mcp-connectwise-psa 0.1.0 → 0.3.0

package/README.md

@@ -6,8 +6,7 @@ An MCP ([Model Context Protocol](https://modelcontextprotocol.io)) server for [C
 - **Time entries** — log time against tickets, review your own time
 - **Companies & contacts** — fast lookup (read-only)
 - **Configurations** — devices/assets with serials, IPs, OS, warranty (read-only)
-- **Role-based access control** — viewer / editor bearer tokens decide which tools a session sees
-- **Per-tech API keys (BYOK)** — techs supply their own ConnectWise member keys, so notes and time entries are attributed to the *actual person* in ConnectWise
+- **Per-tech API keys (BYOK)** — each tech supplies their own ConnectWise member keys; ConnectWise enforces that member's security role, and notes and time entries are attributed to the *actual person*
 - **Transports** — stdio for local use, streamable HTTP for shared deployments; Docker image included
 
 ## Quick start (local, stdio)
@@ -18,7 +17,7 @@ CW_SITE=na.myconnectwise.net \
 CW_COMPANY_ID=yourcompany \
 CW_CLIENT_ID=<integration clientId> \
 CW_PUBLIC_KEY=xxxx CW_PRIVATE_KEY=yyyy \
-CW_MEMBER_IDENTIFIER=JSmith \
+CW_MEMBER_IDENTIFIER=jdoe \
 node dist/index.js
 ```
 
@@ -36,7 +35,7 @@ Claude Desktop / Claude Code config:
         "CW_CLIENT_ID": "<clientId>",
         "CW_PUBLIC_KEY": "xxxx",
         "CW_PRIVATE_KEY": "yyyy",
-        "CW_MEMBER_IDENTIFIER": "JSmith"
+        "CW_MEMBER_IDENTIFIER": "jdoe"
       }
     }
   }
@@ -49,12 +48,10 @@ A `clientId` is required by the ConnectWise API — register a (free) integratio
 
 ```bash
 CW_SITE=… CW_COMPANY_ID=… CW_CLIENT_ID=… \
-MCP_TOKENS_VIEWER="alice:$(openssl rand -hex 32)" \
-MCP_TOKENS_EDITOR="bot:$(openssl rand -hex 32)" \
 node dist/index.js --transport http --port 3000
 ```
 
-Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:3000 -e CW_SITE -e CW_COMPANY_ID -e CW_CLIENT_ID -e MCP_TOKENS_VIEWER -e MCP_TOKENS_EDITOR mcp-connectwise-psa`
+Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:3000 -e CW_SITE -e CW_COMPANY_ID -e CW_CLIENT_ID mcp-connectwise-psa`
 
 | Route | Purpose |
 |---|---|
@@ -63,44 +60,45 @@ Or with Docker: `docker build -t mcp-connectwise-psa . && docker run -p 3000:300
 
 > Sessions are held in memory — run a single instance (or sticky sessions).
 
-## Access control
+## Access control — bring your own keys (BYOK)
 
-### Role tokens
+Over HTTP there is **no MCP-level role system**. Each session presents its own ConnectWise member API keys, and ConnectWise itself is the access control: the member's security role decides what succeeds, and every note and time entry is attributed to that member.
 
-```bash
-MCP_TOKENS_VIEWER="alice:tokA,bob:tokB"   # read-only tools
-MCP_TOKENS_EDITOR="helpdesk-bot:tokC"     # + create/update tickets, notes, time entries
-MCP_TOKENS_ADMIN="ops:tokD"               # reserved for future destructive tools
-```
-
-Clients send `Authorization: Bearer <token>`. Tools outside the role are not even registered for the session, a runtime guard re-checks every call, and session ids never carry privilege (each request re-authenticates; principal mismatch → 403). Labels appear in the audit log and allow per-person revocation. With no tokens configured the server runs in dev mode (full access + loud warning).
-
-### Bring your own keys (BYOK) — recommended for techs
-
-Send your own ConnectWise member API keys on the initialize request:
+Send your keys on the initialize request (and on every subsequent request in the session):
 
-```
+```http
 x-cw-public-key:  <public key>
 x-cw-private-key: <private key>
 x-cw-member-id:   <your member identifier>   (optional — enables "my tickets"/"my time")
 ```
 
