Syncro MCP

alerts subcommands: noise, orphans

Count RMM alerts per customer over the lookback window using each alert's created timestamp, resolving customer names from synced customers when present. Customers are ranked by alert count, descending.

List RMM alerts in the window that have no matching ticket. An alert is considered converted when a ticket exists for the same asset (or customer when no asset id is present) created within the proximity window of the alert.

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

assets subcommands: patch-gaps

Scan the patches table for patches whose status indicates they are not yet installed (missing, pending, available, needed, not installed), join each patch to its asset and the asset's customer, and rank assets by missing-patch count.

billing subcommands: ar-aging, drift, uninvoiced

Bucket unpaid (is_paid=0) invoices from the local store into accounts-receivable aging tiers based on the age of each invoice's due date (falling back to invoice date, then created_at). Sums the outstanding total per bucket.

List tickets in the local store whose status is Resolved or Closed and whose close/resolve timestamp is older than --closed-before, but which have no linked invoice (no invoices row references their ticket id).

Aggregate timer entries from the local store that have not yet been invoiced (no invoice_id and not explicitly marked non-chargeable), join each entry's ticket to its customer, and group uninvoiced hours per customer.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Export paginated API data to a local file. Supports JSONL (one JSON object per line, streaming-friendly) and JSON (array). JSONL is recommended for large datasets as it has no memory pressure.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Analyze locally synced data to show how many items are assigned to each person. Helps identify overloaded team members and unbalanced workload.

Scan locally synced data for items that are missing important fields such as assignee, project, priority, or labels. Useful for triaging unowned work.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

snapshot subcommands: diff

Capture a content-hash snapshot of the local store, then diff it against the most recent prior snapshot older than --since, reporting added/removed/changed counts per resource type. The first run records a baseline and exits.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Scan locally synced data for items that have not been updated within the specified number of days. Useful for identifying forgotten or blocked work.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Execute one syncro API endpoint by its endpoint_id (from syncro_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the syncro API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Create apply for ticket blueprints

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources