Avanan Legacy Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Avanan Legacy Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for the Avanan MSP SmartAPI (the "legacy" Avanan MSP tenant management API — distinct from avanan-mcp, which targets the Checkpoint Harmony Email & Collaboration HEC API).
Implements the Jan 2024 Avanan MSP SmartAPI Reference Guide:
| Group | Tools |
|---|---|
| Child MSPs | avanan_list_msp_partners, avanan_create_msp_partner, avanan_delete_msp_partner |
| MSP users | avanan_list_msp_users, avanan_get_msp_user, avanan_create_msp_user, avanan_update_msp_user, avanan_delete_msp_user |
| Customer tenants | avanan_list_tenants, avanan_get_tenant, avanan_create_tenant, avanan_delete_tenant |
| Licenses | avanan_list_licenses, avanan_list_addons, avanan_assign_license |
| Usage | avanan_get_monthly_usage, avanan_get_daily_usage |
| Env var | Required | Description | |||
|---|---|---|---|---|---|
AVANAN_APP_ID | yes | Application ID provided by Avanan Support (x-av-app-id). | |||
AVANAN_TOKEN | yes | Token from the Avanan auth handshake (x-av-token). | |||
AVANAN_SECRET | yes | Shared secret used to compute the x-av-sig HMAC. | |||
AVANAN_REGION | no | us \ | eu \ | ca \ | ap. Defaults to JWT region claim, then us. |
MCP_TRANSPORT | no | stdio (default) or http. | |||
MCP_HTTP_PORT | no | HTTP transport port (default 8080). | |||
LOG_LEVEL | no | debug \ | info \ | warn \ | error (default info). |
In gateway mode, credentials are taken per-request from headers: X-Avanan-App-Id, X-Avanan-Token, X-Avanan-Secret, optionally X-Avanan-Region.
[!IMPORTANT] Thex-av-sigsigning algorithm is implemented as a best-guess HMAC-SHA256 because the MSP SmartAPI guide defers signing details to the parent Avanan API Reference Guide. Replace the body ofsignRequest()insrc/utils/client.tswith the exact algorithm before production use. The function is isolated so no other code needs to change.
npm install
npm run build
npm start| Region | Base |
|---|---|
| US | https://smart-api-production-1-us.avanan.net |
| EU | https://smart-api-production-1-eu.avanan.net |
| CA | https://smart-api-production-1-ca.avanan.net |
| AP | https://smart-api-production-5-ap.avanan.net |
All endpoints sit under /v1.0/msp/....
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.