How do I install Msp360?

Msp360 is a local plugin. Install it using the provided package and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Msp360 safe to use?

Msp360 scored 5.4/10 (moderate risk) in MCP Marketplace's automated security scan. It has 2 high or critical findings to review. It's listed, but review the security report on this page before installing.

What credentials does Msp360 need?

Msp360 requires the following credentials or environment variables: MSP360_USERNAME, MSP360_PASSWORD, MCP_TRANSPORT, AUTH_MODE, LOG_LEVEL. You can find setup instructions on the server detail page.

What AI apps work with Msp360?

Msp360 uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Msp360 MCP Server

by WYRE AI

Developer ToolsModerate5.4MCP RegistryLocal

Free

Server data from the Official MCP Registry

MCP server for MSP360's Managed Backup Service API — companies, computers, and backup plans.

About

MCP server for MSP360's Managed Backup Service API — companies, computers, and backup plans.

Security Report

5.4

Moderate5.4Moderate Risk

This MSP360 MCP server exchanges provider-portal credentials for a bearer token, caches it per credential pair, and exposes read-mostly monitoring tools plus start/stop backup actions, all calling the vendor's own api.mspbackups.com endpoint with no third-party exfiltration path found. Its permissions (network_http to the vendor API, env_vars for credentials, plus HTTP gateway auth via S2S HMAC and body/input size caps) match its stated purpose. Minor observations include the in-memory token cache, lack of input format validation on IDs, and that start/stop tools are mutating operations exposed to the AI assistant, but none significantly lower the score. Supply chain analysis found 4 known vulnerabilities in dependencies (2 critical, 0 high severity).

12 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

MSP360 Managed Backup Service provider-portal usernameOptional

Environment variable: MSP360_USERNAME

MSP360 Managed Backup Service provider-portal passwordRequired

Environment variable: MSP360_PASSWORD

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.Optional

Environment variable: MCP_TRANSPORT

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.Optional

Environment variable: AUTH_MODE

Log verbosity: debug, info, warn, errorOptional

Environment variable: LOG_LEVEL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-wyre-ai-msp360-mcp": {
      "env": {
        "AUTH_MODE": "your-auth-mode-here",
        "LOG_LEVEL": "your-log-level-here",
        "MCP_TRANSPORT": "your-mcp-transport-here",
        "MSP360_PASSWORD": "your-msp360-password-here",
        "MSP360_USERNAME": "your-msp360-username-here"
      },
      "args": [
        "-y",
        "@wyre-ai/msp360-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

MSP360 MCP Server

MCP server for MSP360's Managed Backup Service API (formerly CloudBerry Lab) - companies, managed computers, backup plans, monitoring, and licenses, for AI assistants and the WYRE Conduit gateway.

Authentication

Provide the Managed Backup Service provider-portal UserName/Password pair. This server exchanges it for a short-lived bearer token via POST /api/Provider/Login and caches it, re-authenticating automatically whenever the vendor rejects the cached token (HTTP 401) - callers only ever need to supply the long-lived username/password.

Configuration

Env var	Description
`MSP360_USERNAME`	MSP360 provider-portal username.
`MSP360_PASSWORD`	MSP360 provider-portal password.
`MCP_TRANSPORT`	`stdio` (default) or `http`.
`AUTH_MODE`	`env` (default, reads the vars above) or `gateway` (credentials arrive per-request via `X-MSP360-Username` / `X-MSP360-Password` headers, injected by the Conduit gateway).
`CONDUIT_S2S_SECRET`	When set, the HTTP transport requires a valid `X-Gateway-S2S` header (Conduit sidecar auth) on every `/mcp` request.
`LOG_LEVEL`	`debug` \| `info` (default) \| `warn` \| `error`.

Request limits

HTTP request bodies are capped at 256 KiB (262144 bytes). After the X-Gateway-S2S check passes, a Content-Length above the cap returns 413 with a JSON-RPC error; bodies without Content-Length are capped by the MCP SDK transport. Unauthenticated requests still get 401 first.
tools/call arguments are capped at 10,000 elements (every array item and object key at any depth). Larger inputs return an isError tool result and are never dispatched.

These limits address CVE-2026-111768 / GHSA-46jr-4wx8-v453 (memory exhaustion during validation) and GHSA-f897-62hf-6gxq (no request body / batch cap).

Tools

Companies

msp360_list_companies - list companies (customer organizations) under this provider account.
msp360_get_company - get a single company by ID.

Computers

msp360_list_computers - paginated list of managed computers (endpoints).
msp360_get_computer - get a single computer by HID.

Backup Plans

msp360_list_plans - list backup/restore plans on a computer.
msp360_get_plan - get a single plan by ID.
msp360_get_plan_info - get status/info for a plan.
msp360_get_plan_history - get run history for a plan, optionally filtered to a date.
msp360_start_plan - start a backup run for a plan.
msp360_stop_plan - stop a currently running backup for a plan.

Monitoring

msp360_get_monitoring - status data for the latest plan runs on all endpoints.
msp360_get_monitoring_for_user - status data for the latest plan runs, filtered by user.

Licenses

msp360_list_licenses - list available licenses, optionally filtered to unassigned ones.
msp360_get_license - get a single license by ID.

Scope

This is a v1 / MVP surface covering the core "what's backed up and is it healthy" MSP workflow. Explicitly out of scope for now: Administrators, Billing, Builds, Packages, Destinations/Accounts (storage-provisioning config), Users/Authenticate, and License Grant/Release/Revoke (mutating license assignment) and computer authorization/de-authorization - these are provider/reseller-admin-console-level operations with real billing/access consequences, distinct from day-to-day MSP monitoring, and worth a deliberate separate decision later rather than bundling into v1.

Development

npm install
npm run build
npm test
npm run lint   # tsc --noEmit

Docker

docker build -t msp360-mcp .
docker run -p 8080:8080 -e MSP360_USERNAME=... -e MSP360_PASSWORD=... msp360-mcp

Reviews

No reviews yet

Be the first to review this server!

4.8

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.