mcp-connectwise-psa 0.1.0 → 0.2.0

package/README.md

@@ -6,8 +6,7 @@ An MCP ([Model Context Protocol](https://modelcontextprotocol.io)) server for [C
 - **Time entries** — log time against tickets, review your own time
 - **Companies & contacts** — fast lookup (read-only)
 - **Configurations** — devices/assets with serials, IPs, OS, warranty (read-only)
-- **Role-based access control** — viewer / editor bearer tokens decide which tools a session sees
-- **Per-tech API keys (BYOK)** — techs supply their own ConnectWise member keys, so notes and time entries are attributed to the *actual person* in ConnectWise
+- **Per-tech API keys (BYOK)** — each tech supplies their own ConnectWise member keys; ConnectWise enforces that member's security role, and notes and time entries are attributed to the *actual person*
 - **Transports** — stdio for local use, streamable HTTP for shared deployments; Docker image included
 
 ## Quick start (local, stdio)
@@ -49,12 +48,10 @@ A `clientId` is required by the ConnectWise API — register a (free) integratio
 
 ```bash
 CW_SITE=… CW_COMPANY_ID=… CW_CLIENT_ID=… \
-MCP_TOKENS_VIEWER="alice:$(openssl rand -hex 32)" \
-MCP_TOKENS_EDITOR="bot:$(openssl rand -hex 32)" \
 node dist/index.js --transport http --port 3000
 ```
 
-Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:3000 -e CW_SITE -e CW_COMPANY_ID -e CW_CLIENT_ID -e MCP_TOKENS_VIEWER -e MCP_TOKENS_EDITOR mcp-connectwise-psa`
+Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:3000 -e CW_SITE -e CW_COMPANY_ID -e CW_CLIENT_ID mcp-connectwise-psa`
 
 | Route | Purpose |
 |---|---|
@@ -63,35 +60,29 @@ Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:300
 
 > Sessions are held in memory — run a single instance (or sticky sessions).
 
-## Access control
+## Access control — bring your own keys (BYOK)
 
-### Role tokens
+Over HTTP there is **no MCP-level role system**. Each session presents its own ConnectWise member API keys, and ConnectWise itself is the access control: the member's security role decides what succeeds, and every note and time entry is attributed to that member.
 
-```bash
-MCP_TOKENS_VIEWER="alice:tokA,bob:tokB"   # read-only tools
-MCP_TOKENS_EDITOR="helpdesk-bot:tokC"     # + create/update tickets, notes, time entries
-MCP_TOKENS_ADMIN="ops:tokD"               # reserved for future destructive tools
-```
-
-Clients send `Authorization: Bearer <token>`. Tools outside the role are not even registered for the session, a runtime guard re-checks every call, and session ids never carry privilege (each request re-authenticates; principal mismatch → 403). Labels appear in the audit log and allow per-person revocation. With no tokens configured the server runs in dev mode (full access + loud warning).
-
-### Bring your own keys (BYOK) — recommended for techs
+Send your keys on the initialize request (and on every subsequent request in the session):
 
-Send your own ConnectWise member API keys on the initialize request:
-
-```
+```http
 x-cw-public-key:  <public key>
 x-cw-private-key: <private key>
 x-cw-member-id:   <your member identifier>   (optional — enables "my tickets"/"my time")
 ```
 
-The session then acts as *you* in ConnectWise: your security role limits what succeeds, and every note and time entry is attributed to you. `CLIENT_CW_KEYS` controls the policy: `with-token` (default — a bearer token is still required), `open`, or `disabled`. Keys are never logged; sessions are bound to a SHA-256 hash of the pair.
+- A request with no keys is rejected with `401`; both key headers are required together.
+- Keys are never logged. A session is bound to a SHA-256 hash of the key pair; presenting a different pair on the same session id → `403`.
+- Create member API keys in ConnectWise under **My Account → API Keys**. Each tech uses their own.
