Skip to main content
The MSPortal MCP server lets a compatible AI client, such as Claude, Cursor, Codex or Gemini CLI, use portal tools under your account’s access. This guide is for MSP staff and API consumers who connect an external AI client. It is separate from the built-in Home assistant. Sign-in uses a browser and OAuth, so there is no API key to copy.

​
Before you start

  • You need an MSPortal account and a role with MCP Server write permission. Without it you can open Settings > MCP Server and see the page, but the setup cards are disabled and the page says “You have view-only access.”
  • Your MSP administrator manages roles in Settings > Users & Roles, including for company users.
  • Your AI client must support remote Streamable HTTP MCP servers with browser OAuth sign-in. Local-server support alone is not enough.
  • Data that tools return goes to the AI client you connect. It is handled under that service’s terms and your organization’s policies. Connect only the areas you need.

​
Let your agent set up the connection

Open Launch Center > Connect > Continue with MCP, then select Copy setup script. Paste it into your AI agent. It includes your server address, client-specific installation recipes, browser OAuth instructions and a brief for finishing portal setup. The agent should use only the recipe for its current client, preserve existing connections, and call get_current_user to verify your tenant.
Codex setup dialog opened over the Launch Center MCP workspace.

Codex connection instructions opened from Launch Center.

With the relevant permissions and scopes, the setup tools let an agent:
  • Read and update tenant contact details, address, locale, currency, domain hostname and primary administrator.
  • Upload branding assets and set logos, brand color and sign-in design; configure supported portal, support and AI settings.
  • Create staff/client roles, review permission grants and change defaults; enable or disable existing training courses for tenant defaults or selected companies.
  • Configure service-plan billing recognition, software/integration detection rules and guided Standards answers.
Writes require a reviewed proposal and confirmation. Replacements reject an outdated review if the underlying configuration changes. Training proposals retain the company scope shown during review. A saved domain hostname still needs DNS/hosting setup, and provider sign-in, payment authorization and visual checks may need the browser. These tools do not imply that every app action is available: ask the agent to report missing capabilities explicitly.

​
Connect your client

1

Open MCP Server settings

In MSPortal, go to Settings > MCP Server. The page shows MSPortal MCP server with the badges OAuth 2.1 + PKCE, Streamable HTTP and Scoped to your permissions.
2

Copy the Server URL

Click the copy button beside Server URL. The same URL works for everyone in your organization, and each person signs in with their own account. Use the URL shown by your own regional portal.
3

Open the setup card for your client

Under Connect your client, click your client. A dialog titled Set up and the client’s name opens with a ready-made command or configuration. Copying a snippet does not connect anything yet.
4

Add the server to your client

Follow the section for your client below. Where the card has a one-click button, such as Add to Cursor, it opens the client app, which may ask you to trust and start the server.
5

Sign in and approve access

Your browser opens Authorize MSPortal MCP access. Complete sign-in and any account verification. Under Choose which areas this client can use, tick only the areas you need. The page shows Tools selected and warns when the count may exceed your client’s tool limit. Click Allow access, or Deny if you do not expect this request.
6

Check that it works

In your client, check the server status and the tool list. Then ask it to call get_current_user. The result shows the connected user, tenant and company. An answer that only lists tool names, with no tool call, does not prove the connection works.
Codex MCP setup dialog with command, configuration and browser sign-in instructions.

The Codex setup dialog in MSPortal. Nothing is authorized until you approve access in the browser.

​
Add the server to your client

Replace YOUR_SERVER_URL with the Server URL you copied. The setup card in MSPortal fills in your URL for you.
  1. Run this command in your terminal:
  2. In Claude Code, run /mcp and select msportal to authenticate.
  3. Approve access in the browser window that opens.
Configuration formats differ between clients. Do not paste one client’s JSON or command into another.

​
What an assistant can do

Tools cover tickets, devices, reporting, Planner, goals, budgets, meetings, compliance, projects and project documents, financial data, cloud services, security, backup, surveys, training, onboarding and more. The MCP Tools Reference lists every action and how it behaves. What you actually get depends on the server version, the areas you approved, your role, your company access, your integrations and your client’s tool selection. A company identity does not get MSP-only tools, even with broader scopes. List results can be paginated or cut short, so a small result does not prove a search was complete. A good first request is: “Use read tools to find the company I name and summarize the available evidence. Do not change records or send messages.” Then check the cited records, dates and gaps before you ask for follow-up work.

