Ams360 Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Ams360 Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Vertafore AMS360 WSAPI v3, implemented in TypeScript with @modelcontextprotocol/sdk and a real SOAP 1.1 client for AMS360's WCF endpoint.
This server exposes the following MCP tools:
search_clients(query)get_client(clientId)get_policies(clientId)get_renewals(startDate, endDate)get_activities(filter)Under the hood it uses the public AMS360 WSAPI v3 contract:
Login to establish a sessionCustomerGetByIdCustomerGetByNumberCustomerGetListByNamePrefixPolicyGetPolicyGetListByCustomerIdPolicyGetListByCustomerNumberPolicyGetListByPolicyNumberCustomerSuspenseGetListByCustomerIdCommonSuspenseGetListByEntityIdPersonalNoteGetListLineOfBusinessGetByCodeThe public Vertafore AMS360 WSAPI v3 docs currently describe a single SOAP endpoint:
https://wsapi.ams360.com/v3/WSAPIService.svcAuthentication is not plain REST-style auth. The documented flow is:
Login with AgencyNo, LoginId, Password, and optionally EmployeeCode.WSAPISession SOAP header from the login response.WSAPISession header with subsequent requests.This server follows that flow and also supports optional HTTP Basic auth for agencies that place WSAPI behind an additional HTTPS auth layer.
Two of the requested concepts are not fully exposed by the current public WSAPI v3 surface:
CustomerActivityInsert and CommonActivityInsert, but not an activity-list retrieval operation.Because of that:
get_activities is implemented against the retrievable WSAPI entities that agencies commonly use for reminders: customer suspenses, common suspenses, and personal notes.get_renewals returns a structured docs-based limitation message instead of pretending a complete renewal feed exists when it does not.npm install
npm run buildTo run directly from source during development:
npm run devTo run the compiled server:
npm startSet these environment variables:
export AMS360_AGENCY_NO="YOUR_AGENCY_NO"
export AMS360_USERNAME="YOUR_WSAPI_LOGIN_ID"
export AMS360_PASSWORD="YOUR_WSAPI_PASSWORD"
export AMS360_ENDPOINT_URL="https://wsapi.ams360.com/v3/WSAPIService.svc"Optional variables:
export AMS360_EMPLOYEE_CODE="ABC"
export AMS360_TIMEOUT_MS="30000"
export AMS360_POLICY_DETAIL_LIMIT="25"
export AMS360_DEBUG="false"Optional HTTP Basic auth, if your agency front-ends WSAPI with another auth layer:
export AMS360_HTTP_AUTH_MODE="basic"
export AMS360_HTTP_USERNAME="basic-auth-user"
export AMS360_HTTP_PASSWORD="basic-auth-password"Aliases supported by this server:
AMS360_AGENCY_URL as an alias for AMS360_ENDPOINT_URLAMS360_LOGIN_ID as an alias for AMS360_USERNAMEAdd the server to claude_desktop_config.json:
{
"mcpServers": {
"ams360": {
"command": "node",
"args": [
"/absolute/path/to/ams360-mcp-server/dist/index.js"
],
"env": {
"AMS360_AGENCY_NO": "YOUR_AGENCY_NO",
"AMS360_USERNAME": "YOUR_WSAPI_LOGIN_ID",
"AMS360_PASSWORD": "YOUR_WSAPI_PASSWORD",
"AMS360_ENDPOINT_URL": "https://wsapi.ams360.com/v3/WSAPIService.svc"
}
}
}
}If you want Claude Desktop to launch it from the package directory instead:
{
"mcpServers": {
"ams360": {
"command": "npx",
"args": [
"tsx",
"/absolute/path/to/ams360-mcp-server/src/index.ts"
],
"env": {
"AMS360_AGENCY_NO": "YOUR_AGENCY_NO",
"AMS360_USERNAME": "YOUR_WSAPI_LOGIN_ID",
"AMS360_PASSWORD": "YOUR_WSAPI_PASSWORD"
}
}
}
}Add the same server definition to .claude.json:
{
"mcpServers": {
"ams360": {
"command": "node",
"args": [
"/absolute/path/to/ams360-mcp-server/dist/index.js"
],
"env": {
"AMS360_AGENCY_NO": "YOUR_AGENCY_NO",
"AMS360_USERNAME": "YOUR_WSAPI_LOGIN_ID",
"AMS360_PASSWORD": "YOUR_WSAPI_PASSWORD",
"AMS360_ENDPOINT_URL": "https://wsapi.ams360.com/v3/WSAPIService.svc"
}
}
}
}search_clients(query)Best-effort search strategy:
CustomerGetByIdCustomerGetByNumberCustomerGetListByNamePrefixPolicyGetListByPolicyNumber, then hydrate matched customer recordsget_client(clientId)Fetches a full customer record by:
get_policies(clientId)Returns:
AMS360_POLICY_DETAIL_LIMIT policiesLineOfBusinessGetByCodeImportant:
PolicyGet detail is only fetched for the first AMS360_POLICY_DETAIL_LIMIT policies25detailHydrationTruncated and detailHydrationMessage when the detailed set is partialget_activities(filter)Supported filter routes:
{"customerId":"<guid>"} -> CustomerSuspenseGetListByCustomerId{"entityId":"<id>","entityType":<short>} -> CommonSuspenseGetListByEntityId{"source":"personalNotes","dateFrom":"2026-01-01","dateTo":"2026-01-31"} -> PersonalNoteGetListImportant:
source to "personalNotes" explicitlyget_renewals(startDate, endDate)Returns a structured limitation response explaining that the public WSAPI v3 docs do not expose a true agency-wide renewal date-range query. This is returned as a normal tool response, not a transport/tool failure.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.