ImmyBot API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ImmyBot API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ImmyBot is a desired-state software deployment platform for Windows endpoints. You configure what should be installed at the tenant or computer level, then a maintenance session reconciles the live state to the desired state. The MCP surface mirrors that model — listing and configuring desired state is one set of tools; running and inspecting maintenance sessions is another.
ImmyBot uses Microsoft Entra ID (Azure AD) OAuth 2.0 client credentials. Four fields are required:
| Variable | Description |
|---|---|
IMMYBOT_INSTANCE_SUBDOMAIN | Your ImmyBot instance subdomain (e.g. acme for acme.immy.bot) |
IMMYBOT_TENANT_ID | Microsoft Entra tenant UUID |
IMMYBOT_CLIENT_ID | App registration client ID |
IMMYBOT_CLIENT_SECRET | App registration client secret |
The gateway exchanges these for a token automatically. Token cache is managed gateway-side; you should not need to think about token refresh.
| Tool | Purpose |
|---|---|
immybot_navigate | Discover available domains |
immybot_back | Pop back to the prior context |
immybot_status | Health/status check |
Tools follow immybot_<domain>_<action>. Domains:
computers - Enrolled Windows endpointssoftware - Software catalog (per-tenant + global)deployments - Desired-state assignments (the "what should be installed")scripts - PowerShell scripts and execution historytenants - MSP-level tenant scopingmaintenance_sessions - The reconciliation runs (active, paused, etc.)tasks - Lower-level work units inside sessionsThis is the most important concept in ImmyBot. Software does not get installed by a single API call. Instead:
immybot_deployments_create(or update an existing deployment) to assert: "Software X should be installed at version Y on this scope."
triggered via immybot_maintenance_sessions_start) and brings the endpoints in scope into compliance with the desired state.
If you skip step 2, nothing happens on the endpoint. If you skip step 1 and try to "install software directly," there is no API for that — the platform is desired-state by design.
The following tools mutate live customer infrastructure. Always confirm with a human before invoking:
immybot_scripts_run - Executes a PowerShell script on endpointsimmybot_deployments_trigger - Forces deployment evaluationimmybot_software_install - Triggers software install via desired stateimmybot_maintenance_sessions_start - Starts a reconciliation runFor all four, log who approved, the scope (computer / tenant), and the expected outcome before calling.
immybot_maintenance_sessions_start and similar tools return quickly with a session/task ID. Actual progress is observed by polling:
immybot_maintenance_sessions_get - Snapshot of one sessionimmybot_maintenance_sessions_logs - Log lines so farimmybot_maintenance_sessions_results - Final outcomeimmybot_tasks_get, immybot_tasks_logs - Lower-level task detailReasonable cadence: 10-15s while a session is running, stop once it reaches a terminal state.
| Status | Meaning | Action |
|---|---|---|
| 401 | Bad client credentials or expired token | Recheck the four creds; gateway refreshes tokens |
| 403 | App registration lacks the right ImmyBot permissions | Check ImmyBot RBAC for the app |
| 404 | Unknown computer / software / deployment | Re-list to confirm |
| 409 | Conflicting maintenance session already running | Wait or cancel the existing one |
| 429 | Rate limit | Back off and retry |
let maintenance reconcile.
immybot_tenants_get) andpivot down — never modify deployments without confirming the tenant.
immybot_maintenance_sessions_results after a sessionto see which endpoints succeeded vs failed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.