 
-Token-only sessions use the server-wide `CW_PUBLIC_KEY`/`CW_PRIVATE_KEY` (use an integration API member with a conservative security role — its writes are attributed to that integration member).
+Local **stdio** is single-user and uses the `CW_PUBLIC_KEY`/`CW_PRIVATE_KEY` from the environment instead of headers.
 
 ## Tools
 
-| Tool | Tier |
+The full tool surface is always available; whether a write succeeds is governed by the member's ConnectWise security role.
+
+| Tool | Access |
 |---|---|
 | `cw_my_tickets`, `cw_search_tickets`, `cw_get_ticket` | read |
 | `cw_list_my_time` | read |
@@ -100,7 +91,7 @@ Token-only sessions use the server-wide `CW_PUBLIC_KEY`/`CW_PRIVATE_KEY` (use an
 | `cw_create_ticket`, `cw_update_ticket`, `cw_add_ticket_note` | write |
 | `cw_create_time_entry` | write |
 
-Viewer = read. Editor/Admin = read + write. No destructive (delete) tools in v1.
+No destructive (delete) tools in v1.
 
 ## Configuration reference
 
@@ -109,11 +100,9 @@ Viewer = read. Editor/Admin = read + write. No destructive (delete) tools in v1.
 | `CW_SITE` | — | ConnectWise host (cloud or on-prem; full URLs accepted) |
 | `CW_COMPANY_ID` | — | Login company id |
 | `CW_CLIENT_ID` | — | Integration clientId |
-| `CW_PUBLIC_KEY` / `CW_PRIVATE_KEY` | — | Server-wide API member keys (optional when BYOK is enabled) |
-| `CW_MEMBER_IDENTIFIER` | — | Member the server-wide keys belong to |
+| `CW_PUBLIC_KEY` / `CW_PRIVATE_KEY` | — | API member keys — required for stdio; unused on HTTP (BYOK) |
+| `CW_MEMBER_IDENTIFIER` | — | Member the stdio keys belong to (my-tickets/my-time) |
 | `TRANSPORT` / `PORT` | `stdio` / `3000` | Transport selection |
-| `CLIENT_CW_KEYS` | `with-token` | BYOK policy: `disabled`, `with-token`, `open` |
-| `MCP_TOKENS_VIEWER/EDITOR/ADMIN` | — | `label:token,label:token` per role |
 
 ## Notes & limits
 

package/dist/config.js

@@ -7,20 +7,18 @@
  *                         path are stripped.
  *   CW_COMPANY_ID         ConnectWise login company id (required)
  *   CW_CLIENT_ID          Integration clientId from developer.connectwise.com (required)
- *   CW_PUBLIC_KEY         Server-wide API member public key (optional — enables
- *   CW_PRIVATE_KEY        token-only sessions; omit to require per-tech keys)
- *   CW_MEMBER_IDENTIFIER  Member identifier the server-wide keys belong to
- *                         (enables "my tickets"/"my time" for token-only sessions)
+ *   CW_PUBLIC_KEY         API member public key — required for stdio; unused on
+ *   CW_PRIVATE_KEY        HTTP, where each session brings its own keys (BYOK)
+ *   CW_MEMBER_IDENTIFIER  Member the stdio keys belong to (enables
+ *                         "my tickets"/"my time")
  *   TRANSPORT             stdio | http (default: stdio)
  *   PORT                  HTTP port (default: 3000)
- *   CLIENT_CW_KEYS        disabled | with-token | open (default: with-token) —
- *                         whether HTTP clients may supply their own member API
- *                         keys via x-cw-public-key / x-cw-private-key headers
- *   MCP_TOKENS_VIEWER     Comma-separated label:token list for the viewer role
- *   MCP_TOKENS_EDITOR     Comma-separated label:token list for the editor role
- *   MCP_TOKENS_ADMIN      Comma-separated label:token list for the admin role
+ *
+ * Access model: stdio uses the server-wide keys above (single local user). HTTP
+ * sessions each bring their own member API keys (BYOK) via x-cw-public-key /
+ * x-cw-private-key headers; ConnectWise enforces that member's security role.