-The session then acts as *you* in ConnectWise: your security role limits what succeeds, and every note and time entry is attributed to you. `CLIENT_CW_KEYS` controls the policy: `with-token` (default — a bearer token is still required), `open`, or `disabled`. Keys are never logged; sessions are bound to a SHA-256 hash of the pair.
+- A request with no keys is rejected with `401`; both key headers are required together.
+- Keys are never logged. A session is bound to a SHA-256 hash of the key pair; presenting a different pair on the same session id → `403`.
+- Create member API keys in ConnectWise under **My Account → API Keys**. Each tech uses their own.
+
+Local **stdio** is single-user and uses the `CW_PUBLIC_KEY`/`CW_PRIVATE_KEY` from the environment instead of headers.
 
-Token-only sessions use the server-wide `CW_PUBLIC_KEY`/`CW_PRIVATE_KEY` (use an integration API member with a conservative security role — its writes are attributed to that integration member).
+## Toolsets
 
-## Tools
+Tools are grouped into **toolsets** so a session only sees the capabilities it needs — a dispatcher doesn't need the invoicing tools, and a small tool surface keeps the assistant focused (and its context cheap). Whether a write actually succeeds is still governed by the member's ConnectWise security role.
 
-| Tool | Tier |
+| Toolset key | Tools |
 |---|---|
-| `cw_my_tickets`, `cw_search_tickets`, `cw_get_ticket` | read |
-| `cw_list_my_time` | read |
-| `cw_search_companies`, `cw_get_company`, `cw_search_contacts` | read |
-| `cw_list_configurations`, `cw_get_configuration` | read |
-| `cw_create_ticket`, `cw_update_ticket`, `cw_add_ticket_note` | write |
-| `cw_create_time_entry` | write |
+| `tickets` | `cw_search_tickets`, `cw_my_tickets`, `cw_get_ticket`, `cw_create_ticket`, `cw_update_ticket`, `cw_add_ticket_note`, `cw_list_boards`, `cw_get_board`, `cw_list_priorities`, `cw_list_ticket_time`, `cw_list_ticket_tasks` |
+| `time` | `cw_create_time_entry`, `cw_list_my_time`, `cw_list_work_roles`, `cw_list_my_timesheets`, `cw_submit_timesheet` |
+| `companies` | `cw_search_companies`, `cw_get_company`, `cw_search_contacts`, `cw_get_contact`, `cw_list_company_sites` |
+| `configurations` | `cw_list_configurations`, `cw_get_configuration` |
+| `schedule` | `cw_list_schedule_entries`, `cw_my_schedule`, `cw_schedule_ticket`, `cw_update_schedule_entry`, `cw_delete_schedule_entry`, `cw_member_availability`, `cw_list_members`, `cw_get_member` |
+| `finance` | `cw_list_invoices`, `cw_get_invoice`, `cw_list_agreements`, `cw_get_agreement`, `cw_list_unbilled_time` |
+
+**Presets** bundle keys per persona: `tech` = tickets + time + companies + configurations · `dispatch` = tickets + schedule + companies + configurations · `invoicing` = finance + time + companies · `all` = everything.
+
+Select toolsets with a comma list mixing keys and presets:
+
+- **HTTP** — the `x-cw-toolsets` header, per session: `x-cw-toolsets: dispatch` or `x-cw-toolsets: tech,finance`.
+- **stdio** — the `CW_TOOLSETS` env var or `--toolsets` flag: `CW_TOOLSETS=invoicing`.
 
