Tactical RMM MCP

Scan locally synced data for items that are missing important fields such as assignee, project, priority, or labels. Useful for triaging unowned work.

Roll pending Windows updates and reboots up to each client or site from the local store.

Rolls pending Windows updates and reboots up to each client or site from the local store. For a per-client posture row across all signals (not just patches), use 'clients scorecard'.

Get, create, update, and delete scripts

Run download operations for scripts

Create test for scripts

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Get, create, and update services

Use this command to find agents where a named Windows service is stopped. Do NOT use it to find installed software packages; use 'software find' instead. Services are not stored locally, so this fans out live to GET /services/{agent_id}/ for each synced agent, capped by --max-scan-agents. Read-only.

Reports new alerts and newly-offline agents within the window (e.g. 2h, 24h, 7d), derived from synced timestamps. Reads only the local store.

Get, create, and update software

Searches synced per-agent software inventory for a package name (case-insensitive substring) and lists each agent, version and publisher. Reads only the local store. To find agents where a Windows service is stopped instead, use 'services down'.

Create uninstall for software

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Scan locally synced data for items that have not been updated within the specified number of days. Useful for identifying forgotten or blocked work.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Execute one tactical-rmm API endpoint by its endpoint_id (from tactical-rmm_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the tactical-rmm API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Scores every synced agent across offline state, failing checks, pending reboots, patches and pending actions, then ranks them. Use this to rank individual agents by how much attention they need. To rank failing checks by blast radius instead, use 'checks worst'.

Get and update winupdate

Create install for winupdate

Create scan for winupdate

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.

Show local archive status and sync state for all resources