+ * There is no MCP-level role gating.
  */
-const CLIENT_KEY_MODES = ["disabled", "with-token", "open"];
 export class ConfigError extends Error {
 }
 function flagValue(argv, name) {
@@ -63,10 +61,6 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
     if (!clientId) {
         throw new ConfigError("CW_CLIENT_ID is required — register an integration at developer.connectwise.com");
     }
-    const clientKeyMode = (env.CLIENT_CW_KEYS || "with-token");
-    if (!CLIENT_KEY_MODES.includes(clientKeyMode)) {
-        throw new ConfigError(`Invalid CLIENT_CW_KEYS "${clientKeyMode}" — expected one of: ${CLIENT_KEY_MODES.join(", ")}`);
-    }
     const publicKey = env.CW_PUBLIC_KEY || undefined;
     const privateKey = env.CW_PRIVATE_KEY || undefined;
     if (!!publicKey !== !!privateKey) {
@@ -75,9 +69,6 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
     if (transport === "stdio" && !publicKey) {
         throw new ConfigError("CW_PUBLIC_KEY / CW_PRIVATE_KEY are required for stdio transport");
     }
-    if (transport === "http" && !publicKey && clientKeyMode === "disabled") {
-        throw new ConfigError("CW_PUBLIC_KEY / CW_PRIVATE_KEY are required when CLIENT_CW_KEYS=disabled — there are no keys the server could use");
-    }
     return {
         transport,
         port,
@@ -87,6 +78,5 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
         publicKey,
         privateKey,
         memberIdentifier: env.CW_MEMBER_IDENTIFIER || undefined,
-        clientKeyMode,
     };
 }

package/dist/http/app.js

@@ -1,27 +1,23 @@
 /**
  * HTTP transport: Express app exposing
  *
- *   POST/GET/DELETE /mcp    MCP streamable-http endpoint (auth + RBAC)
+ *   POST/GET/DELETE /mcp    MCP streamable-http endpoint (BYOK auth)
  *   GET  /health            liveness probe
  *
- * Authentication model:
- *  - Role tokens (Authorization: Bearer …) map to viewer/editor/admin and gate
- *    which tools a session gets, using the server-wide ConnectWise keys.
- *  - Bring-your-own-keys: x-cw-public-key + x-cw-private-key headers bind the
- *    session to that member's API keys with the FULL tool surface — the
- *    member's own ConnectWise security role is the access control, and writes
- *    (notes, time entries) are attributed to that member. Optional
- *    x-cw-member-id header names the member for "my tickets"/"my time".
- *    CLIENT_CW_KEYS controls the policy (with-token default / open / disabled).
+ * Authentication model — bring-your-own-keys only:
+ *  - Every session presents its own ConnectWise member API keys via the
+ *    x-cw-public-key + x-cw-private-key headers. Those keys are both the
+ *    credential and the permission model: ConnectWise enforces that member's
+ *    security role, and writes (notes, time entries) are attributed to that
+ *    member. Optional x-cw-member-id names the member for "my tickets"/"my time".
+ *  - The full tool surface is exposed; there is no MCP-level role gating.
  *  - A session id never carries privilege: every request re-authenticates and
- *    must present the same principal (role + label + key hash) the session was
- *    created with.
+ *    must present the same key pair (SHA-256 hash) the session was created with.