-Viewer = read. Editor/Admin = read + write. No destructive (delete) tools in v1.
+The **default is the `tech` preset** — the same tools this server exposed before toolsets existed, so nothing changes for existing clients until they opt in. Unknown keys in `CW_TOOLSETS`/`--toolsets` fail fast; unknown tokens in the `x-cw-toolsets` header are ignored. The only destructive tool is `cw_delete_schedule_entry` (dispatch); finance is read-only.
 
 ## Configuration reference
 
@@ -109,11 +107,10 @@ Viewer = read. Editor/Admin = read + write. No destructive (delete) tools in v1.
 | `CW_SITE` | — | ConnectWise host (cloud or on-prem; full URLs accepted) |
 | `CW_COMPANY_ID` | — | Login company id |
 | `CW_CLIENT_ID` | — | Integration clientId |
-| `CW_PUBLIC_KEY` / `CW_PRIVATE_KEY` | — | Server-wide API member keys (optional when BYOK is enabled) |
-| `CW_MEMBER_IDENTIFIER` | — | Member the server-wide keys belong to |
+| `CW_PUBLIC_KEY` / `CW_PRIVATE_KEY` | — | API member keys — required for stdio; unused on HTTP (BYOK) |
+| `CW_MEMBER_IDENTIFIER` | — | Member the stdio keys belong to (my-tickets/my-time) |
 | `TRANSPORT` / `PORT` | `stdio` / `3000` | Transport selection |
-| `CLIENT_CW_KEYS` | `with-token` | BYOK policy: `disabled`, `with-token`, `open` |
-| `MCP_TOKENS_VIEWER/EDITOR/ADMIN` | — | `label:token,label:token` per role |
+| `CW_TOOLSETS` | `tech` | Enabled toolsets (keys/presets); HTTP overrides per session via `x-cw-toolsets` |
 
 ## Notes & limits
 

package/dist/config.js

@@ -7,20 +7,22 @@
  *                         path are stripped.
  *   CW_COMPANY_ID         ConnectWise login company id (required)
  *   CW_CLIENT_ID          Integration clientId from developer.connectwise.com (required)
- *   CW_PUBLIC_KEY         Server-wide API member public key (optional — enables
- *   CW_PRIVATE_KEY        token-only sessions; omit to require per-tech keys)
- *   CW_MEMBER_IDENTIFIER  Member identifier the server-wide keys belong to
- *                         (enables "my tickets"/"my time" for token-only sessions)
+ *   CW_PUBLIC_KEY         API member public key — required for stdio; unused on
+ *   CW_PRIVATE_KEY        HTTP, where each session brings its own keys (BYOK)
+ *   CW_MEMBER_IDENTIFIER  Member the stdio keys belong to (enables
+ *                         "my tickets"/"my time")
  *   TRANSPORT             stdio | http (default: stdio)
  *   PORT                  HTTP port (default: 3000)
- *   CLIENT_CW_KEYS        disabled | with-token | open (default: with-token) —
- *                         whether HTTP clients may supply their own member API
