@wyre-ai/immybot-mcp

MCP server for ImmyBot - Windows endpoint management and software deployment automation.

Features

• 🔐 OAuth 2.0 Authentication - Microsoft Entra ID client credentials
• 🏢 Multi-tenant Support - Per-instance subdomain configuration
• 🧭 Decision Tree Navigation - Organized tool discovery by domain
• 💻 Comprehensive Coverage - Computers, software, deployments, scripts, tenants, maintenance sessions, tasks
• ⚡ Gateway Ready - Stateless per-request operation for WYRE MCP Gateway
• 🚀 Docker Deployment - Container-ready with health checks
• 📊 Structured Logging - Detailed operation tracking

Quick Start

Docker (Recommended)

The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass a real CONDUIT_S2S_SECRET. In gateway mode, ImmyBot credentials arrive on each request as headers; they are not read from the environment.

docker run -d \
  --name immybot-mcp \
  -p 127.0.0.1:8080:8080 \
  -e CONDUIT_S2S_SECRET \
  -e AUTH_MODE=gateway \
  -e MCP_TRANSPORT=http \
  -e MCP_HTTP_PORT=8080 \
  -e LOG_LEVEL=info \
  ghcr.io/wyre-ai/immybot-mcp:latest

Compose refuses to start when CONDUIT_S2S_SECRET is unset. The gateway service does not set IMMYBOT_* variables or env_file, so a project .env cannot inject static vendor credentials. It publishes 127.0.0.1:8080:8080:

# openssl rand -hex 32 — do not use a placeholder such as changeme
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up

Direct Installation

npm install @wyre-ai/immybot-mcp
npx @wyre-ai/immybot-mcp

Navigation

The server uses decision-tree navigation to organize tools by domain:

1. Start → immybot_navigate → Choose domain
2. Domain tools → Domain-specific operations
3. Return → immybot_back → Main navigation

Available Domains

• computers - Device and endpoint management
• software - Application and package management
• deployments - Software deployment configuration
• scripts - PowerShell script execution and management
• tenants - Client organization management
• maintenance_sessions - Device maintenance and state reconciliation
• tasks - Background operation monitoring

Authentication

ImmyBot uses OAuth 2.0 with Microsoft Entra ID:

Required Configuration

Setup Steps

1. Register Enterprise Application in Microsoft Entra ID
2. Grant ImmyBot API permissions to the application
3. Create client secret for the application
4. Configure application in ImmyBot settings

OAuth scope: api://{client_id}/.default

Usage Examples

1. Navigate to Computers Domain

// Start navigation
await callTool('immybot_navigate', { domain: 'computers' });

// List computers
await callTool('immybot_computers_list', { 
  tenantId: 1,
  isOnline: true 
});

// Get computer details
await callTool('immybot_computers_get', { computerId: 123 });

2. Software Management

// Navigate to software domain
await callTool('immybot_navigate', { domain: 'software' });

// Search for software
await callTool('immybot_software_search', { query: 'Chrome' });

// Install software (stages for maintenance session)
await callTool('immybot_software_install', {
  softwareId: 456,
  computerIds: [123, 124, 125],
  autoUpdate: true
});

3. Maintenance Sessions

// Navigate to maintenance sessions
await callTool('immybot_navigate', { domain: 'maintenance_sessions' });

// Start maintenance session (reconciles deployments)
await callTool('immybot_maintenance_sessions_start', {
  computerId: 123,
  sessionType: 'Manual'
});

// Check session status
await callTool('immybot_maintenance_sessions_get', { sessionId: 789 });

Two-Step Deployment Model

⚠️ Important: ImmyBot uses a two-step deployment workflow:

1. Configure desired state - Software installations create deployments
2. Reconcile via maintenance session - Sessions apply the desired state

// Step 1: Stage software installation
await callTool('immybot_software_install', {
  softwareId: 123,
  computerIds: [456]
});
// ↑ This creates a deployment, does NOT install immediately

// Step 2: Reconcile state
await callTool('immybot_maintenance_sessions_start', {
  computerId: 456
});
// ↑ This runs the maintenance session to actually install software

Environment Variables

Copy .env.example and set the variables below.

Gateway Mode (Docker)

/health stays unauthenticated and does not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

Direct Mode (CLI)

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 of the literal string t=<unix seconds> keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header is HTTP 401, before vendor credentials are read.

TS=$(date +%s)
SIG=$(printf 't=%s' "$TS" | openssl dgst -sha256 -hmac "$CONDUIT_S2S_SECRET" -hex | awk '{print $NF}')
curl -sS http://127.0.0.1:8080/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H "X-Gateway-S2S: t=${TS},v1=${SIG}" \
  -H 'X-ImmyBot-Instance-Subdomain: acmemsp' \
  -H 'X-ImmyBot-Tenant-Id: 12345678-1234-1234-1234-123456789abc' \
  -H 'X-ImmyBot-Client-Id: 87654321-4321-4321-4321-cba987654321' \
  -H 'X-ImmyBot-Client-Secret: your-client-secret' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

In AUTH_MODE=gateway, those four X-ImmyBot-* headers are required. A request missing any of them gets HTTP 401 and does not fall back to IMMYBOT_* in the process environment. Direct mode (AUTH_MODE unset) still requires a valid X-Gateway-S2S header, then uses the IMMYBOT_* environment variables. Direct mode does not read the X-ImmyBot-* headers.

Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning. A non-loopback MCP_HTTP_HOST (including the image default 0.0.0.0) makes startup exit. Do not publish that port off loopback.

MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm start

Tools Reference

Navigation Tools

Computers Tools

Software Tools

Error Handling

The server provides structured error responses:

{
  "content": [{"type": "text", "text": "Error: Authentication failed"}],
  "isError": true
}

Common error types:

• Authentication errors - Invalid credentials or expired tokens
• Not found errors - Resource doesn't exist
• Validation errors - Missing or invalid parameters
• Rate limit errors - Too many requests
• Server errors - Internal ImmyBot API issues

Development

Build from Source

git clone https://github.com/WYRE-AI/immybot-mcp.git
cd immybot-mcp
npm install
npm run build
npm start

Testing

npm test

Docker Build

docker build -t immybot-mcp --secret id=npmrc,src=$HOME/.npmrc .

The checked-in Compose file is gateway mode. It requires CONDUIT_S2S_SECRET and does not pass static IMMYBOT_* credentials.

Support

• ImmyBot API Documentation
• Microsoft Entra App Registration
• WYRE MCP Gateway

License

Apache-2.0 - see LICENSE for details.