API Reference
The RMMmax MCP server exposes roughly 79 canonical functions over a secure JSON-RPC endpoint, authenticated with OAuth2 and scoped exactly like every other part of the platform.
Authentication
- OAuth2
client_credentialsflow — create scoped OAuth clients from Environment → MCP Server in the console, receiving a client ID/secret pair once. - Three scopes, fail-closed by default: read, write, execute. An empty scope grants nothing.
- Rate limit: 120 requests/minute per credential.
- Browser-origin requests are restricted to allowed AppBox origins.
Scope Reference
| Scope | Grants |
|---|---|
read | Inventory, status, summaries, documentation |
write | Enable/disable clients, agents, tool configs; create scripts |
execute | Dispatch commands/scripts, run scans/updates |
Isolation and Data Safety
- Every tool call is re-scoped to the authenticated team; cross-tenant IDs are returned as “not found,” never dispatched.
- Responses use explicit field allowlists — credentials, OAuth secrets, agent tokens, and encrypted fields are never returned through MCP.
- MCP access is plan-gated, and every individual function call is separately checked against the team’s plan entitlements.
Function Categories
Inventory & docs · Alerts · Scripts & executions · Software management · Health & Defender · BitLocker · BleachBit · SurfLog · Update Manager · Warranty · Printers, Hardware Inventory & Recon. See the MCP Overview for the full function table.