Skip to content

SELF-HOSTED MCP / AUTOTASK PSA

A controlled protocol boundary for Autotask.

ATEM runs in your Azure tenant, validates Microsoft Entra identities, and exposes a deliberately smaller MCP toolset to remote AI clients.

Microsoft 365 Copilot target: the hosted gateway works today; packaging and tenant-install guidance remain on the public roadmap. Read the integration notes.
Deploy to AzureTrace the request
[FRAME]hosted / m3650x01
# customer-hosted Azure Container Appatem serve --addr :8080 --toolset m365 --auth entraatem remote MCP listening on :8080POST /mcp      Streamable HTTP / JSON-RPCGET  /healthz  Container probe
SURFACE
9 hosted tools
IDENTITY
Entra profiles
LICENSE
AGPL-3.0
TRACE / 01Inspect the command surface
01COMMAND SURFACE

The hosted surface is small on purpose.

Nine tools cover the technician workflows that are safe to expose remotely. Local configuration, timers, aliases, and ticket closing stay outside the Microsoft 365 allowlist.

HOSTED
9 tools
POLICY
Profile-scoped

01A

Discover

Resolve Autotask ground truth before an agent proposes a write.

  • company_searchFind companies by name
  • contact_searchFind an active contact in one company
  • ticket_searchFind tickets by title and company
  • ticket_issue-typesResolve issue and sub-issue taxonomy
  • ticket_showFetch one ticket by ID

01B

Write

Create only through server-mapped identity and the same guarded handlers as the local runner.

  • contact_createCreate a company-scoped contact
  • ticket_createCreate and assign a classified ticket
  • time_addLog explicit clock windows separately

01C

Report

Build customer and project summaries directly from Autotask time-entry data.

  • reportAggregate entries and flag thin or large records

WRITE PREVIEW

Inspect the payload before Autotask changes.

Every mutating handler supports a dry-run path. It is available by contract; the calling agent still needs to request it.

local runner / preview
atem ticket create --company 0 --title "Review" --desc "What the work is about" --dry-run# previews the payload; performs no Autotask write
IDENTITY
Entra tenant and object IDs map to server-side Autotask resource and role IDs.
WRITE GUARD
Contact, ticket, and time writes share handlers with explicit dry-run support.
SCOPE
Each technician profile can reduce the hosted allowlist further.
02TRUST PATH

One request. Four explicit boundaries.

ATEM is not the agent and it is not the system of record. It is the narrow translation and policy layer between a remote MCP client and Autotask REST.

REQUEST RESPONSE

  1. TECHNICIAN

    Technician

    Intent owner

    Describes the work in plain language and reviews the proposed result.

    “Log 11–12 and 13–15 on ticket 121159.”

  2. NATURAL LANGUAGE

    MICROSOFT 365

    Copilot

    Target MCP client

    Selects a registered tool and acquires an Entra token outside ATEM.

    tools/call → time_add

  3. MCP + BEARER TOKEN

    CUSTOMER AZURE

    ATEM

    Policy boundary

    Validates identity, applies profile scope, then runs the registered handler.

    POST /mcp · toolset=m365

    ENTRA VALIDATION

    Audience · tenant ID · object ID · profile scopes

  4. AUTOTASK REST

    SYSTEM OF RECORD

    Autotask PSA

    Ground truth

    Receives REST reads and guarded writes using customer-managed credentials.

    REST API · ticket / time / contact

THREE RUNTIMES / ONE REGISTRY

01Hosted MCP
atem serve
Primary remote surface. Customer-hosted in Azure with the smaller m365 allowlist.
02Local MCP
atem mcp
Broad stdio surface for local agents, development, and fallback.
03JSON runner
atem <command>
Setup, smoke tests, support, and deterministic command debugging.
03DEPLOY

Deploy the gateway you can verify.

The supported hosted path is customer-operated Azure infrastructure. Copilot is the target client, but its installable package and complete tenant-publishing guide are still roadmap work.

Open Azure runbook
  1. 01

    Prepare access

    Collect the customer-owned accounts and identifiers ATEM needs before provisioning infrastructure.

    Review Autotask permissions
    • 01Autotask API-only user, secret, and integration code
    • 02Authenticated Azure CLI and GitHub CLI sessions
    • 03Entra tenant, API audience, and technician profile mapping
  2. 02

    Bootstrap Azure

    Provision Container Apps, ACR, Key Vault, and GitHub deployment OIDC with the idempotent bootstrap script.

    bootstrap azure
    ./scripts/azure/bootstrap.ps1 -SubscriptionId "<subscription-id>" -ResourceGroup "<resource-group>" -Location "<azure-region>" -AcrName "<acr-name>" -KeyVaultName "<vault-name>" -GitHubRepo "<owner>/<repo>"# creates or reuses the Azure resources and first image
  3. 03

    Wire identity

    Keep Autotask credentials and technician profiles in Key Vault, then run the hosted surface in Entra mode.

    wire identity
    ATEM_AUTH_MODE=entraATEM_ENTRA_TENANT_ID=<tenant-id>ATEM_ENTRA_AUDIENCE=<api-app-audience>ATEM_AUTH_PROFILES=<profile-json>
  4. 04

    Verify the boundary

    Check the container probe first, then validate authenticated tool discovery against the customer MCP endpoint.

    verify the boundary
    curl https://<container-app-fqdn>/healthz# then send an authenticated JSON-RPC request to POST /mcp# health alone does not verify Autotask credentials or Copilot packaging

INTEGRATION STATUS

Current capability, visible roadmap.

WORKS TODAY

  • Azure Container Apps deployment and GitHub OIDC
  • Entra bearer validation and technician profile scopes
  • Hosted m365 allowlist over the `/mcp` endpoint

NEXT MILESTONE

  • Copilot-facing API app registration and consent guide
  • Installable agent or plugin manifest
  • Tenant publishing, assignment, and support runbook
Inspect the open integration notes

LOCAL FALLBACK

Need the broad local surface?

Run the same registry over stdio for local agents and development.

local MCP / stdio
{ "mcpServers": { "atem": { "command": "atem", "args": ["mcp"] } } }