- *                         keys via x-cw-public-key / x-cw-private-key headers
- *   MCP_TOKENS_VIEWER     Comma-separated label:token list for the viewer role
- *   MCP_TOKENS_EDITOR     Comma-separated label:token list for the editor role
- *   MCP_TOKENS_ADMIN      Comma-separated label:token list for the admin role
+ *   CW_TOOLSETS           Comma list of toolset keys/presets to expose (default:
+ *                         the "tech" preset). HTTP sessions may override per
+ *                         request via the x-cw-toolsets header.
+ *
+ * Access model: stdio uses the server-wide keys above (single local user). HTTP
+ * sessions each bring their own member API keys (BYOK) via x-cw-public-key /
+ * x-cw-private-key headers; ConnectWise enforces that member's security role.
+ * There is no MCP-level role gating.
  */
-const CLIENT_KEY_MODES = ["disabled", "with-token", "open"];
+import { DEFAULT_TOOLSETS, resolveToolsets } from "./tools/toolsets.js";
 export class ConfigError extends Error {
 }
 function flagValue(argv, name) {
@@ -63,10 +65,6 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
     if (!clientId) {
         throw new ConfigError("CW_CLIENT_ID is required — register an integration at developer.connectwise.com");
     }
-    const clientKeyMode = (env.CLIENT_CW_KEYS || "with-token");
-    if (!CLIENT_KEY_MODES.includes(clientKeyMode)) {
-        throw new ConfigError(`Invalid CLIENT_CW_KEYS "${clientKeyMode}" — expected one of: ${CLIENT_KEY_MODES.join(", ")}`);
-    }
     const publicKey = env.CW_PUBLIC_KEY || undefined;
     const privateKey = env.CW_PRIVATE_KEY || undefined;
     if (!!publicKey !== !!privateKey) {
@@ -75,8 +73,12 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
     if (transport === "stdio" && !publicKey) {
         throw new ConfigError("CW_PUBLIC_KEY / CW_PRIVATE_KEY are required for stdio transport");
     }
-    if (transport === "http" && !publicKey && clientKeyMode === "disabled") {
-        throw new ConfigError("CW_PUBLIC_KEY / CW_PRIVATE_KEY are required when CLIENT_CW_KEYS=disabled — there are no keys the server could use");
+    let toolsets;
+    try {
+        toolsets = resolveToolsets(flagValue(argv, "--toolsets") ?? env.CW_TOOLSETS, DEFAULT_TOOLSETS, "throw");
+    }
+    catch (err) {
+        throw new ConfigError(err instanceof Error ? err.message : String(err));
     }
     return {
         transport,
@@ -87,6 +89,6 @@ export function loadConfig(argv = process.argv.slice(2), env = process.env) {
         publicKey,
         privateKey,
         memberIdentifier: env.CW_MEMBER_IDENTIFIER || undefined,
-        clientKeyMode,
+        toolsets,
     };
 }

