http\nexport MCP_HTTP_PORT=8080\nnode dist/http.js\n```\n\n### WYRE Gateway mode\n\nWhen running behind the WYRE MCP Gateway, set `AUTH_MODE=gateway`. The gateway injects the API key per-request via the `X-SaaS-Alerts-API-Key` header — no env var needed.\n\n## Running with Docker\n\n```bash\ndocker compose up\n```\n\nOr pull from GHCR:\n\n```bash\ndocker run -e SAAS_ALERTS_API_KEY=your-key \\\n  -e MCP_TRANSPORT=http \\\n  -p 8080:8080 \\\n  ghcr.io/wyre-ai/saas-alerts-mcp:latest\n```\n\n## Development\n\n```bash\nnpm install\nnpm run build\nnpm test\nnpm run lint\nnode scripts/lint-destructive-warnings.mjs src\n```\n\n## Destructive tool confirmation\n\nTools that permanently delete data (customer delete, scheduled report delete) carry:\n- `⚠ DESTRUCTIVE — IRREVERSIBLE` description prefix\n- `annotations.destructiveHint: true`\n- Elicitation confirmation guard (additive — proceeds if client doesn't support elicitation)\n\nAlways confirm with the user before invoking these tools.\n\n## License\n\nApache-2.0 — see [LICENSE](LICENSE).\n",
  "bytes": 2448,
  "sha": "d1e864299a29f8cfeaba069b4633589777220c7765c4892c2b98524608198563",
  "repo_slug": "wyre-technology/saas-alerts-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_wyre_technology_saas_alerts_mc_e5e49196/readme"
}