Use Claude or ChatGPT on your fleet, with the same locks
OpenRMM has its own MCP (Model Context Protocol) server. Any compatible assistant can query the fleet and propose actions, but it follows the technician's permissions and human approval, just like the console chat.
Three steps
The address is your instance's, with /mcp at the end. Cloud clients such as Claude on the web and ChatGPT use OAuth sign-in.
- Create the accessGenerate a token under Settings ▸ API tokens, or turn on OAuth sign-in so clients log in with username, password and 2FA.
- Add the server to your assistantEnter your instance's address and, if you use a token, the authorization header.
- Ask in plain languageThe assistant only sees the tools that the user's role allows.
Tokens for automation, sign-in for people
API token
One token per connector, shown only once. It can be tied to a user to inherit their scope, given an expiry date and revoked without affecting the others.
OAuth 2.1 sign-in
The person signs in with password and 2FA (or SSO) and authorizes the application. The client receives a short-lived, renewable token tied to that user. No fixed secret is pasted anywhere.
The outside AI gets no extra power
The MCP server uses the same tool catalog and the same checks as the console chat.
- Jobs are created "awaiting approval". Tasks, checks and policies are created disabled.
- Installing patches only works for those a person has already approved. There is no tool to approve.
- Moving or deleting machines becomes a proposal in the pending-operations queue.
- Access requires its own
mcp.usepermission, not an administrator token. - Optional IP allowlist and a limit of 60 calls per minute.
- An applications screen shows what is connected, so you can approve or revoke it.
Everything the console does, the API does too
OpenRMM is built "API first": the console itself uses the same API. Integrate with your PSA, billing or internal scripts using scoped tokens.
Clear limits
600 API calls per minute (adjustable when self-hosted) and a request body of up to 1 MiB.
Same audit trail
Token creation, proposals and approvals are written to the log, like any action in the console.
Good to know
- Claude on the web and ChatGPT connect over the internet, so the instance needs a public address with TLS. On Cloud that comes ready.
- These clients connect from dynamic IPs, so the IP allowlist does not apply to them. Use tokens with an expiry.
- Audit log search is only available to accounts without a scope restriction.
Connect your assistant in minutes.
On Cloud, the MCP address with TLS is already set up on your instance.