package/dist/cw/client.js

@@ -132,6 +132,10 @@ export class CWClient {
     async patch(path, operations) {
         return this.request("PATCH", path, undefined, operations);
     }
+    /** DELETE a resource (e.g. /schedule/entries/{id}). Returns void (CW replies 204/200). */
+    async del(path) {
+        await this.request("DELETE", path);
+    }
     /**
      * The member identifier this session acts as. Uses the explicitly provided
      * identifier when available; otherwise tries /system/myAccount once (not

package/dist/http/app.js

@@ -1,28 +1,25 @@
 /**
  * HTTP transport: Express app exposing
  *
- *   POST/GET/DELETE /mcp    MCP streamable-http endpoint (auth + RBAC)
+ *   POST/GET/DELETE /mcp    MCP streamable-http endpoint (BYOK auth)
  *   GET  /health            liveness probe
  *
- * Authentication model:
- *  - Role tokens (Authorization: Bearer …) map to viewer/editor/admin and gate
- *    which tools a session gets, using the server-wide ConnectWise keys.
- *  - Bring-your-own-keys: x-cw-public-key + x-cw-private-key headers bind the
- *    session to that member's API keys with the FULL tool surface — the
- *    member's own ConnectWise security role is the access control, and writes
- *    (notes, time entries) are attributed to that member. Optional
- *    x-cw-member-id header names the member for "my tickets"/"my time".
- *    CLIENT_CW_KEYS controls the policy (with-token default / open / disabled).
+ * Authentication model — bring-your-own-keys only:
+ *  - Every session presents its own ConnectWise member API keys via the
+ *    x-cw-public-key + x-cw-private-key headers. Those keys are both the
+ *    credential and the permission model: ConnectWise enforces that member's
+ *    security role, and writes (notes, time entries) are attributed to that
+ *    member. Optional x-cw-member-id names the member for "my tickets"/"my time".
+ *  - The full tool surface is exposed; there is no MCP-level role gating.
  *  - A session id never carries privilege: every request re-authenticates and
- *    must present the same principal (role + label + key hash) the session was
- *    created with.
+ *    must present the same key pair (SHA-256 hash) the session was created with.
  */
 import { createHash, randomUUID } from "node:crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { authenticateToken, loadTokenEntries } from "../auth/tokens.js";
 import { createServer, SERVER_NAME, SERVER_VERSION } from "../server.js";
+import { resolveToolsets } from "../tools/toolsets.js";
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 function rpcError(res, status, code, message) {
     res.status(status).json({ jsonrpc: "2.0", error: { code, message }, id: null });
@@ -38,62 +35,38 @@ function headerValue(req, name) {
     return Array.isArray(value) ? value[0] : value;
 }
 /** Resolve the principal for a request. Exported for tests. */
-export function resolveAuth(req, config) {
-    const entries = loadTokenEntries();
-    const token = authenticateToken(req.headers.authorization, entries);
+export function resolveAuth(req) {
     const clientPublic = headerValue(req, "x-cw-public-key");
     const clientPrivate = headerValue(req, "x-cw-private-key");
     const clientMember = headerValue(req, "x-cw-member-id");
-    if (clientPublic || clientPrivate) {
-        if (config.clientKeyMode === "disabled") {
-            return unauthorized("Client-supplied ConnectWise keys are disabled on this server (CLIENT_CW_KEYS=disabled).");
-        }
-        if (!clientPublic || !clientPrivate) {
-            return unauthorized("Both x-cw-public-key and x-cw-private-key headers are required.");
-        }
-        const keyHash = sha256(`${clientPublic}:${clientPrivate}`);
-        const byokLabel = `byok:${keyHash.slice(0, 8)}`;
-        if (config.clientKeyMode === "with-token" && entries.length > 0 && !token) {
-            return unauthorized("A valid bearer token is required alongside your ConnectWise keys (CLIENT_CW_KEYS=with-token).");
-        }
-        const label = token ? `${token.label}+${byokLabel}` : byokLabel;
-        // BYOK sessions get the full tool surface; the member's own ConnectWise
-        // security role is the effective access control.
-        return {
-            ok: true,
-            role: "admin",
-            label,
-            credentials: {
-                publicKey: clientPublic,