  */
 import { createHash, randomUUID } from "node:crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { authenticateToken, loadTokenEntries } from "../auth/tokens.js";
 import { createServer, SERVER_NAME, SERVER_VERSION } from "../server.js";
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 function rpcError(res, status, code, message) {
@@ -38,62 +34,30 @@ function headerValue(req, name) {
     return Array.isArray(value) ? value[0] : value;
 }
 /** Resolve the principal for a request. Exported for tests. */
-export function resolveAuth(req, config) {
-    const entries = loadTokenEntries();
-    const token = authenticateToken(req.headers.authorization, entries);
+export function resolveAuth(req) {
     const clientPublic = headerValue(req, "x-cw-public-key");
     const clientPrivate = headerValue(req, "x-cw-private-key");
     const clientMember = headerValue(req, "x-cw-member-id");
-    if (clientPublic || clientPrivate) {
-        if (config.clientKeyMode === "disabled") {
-            return unauthorized("Client-supplied ConnectWise keys are disabled on this server (CLIENT_CW_KEYS=disabled).");
-        }
-        if (!clientPublic || !clientPrivate) {
-            return unauthorized("Both x-cw-public-key and x-cw-private-key headers are required.");
-        }
-        const keyHash = sha256(`${clientPublic}:${clientPrivate}`);
-        const byokLabel = `byok:${keyHash.slice(0, 8)}`;
-        if (config.clientKeyMode === "with-token" && entries.length > 0 && !token) {
-            return unauthorized("A valid bearer token is required alongside your ConnectWise keys (CLIENT_CW_KEYS=with-token).");
-        }
-        const label = token ? `${token.label}+${byokLabel}` : byokLabel;
-        // BYOK sessions get the full tool surface; the member's own ConnectWise
-        // security role is the effective access control.
-        return {
-            ok: true,
-            role: "admin",
-            label,
-            credentials: {
-                publicKey: clientPublic,
-                privateKey: clientPrivate,
-                memberIdentifier: clientMember,
-            },
-            keyHash,
-        };
+    if (!clientPublic && !clientPrivate) {
+        return unauthorized("Supply your ConnectWise member API keys via the x-cw-public-key and x-cw-private-key headers.");
     }
-    const serverCredentials = config.publicKey && config.privateKey
-        ? {
-            publicKey: config.publicKey,
-            privateKey: config.privateKey,
-            memberIdentifier: config.memberIdentifier,
-        }
-        : null;
-    if (entries.length === 0) {
-        if (!serverCredentials) {
-            return unauthorized("No ConnectWise keys available — set CW_PUBLIC_KEY/CW_PRIVATE_KEY on the server or send x-cw-public-key/x-cw-private-key.");
-        }
-        return { ok: true, role: "admin", label: "dev-unauthenticated", credentials: serverCredentials, keyHash: null };
+    if (!clientPublic || !clientPrivate) {
+        return unauthorized("Both x-cw-public-key and x-cw-private-key headers are required.");
     }
-    if (!token) {
-        return unauthorized("Unauthorized: invalid or missing bearer token.");
-    }
-    if (!serverCredentials) {
-        return unauthorized("This server has no shared ConnectWise keys — supply your own via the x-cw-public-key/x-cw-private-key headers.");
-    }
-    return { ok: true, role: token.role, label: token.label, credentials: serverCredentials, keyHash: null };
+    const keyHash = sha256(`${clientPublic}:${clientPrivate}`);
+    return {
+        ok: true,
+        label: `byok:${keyHash.slice(0, 8)}`,
+        credentials: {
+            publicKey: clientPublic,
+            privateKey: clientPrivate,
