20.12. Connect AI Assistants to AlgaPSA with the MCP Server

Your team already answers the same questions all day: which tickets are open for a client, whether time was logged, what is scheduled this week. With the AlgaPSA MCP server, an MCP-compatible AI assistant such as Claude can answer those questions and do the follow-up work: look up tickets, enter time, schedule tasks, or draft a workflow from a plain-language description.

This guide covers the three ways to connect an assistant, what it can and cannot do once connected, and how administrators keep control of automated access. The examples use a fictional MSP serving clients such as GreenLeaf Dental Group and Northstar Accounting.

How access is controlled: everything an assistant does runs through the same permission system as a signed-in user. A personal connection acts as you, with your roles. A governed agent acts as itself, with only the roles an administrator assigned. If the identity behind the call lacks a permission, the action is denied. There is no separate "AI permission level" to configure or worry about.

Three Ways to Connect

All three paths expose the same tool surface, described next.

What the Assistant Can Do

Rather than one tool per API endpoint, AlgaPSA exposes three tools that let the assistant discover and call the whole REST API within the caller's permissions:

In practice, that supports requests like:

• "Which tickets are open for GreenLeaf Dental Group, and which are past SLA?"
• "Log 45 minutes on ticket #1042 for the firewall replacement."
• "Create a workflow that assigns new Northstar Accounting tickets to the finance board."

The assistant's reach equals the connected identity's reach. A dispatcher's connection cannot finalize invoices unless the dispatcher can.

Before You Start

Connect an Assistant as Yourself

This is the everyday path: authorize your assistant once, and it works with your permissions until you disconnect it.

1. In your assistant, add a remote MCP server (in Claude, a custom connector) and enter your MCP endpoint: https://<your-instance>/api/mcp.
2. The assistant redirects you to your AlgaPSA sign-in. Log in as usual.
3. AlgaPSA shows a consent screen explaining that the app "is requesting access to AlgaPSA as you" and will use the MCP tools with your own permissions. Choose Approve.
4. The assistant now lists the three AlgaPSA tools. Try it: "What tickets were opened for GreenLeaf Dental Group this week?"

Reconnecting the same app later does not prompt again. Access tokens are short-lived and refresh automatically, so revoking access takes effect quickly.

To disconnect: open https://<your-instance>/msp/settings/mcp-server and find the Connected MCP clients card, which lists "apps you've authorized to access AlgaPSA as you over MCP." Click Disconnect next to any client you no longer use. Every user manages their own connected clients; no admin is needed.

Set Up a Governed Agent (Administrators)

This is an advanced setup, and most teams never need it. A personal connection covers everyday assistant use and takes a minute to authorize. Reach for a governed agent only when a standing automation must run under its own identity rather than a person's, and you are comfortable working with identity providers.

Use a governed agent when the automation should not run as any particular person: a Support triage bot that labels and routes new tickets overnight, for example. A governed agent has its own identity, only the roles you grant, and a full activity log.

Open https://<your-instance>/msp/settings/mcp-server. (This screen is currently reached by direct URL; it does not yet appear in the Settings sidebar.) The page walks through two steps.

Step 1: Identity providers. Agents sign in through an identity provider you trust.

• On hosted AlgaPSA, Microsoft and Google providers show as Ready to use, managed by AlgaPSA with no setup needed.
• To use your own directory, choose Add provider and pick Microsoft Entra (enter your Entra tenant ID), Google (no setup; agents sign in with a Google service-account ID), or Custom (issuer, signing keys URL, and audience for any OIDC-compatible provider).
• If your tenant already has a Microsoft or Google connection for email or SSO, the page offers to reuse that directory for agents.

Step 2: Agents. Create the agent and decide what it may do.

1. Click to add an agent and give it a recognizable Name, such as "Support triage bot."
2. Set its Identity: on hosted AlgaPSA use Connect with Microsoft or Connect with Google, or choose Enter identity manually and provide the provider plus the agent's ID (the Entra application ID or Google service-account ID).
3. Assign Roles. Grant the least privilege the job needs; a dedicated role limited to ticket triage is safer than reusing a broad technician role. An agent without a permission is denied when it tries to use it.

The system that runs the agent then authenticates to https://<your-instance>/api/mcp with a token from that identity provider. Each identity can back only one agent, so one credential cannot quietly serve two bots.

Reviewing what an agent did: open the agent's menu and choose View activity. The activity log shows what the agent did and whether each action was allowed, with a When / Action / Result view marking each call Allowed or Blocked. Review it the way you would review a new hire's ticket notes, especially in the agent's first weeks.

Offboarding: Deactivate stops an agent while keeping its history; you can reactivate it later. Remove permanently deletes the agent, its role grants, and its activity log, and cannot be undone. Prefer deactivating unless you are certain the history is no longer needed.

Run the Free Local Connector

On any edition, including the free Community Edition, a technician can connect Claude Desktop or Cursor through a small connector that runs on their workstation and uses their own API key (created under Settings → API Keys). Add this to Claude Desktop's claude_desktop_config.json (Cursor uses the same block in ~/.cursor/mcp.json):

{
  "mcpServers": {
    "alga-psa": {
      "command": "npx",
      "args": ["-y", "@alga-psa/mcp-connector"],
      "env": {
        "ALGA_INSTANCE_URL": "https://alga.example.com",
        "ALGA_API_TOKEN": "your-api-key"
      }
    }
  }
}

Calls made this way carry the key owner's permissions, exactly as if that person used the app.

Operational Checks

• Confirm permissions hold. Ask a connected assistant to do something the identity is not allowed to do; the request should be denied. If it succeeds, review that identity's roles, not the MCP configuration.
• Know what is audited. The agent activity log covers governed agents only. Personal connections and the local connector act as the person who authorized them, so their actions look like that person's own actions in AlgaPSA.
• Writes execute immediately. When an assistant creates or updates a record, the change is applied right away, subject to permissions. Keep role grants conservative for identities used by automation.
• Prune access. Have users check Connected MCP clients for apps they no longer use, and deactivate agents whose jobs have ended.