-                privateKey: clientPrivate,
-                memberIdentifier: clientMember,
-            },
-            keyHash,
-        };
+    if (!clientPublic && !clientPrivate) {
+        return unauthorized("Supply your ConnectWise member API keys via the x-cw-public-key and x-cw-private-key headers.");
     }
-    const serverCredentials = config.publicKey && config.privateKey
-        ? {
-            publicKey: config.publicKey,
-            privateKey: config.privateKey,
-            memberIdentifier: config.memberIdentifier,
-        }
-        : null;
-    if (entries.length === 0) {
-        if (!serverCredentials) {
-            return unauthorized("No ConnectWise keys available — set CW_PUBLIC_KEY/CW_PRIVATE_KEY on the server or send x-cw-public-key/x-cw-private-key.");
-        }
-        return { ok: true, role: "admin", label: "dev-unauthenticated", credentials: serverCredentials, keyHash: null };
+    if (!clientPublic || !clientPrivate) {
+        return unauthorized("Both x-cw-public-key and x-cw-private-key headers are required.");
     }
-    if (!token) {
-        return unauthorized("Unauthorized: invalid or missing bearer token.");
-    }
-    if (!serverCredentials) {
-        return unauthorized("This server has no shared ConnectWise keys — supply your own via the x-cw-public-key/x-cw-private-key headers.");
-    }
-    return { ok: true, role: token.role, label: token.label, credentials: serverCredentials, keyHash: null };
+    const keyHash = sha256(`${clientPublic}:${clientPrivate}`);
+    return {
+        ok: true,
+        label: `byok:${keyHash.slice(0, 8)}`,
+        credentials: {
+            publicKey: clientPublic,
+            privateKey: clientPrivate,
+            memberIdentifier: clientMember,
+        },
+        keyHash,
+    };
 }
 function principalMatches(session, auth) {
-    return (session.role === auth.role && session.label === auth.label && session.keyHash === auth.keyHash);
+    return session.keyHash === auth.keyHash;
+}
+/**
+ * Toolsets for a new session: the x-cw-toolsets header narrows/widens within the
+ * valid keys, falling back to the server default. Unknown tokens are ignored
+ * (warn) rather than failing the request. Exported for tests.
+ */
+export function sessionToolsets(req, config) {
+    return resolveToolsets(headerValue(req, "x-cw-toolsets"), config.toolsets, "warn");
 }
 export function createApp(config) {
     const app = express();
@@ -104,7 +77,7 @@ export function createApp(config) {
     });
     app.post("/mcp", (req, res) => {
         void (async () => {
-            const auth = resolveAuth(req, config);
+            const auth = resolveAuth(req);
             if (!auth.ok)
                 return rpcError(res, auth.status, auth.code, auth.message);
             const sessionId = headerValue(req, "mcp-session-id");
@@ -126,11 +99,10 @@ export function createApp(config) {
                 onsessioninitialized: (newSessionId) => {
                     sessions.set(newSessionId, {
                         transport,
-                        role: auth.role,
                         label: auth.label,
                         keyHash: auth.keyHash,
                     });
-                    console.error(`[rbac] session ${newSessionId} created for ${auth.label} (${auth.role})`);
+                    console.error(`[auth] session ${newSessionId} created for ${auth.label}`);
                 },
             });
             transport.onclose = () => {
@@ -138,9 +110,9 @@ export function createApp(config) {
                     sessions.delete(transport.sessionId);
             };
             const server = createServer(config, {
-                role: auth.role,
                 label: auth.label,
                 credentials: auth.credentials,
+                toolsets: sessionToolsets(req, config),
             });
             await server.connect(transport);
             await transport.handleRequest(req, res, req.body);
@@ -152,7 +124,7 @@ export function createApp(config) {
     });
     const handleSessionRequest = (req, res) => {
         void (async () => {
-            const auth = resolveAuth(req, config);
+            const auth = resolveAuth(req);
             if (!auth.ok)
                 return rpcError(res, auth.status, auth.code, auth.message);
             const sessionId = headerValue(req, "mcp-session-id");