+            memberIdentifier: clientMember,
+        },
+        keyHash,
+    };
 }
 function principalMatches(session, auth) {
-    return (session.role === auth.role && session.label === auth.label && session.keyHash === auth.keyHash);
+    return session.keyHash === auth.keyHash;
 }
 export function createApp(config) {
     const app = express();
@@ -104,7 +68,7 @@ export function createApp(config) {
     });
     app.post("/mcp", (req, res) => {
         void (async () => {
-            const auth = resolveAuth(req, config);
+            const auth = resolveAuth(req);
             if (!auth.ok)
                 return rpcError(res, auth.status, auth.code, auth.message);
             const sessionId = headerValue(req, "mcp-session-id");
@@ -126,11 +90,10 @@ export function createApp(config) {
                 onsessioninitialized: (newSessionId) => {
                     sessions.set(newSessionId, {
                         transport,
-                        role: auth.role,
                         label: auth.label,
                         keyHash: auth.keyHash,
                     });
-                    console.error(`[rbac] session ${newSessionId} created for ${auth.label} (${auth.role})`);
+                    console.error(`[auth] session ${newSessionId} created for ${auth.label}`);
                 },
             });
             transport.onclose = () => {
@@ -138,7 +101,6 @@ export function createApp(config) {
                     sessions.delete(transport.sessionId);
             };
             const server = createServer(config, {
-                role: auth.role,
                 label: auth.label,
                 credentials: auth.credentials,
             });
@@ -152,7 +114,7 @@ export function createApp(config) {
     });
     const handleSessionRequest = (req, res) => {
         void (async () => {
-            const auth = resolveAuth(req, config);
+            const auth = resolveAuth(req);
             if (!auth.ok)
                 return rpcError(res, auth.status, auth.code, auth.message);
             const sessionId = headerValue(req, "mcp-session-id");

package/dist/index.js

@@ -2,7 +2,6 @@
 /** CLI entry point — runs the MCP server over stdio (default) or HTTP. */
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ConfigError, loadConfig } from "./config.js";
-import { loadTokenEntries } from "./auth/tokens.js";
 import { createServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
 import { createApp } from "./http/app.js";
 const USAGE = `${SERVER_NAME} v${SERVER_VERSION}
@@ -19,31 +18,23 @@ Environment:
   CW_SITE                  ConnectWise host (e.g. na.myconnectwise.net)
   CW_COMPANY_ID            Login company id
   CW_CLIENT_ID             Integration clientId (developer.connectwise.com)
-  CW_PUBLIC_KEY            Server-wide API member public key (optional with BYOK)
-  CW_PRIVATE_KEY           Server-wide API member private key
-  CW_MEMBER_IDENTIFIER     Member the server-wide keys belong to (my-tickets/my-time)
-  MCP_TOKENS_VIEWER        label:token[,label:token…] — read-only access (HTTP)
-  MCP_TOKENS_EDITOR        label:token[,…] — read + tickets/notes/time writes
-  MCP_TOKENS_ADMIN         label:token[,…] — reserved for future destructive tools
-  CLIENT_CW_KEYS           disabled|with-token|open — client-supplied CW keys (default: with-token)
+  CW_PUBLIC_KEY            API member public key (required for stdio)
+  CW_PRIVATE_KEY           API member private key (required for stdio)
+  CW_MEMBER_IDENTIFIER     Member the stdio keys belong to (my-tickets/my-time)
+
+HTTP sessions authenticate per-request with their own member keys via the
+x-cw-public-key / x-cw-private-key headers (BYOK); the CW_* keys above are used
+only by stdio.