​
Grouped tools and existing connections

The catalog groups related operations into 114 public tools that cover 359 existing operations. Read tools have names such as query_planner. Changes use names such as manage_planner, with an action for creating, editing or archiving. The assistant reads each tool’s input schema to pick the action and its arguments. The full catalog fits under a 128-tool client limit. The consent screen counts the tools for the areas you pick. Other servers connected to your client also count toward its limit. Existing tool names keep working with their original arguments and response shapes, including the two compatibility aliases. Pending confirmations keep their original operation and expiry. You do not need a new server URL or broader access because of the grouping. When your client refreshes its tool list, it sees the grouped names. Update any tool-name allowlist to include them. A custom client that needs old names in tools/list must change its discovery logic, because old calls still work but the old discovery response does not. See grouped calls and legacy compatibility.

​
Confirmation before changes

Most changes use a two-call proposal and confirmation flow.
1

Request the change

The client calls the manage_* tool without confirm. MSPortal returns a proposal with a preview, the company, the records and the effects. Nothing is saved yet.
2

Review and approve

Read the proposal. Approve it only if it matches what you intended.
3

Confirm before it expires

The client calls the same tool and action again with confirm: true and the returned confirmationId. A proposal expires after ten minutes.
4

Check the result

Open the resulting record or background job. An accepted job request does not prove the provider delivered it.
The confirmation applies the stored proposal. To change the target or values, request a new proposal and review it again. An expired or used confirmation cannot be reused.
Not every tool has a confirmation step. mark_notification_read changes your notification state at once. draft_compliance_notes generates drafts and does not save them. submit_feedback sends a message to MSPortal at once and is for MSP staff only. Use it only when you explicitly ask to send feedback. Finding a missing feature does not authorize a message.
If a change times out or the result is unclear, check the target record before you ask the assistant to repeat it. Steps in a multi-step workflow are not rolled back together.

​
Install the Ron skill (optional)

The Ron skill is a set of instructions that guides an assistant through client briefings, risk reviews, QBR preparation and planning. It does not connect to MSPortal or grant permissions. You still connect the MCP server first.
1

Download the three files

Get the Ron skill, the playbooks and the tool map. On an EU portal, use the same paths on your regional portal address.
2

Keep the folder layout

Put SKILL.md in a folder named ron-vcio, and the other two files in a references folder inside it.
3

Add it to your client

Install the folder with your client’s skill or custom instruction feature. Do not paste the files at the end of an existing instruction file.
4

Test it

Ask the assistant for a client briefing and check that it calls MSPortal tools. If it answers without any tool calls, check the server connection and the enabled tools first.

​
Manage connected clients

Open Settings > MCP Server and scroll to Connected clients. It lists the applications you have authorized, each with an MSPortal or External app badge, the Last authorized time, the number of active sessions and the number of scopes. It shows only your own connections, not those of other users.
1

Find the client

Look for the client name in Connected clients.
2

Revoke it

Click Revoke on its row. The dialog Revoke access for the client name asks you to confirm. Click Revoke again. You see Access revoked.
3

Reconnect if needed

To connect it again, add the server in the client and approve access in the browser.
Revoking ends the client’s grant and refresh sessions. An access token already issued can work until it expires, up to about 15 minutes. To block access sooner, ask your MSP administrator to remove your MCP Server permission, which MSPortal checks on every request. Revoking does not take back data the client already received, undo finished actions or remove the client’s local server entry.

​
Troubleshooting

​
Frequently asked questions

No. You must add the URL in a compatible client, sign in and approve access.
No. Connecting needs the MCP Server write permission.
No. Scopes, role permissions, company scope and tool-specific limits all apply.
No. The 359 operation names still work with their original arguments and results. Only discovery changed, so client allowlists and custom discovery checks may need updating.
No. A proposal waits for confirmation. Check the record after you confirm.
No. The confirmation commits the stored proposal. Request a new proposal instead.
No. Some run at once, including marking notifications read and sending requested feedback.
It should not. submit_feedback is for MSP staff and needs your explicit request.
It ends the grant and refresh sessions. An issued access token can last up to about 15 minutes.
No. It does not recall data, undo work or delete the client’s local setup.
No. It is optional guidance. Connection, consent and access checks stay separate.