package/dist/index.js

@@ -2,7 +2,6 @@
 /** CLI entry point — runs the MCP server over stdio (default) or HTTP. */
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ConfigError, loadConfig } from "./config.js";
-import { loadTokenEntries } from "./auth/tokens.js";
 import { createServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
 import { createApp } from "./http/app.js";
 const USAGE = `${SERVER_NAME} v${SERVER_VERSION}
@@ -13,43 +12,40 @@ Options:
   --transport stdio|http   Transport (default: stdio; env TRANSPORT)
   --port <n>               HTTP port (default: 3000; env PORT)
   --site <host>            ConnectWise host (env CW_SITE)
+  --toolsets <list>        Enabled toolsets (env CW_TOOLSETS; default: tech)
   --help                   Show this help
 
 Environment:
   CW_SITE                  ConnectWise host (e.g. na.myconnectwise.net)
   CW_COMPANY_ID            Login company id
   CW_CLIENT_ID             Integration clientId (developer.connectwise.com)
-  CW_PUBLIC_KEY            Server-wide API member public key (optional with BYOK)
-  CW_PRIVATE_KEY           Server-wide API member private key
-  CW_MEMBER_IDENTIFIER     Member the server-wide keys belong to (my-tickets/my-time)
-  MCP_TOKENS_VIEWER        label:token[,label:token…] — read-only access (HTTP)
-  MCP_TOKENS_EDITOR        label:token[,…] — read + tickets/notes/time writes
-  MCP_TOKENS_ADMIN         label:token[,…] — reserved for future destructive tools
-  CLIENT_CW_KEYS           disabled|with-token|open — client-supplied CW keys (default: with-token)
+  CW_PUBLIC_KEY            API member public key (required for stdio)
+  CW_PRIVATE_KEY           API member private key (required for stdio)
+  CW_MEMBER_IDENTIFIER     Member the stdio keys belong to (my-tickets/my-time)
+  CW_TOOLSETS              Comma list of toolset keys/presets (default: tech).
+                           Keys: tickets, time, companies, configurations,
+                           schedule, finance. Presets: tech, dispatch, invoicing, all.
+
+HTTP sessions authenticate per-request with their own member keys via the
+x-cw-public-key / x-cw-private-key headers (BYOK); the CW_* keys above are used
+only by stdio. HTTP clients pick toolsets per session with the x-cw-toolsets header.
 `;
 function logStartupSummary(config) {
-    const entries = loadTokenEntries();
-    if (entries.length === 0) {
-        console.error("[auth] WARNING: no MCP_TOKENS_* configured — all HTTP requests are accepted with FULL access. " +
-            "Set MCP_TOKENS_VIEWER / MCP_TOKENS_EDITOR / MCP_TOKENS_ADMIN in production.");
-    }
-    else {
-        console.error(`[auth] ${entries.length} token(s) configured: ${entries.map((e) => `${e.label}(${e.role})`).join(", ")}`);
+    console.error("[auth] HTTP: each session must present its own ConnectWise keys via " +
+        "x-cw-public-key / x-cw-private-key (BYOK); ConnectWise enforces the member's security role.");
+    if (config.publicKey) {
+        console.error("[cw] CW_PUBLIC_KEY/CW_PRIVATE_KEY are set but unused on HTTP — sessions use their own keys.");
     }
-    console.error(`[auth] Client-supplied ConnectWise keys: ${config.clientKeyMode}`);
-    console.error(config.publicKey
-        ? `[cw] Server-wide keys configured${config.memberIdentifier ? ` (member: ${config.memberIdentifier})` : " (no CW_MEMBER_IDENTIFIER — my-tickets/my-time unavailable for token-only sessions)"}`
-        : "[cw] No server-wide keys — sessions must bring their own via x-cw-public-key/x-cw-private-key.");
 }
 async function runStdio(config) {
     const server = createServer(config, {
-        role: "admin",
         label: "stdio",
         credentials: {
             publicKey: config.publicKey,
             privateKey: config.privateKey,
             memberIdentifier: config.memberIdentifier,
         },
+        toolsets: config.toolsets,
     });
     await server.connect(new StdioServerTransport());
     console.error(`${SERVER_NAME} v${SERVER_VERSION} running on stdio (${config.site})`);

package/dist/server.js

@@ -1,20 +1,32 @@
 /**
- * Builds an McpServer for one session. A session is defined by:
- *  - the ConnectWise credentials it uses (server-wide keys or client-supplied)
- *  - the role that gates which tools are registered
+ * Builds an McpServer for one session. A session is defined by the ConnectWise
+ * credentials it uses (server-wide keys on stdio, or client-supplied via BYOK)
+ * and the toolsets it selected. Only the selected toolsets are registered; the
+ * member's ConnectWise security role is the access control.
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createRequire } from "node:module";
-import { ToolRegistrar } from "./auth/roles.js";
+import { ToolRegistrar } from "./tools/registrar.js";
 import { CWClient } from "./cw/client.js";
 import { registerTicketTools } from "./tools/tickets.js";
 import { registerTimeTools } from "./tools/time.js";
 import { registerCompanyTools } from "./tools/companies.js";
 import { registerConfigurationTools } from "./tools/configurations.js";
+import { registerScheduleTools } from "./tools/schedule.js";
+import { registerFinanceTools } from "./tools/finance.js";
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
 export const SERVER_NAME = pkg.name;
 export const SERVER_VERSION = pkg.version;
+/** Maps each toolset key to the function that registers its tools. */
+const TOOLSETS = {
+    tickets: registerTicketTools,
+    time: registerTimeTools,
+    companies: registerCompanyTools,
+    configurations: registerConfigurationTools,
+    schedule: registerScheduleTools,
+    finance: registerFinanceTools,
+};
 const INSTRUCTIONS = `# ConnectWise PSA MCP server
 