 `;
 function logStartupSummary(config) {
-    const entries = loadTokenEntries();
-    if (entries.length === 0) {
-        console.error("[auth] WARNING: no MCP_TOKENS_* configured — all HTTP requests are accepted with FULL access. " +
-            "Set MCP_TOKENS_VIEWER / MCP_TOKENS_EDITOR / MCP_TOKENS_ADMIN in production.");
-    }
-    else {
-        console.error(`[auth] ${entries.length} token(s) configured: ${entries.map((e) => `${e.label}(${e.role})`).join(", ")}`);
+    console.error("[auth] HTTP: each session must present its own ConnectWise keys via " +
+        "x-cw-public-key / x-cw-private-key (BYOK); ConnectWise enforces the member's security role.");
+    if (config.publicKey) {
+        console.error("[cw] CW_PUBLIC_KEY/CW_PRIVATE_KEY are set but unused on HTTP — sessions use their own keys.");
     }
-    console.error(`[auth] Client-supplied ConnectWise keys: ${config.clientKeyMode}`);
-    console.error(config.publicKey
-        ? `[cw] Server-wide keys configured${config.memberIdentifier ? ` (member: ${config.memberIdentifier})` : " (no CW_MEMBER_IDENTIFIER — my-tickets/my-time unavailable for token-only sessions)"}`
-        : "[cw] No server-wide keys — sessions must bring their own via x-cw-public-key/x-cw-private-key.");
 }
 async function runStdio(config) {
     const server = createServer(config, {
-        role: "admin",
         label: "stdio",
         credentials: {
             publicKey: config.publicKey,

package/dist/server.js

@@ -1,11 +1,12 @@
 /**
- * Builds an McpServer for one session. A session is defined by:
- *  - the ConnectWise credentials it uses (server-wide keys or client-supplied)
- *  - the role that gates which tools are registered
+ * Builds an McpServer for one session. A session is defined by the ConnectWise
+ * credentials it uses (server-wide keys on stdio, or client-supplied via BYOK).
+ * The full tool surface is always registered; the member's ConnectWise security
+ * role is the access control.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createRequire } from "node:module";
-import { ToolRegistrar } from "./auth/roles.js";
+import { ToolRegistrar } from "./tools/registrar.js";
 import { CWClient } from "./cw/client.js";
 import { registerTicketTools } from "./tools/tickets.js";
 import { registerTimeTools } from "./tools/time.js";
@@ -31,7 +32,7 @@ const INSTRUCTIONS = `# ConnectWise PSA MCP server
 
 ## Notes
 - Lists are paginated; ask for more pages rather than huge page sizes.
-- Some tools may be unavailable depending on this session's access level.`;
+- A write may still fail if your ConnectWise security role forbids it.`;
 export function createServer(config, session) {
     const client = new CWClient({
         site: config.site,
@@ -40,7 +41,7 @@ export function createServer(config, session) {
         credentials: session.credentials,
     });
     const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { instructions: INSTRUCTIONS });
-    const reg = new ToolRegistrar(server, session.role);
+    const reg = new ToolRegistrar(server);
     registerTicketTools(reg, client);
     registerTimeTools(reg, client);
     registerCompanyTools(reg, client);

package/dist/tools/registrar.js

@@ -0,0 +1,24 @@
+/**
+ * Tool registration.
+ *
+ * Every tool is registered on the session's McpServer. There is no MCP-level
+ * role gating: each session authenticates with a ConnectWise API member key
+ * (its own, via BYOK, or the server-wide keys on stdio), and ConnectWise
+ * enforces that member's security role server-side. The MCP server exposes the
+ * full tool surface and lets the CW API be the access control.
+ */
+/** Registers tools on an McpServer. */
+export class ToolRegistrar {
+    server;
+    constructor(server) {
+        this.server = server;
+    }
+    register(spec, handler) {
+        this.server.registerTool(spec.name, {
+            title: spec.title,
+            description: spec.description,
+            inputSchema: spec.inputSchema,
+            annotations: spec.annotations,
+        }, handler);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-connectwise-psa",
-  "version": "0.1.0",
-  "description": "MCP server for ConnectWise PSA (Manage) — tickets, time entries, companies, and configurations for technicians, with role-based access control and per-tech API keys",
+  "version": "0.2.0",
+  "description": "MCP server for ConnectWise PSA (Manage) — tickets, time entries, companies, and configurations for technicians, with per-tech API keys (BYOK) so writes are attributed to the real member",
   "mcpName": "io.github.selic/mcp-connectwise-psa",
   "type": "module",
   "repository": {
@@ -41,7 +41,7 @@
     "psa",
     "msp",
     "tickets",
-    "rbac"
+    "byok"
   ],
   "engines": {
     "node": ">=20"