 ## Finding things
@@ -31,7 +43,8 @@ const INSTRUCTIONS = `# ConnectWise PSA MCP server
 
 ## Notes
 - Lists are paginated; ask for more pages rather than huge page sizes.
-- Some tools may be unavailable depending on this session's access level.`;
+- A write may still fail if your ConnectWise security role forbids it.
+- Only the tools for this session's enabled toolsets are listed; other capabilities may exist on the server.`;
 export function createServer(config, session) {
     const client = new CWClient({
         site: config.site,
@@ -40,10 +53,9 @@ export function createServer(config, session) {
         credentials: session.credentials,
     });
     const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { instructions: INSTRUCTIONS });
-    const reg = new ToolRegistrar(server, session.role);
-    registerTicketTools(reg, client);
-    registerTimeTools(reg, client);
-    registerCompanyTools(reg, client);
-    registerConfigurationTools(reg, client);
+    const reg = new ToolRegistrar(server);
+    for (const key of session.toolsets) {
+        TOOLSETS[key](reg, client);
+    }
     return server;
 }

package/dist/tools/companies.js

@@ -106,4 +106,66 @@ export function registerCompanyTools(reg, client) {
             return failure(error);
         }
     });
+    reg.register({
+        name: "cw_get_contact",
+        title: "Get ConnectWise Contact",
+        description: "Get one contact with their phone numbers and email addresses (communication items).",
+        inputSchema: {
+            contact_id: z.number().int().positive().describe("The contact ID (from cw_search_contacts)"),
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const c = await client.getOne(`/company/contacts/${args.contact_id}`, "id,firstName,lastName,title,company/name,company/id,inactiveFlag,communicationItems");
+            if (args.response_format === "json")
+                return text(clip(json(c)));
+            const lines = [
+                `# ${c.firstName ?? ""} ${c.lastName ?? ""}${c.inactiveFlag ? " (inactive)" : ""}`.trim(),
+                "",
+                `- **Company**: ${c.company?.name ?? "?"}`,
+                `- **Title**: ${c.title ?? "—"}`,
+            ];
+            const comms = c.communicationItems ?? [];
+            if (comms.length) {
+                lines.push("", "## Contact methods");
+                for (const ci of comms)
+                    lines.push(`- ${ci.type?.name ?? ci.communicationType ?? "?"}: ${ci.value ?? ""}${ci.defaultFlag ? " (default)" : ""}`);
+            }
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
+    reg.register({
+        name: "cw_list_company_sites",
+        title: "List ConnectWise Company Sites",
+        description: "List a company's sites (locations/addresses), with phone and timezone.",
+        inputSchema: {
+            company_id: z.number().int().positive().describe("The company ID"),
+            response_format: responseFormatField,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, async (args) => {
+        try {
+            const page = await client.getList(`/company/companies/${args.company_id}/sites`, {
+                fields: "id,name,addressLine1,city,stateReference/name,zip,phoneNumber,timeZone/name,inactiveFlag,primaryAddressFlag",
+                pageSize: 200,
+            });
+            if (page.items.length === 0)
+                return text(`No sites for company #${args.company_id}.`);
+            if (args.response_format === "json")
+                return text(clip(json(page.items)));
+            const lines = [`# Sites for company #${args.company_id} (${page.items.length})`, ""];
+            for (const s of page.items) {
+                const addr = [s.addressLine1, s.city, s.stateReference?.name, s.zip].filter(Boolean).join(", ");
+                lines.push(`- **${s.name ?? "?"}**${s.primaryAddressFlag ? " (primary)" : ""}${s.inactiveFlag ? " (inactive)" : ""}`, `  ${addr || "—"}${s.phoneNumber ? ` | ${s.phoneNumber}` : ""}${s.timeZone?.name ? ` | TZ: ${s.timeZone.name}` : ""}`);
+            }
+            return text(clip(lines.join("\n")));
+        }
+        catch (error) {
+            return failure(error);
+        }
+    });
 }