SaaS Alerts
OCI · GHCR.IO/WYRE-TECHNOLOGY/SAAS-ALERTS-MCP:V1.2.4 · SCANNED AUG 22
MCP server for Kaseya SaaS Alerts — SaaS security monitoring for M365 & Google Workspace.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security0
- Malware scan not yet available for this package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM, so there is no dependency list to read. Publishing one would let us assess it.Unverified
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1857 tokens (~61/item across 30 items; 30 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 2 categories
Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the SaaS Alerts MCP server?
SaaS Alerts runs locally as a container image, launched with docker run --rm -i ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
claude mcp add wyre-technology-saas-alerts-mcp -- docker run --rm -i ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
{
"mcpServers": {
"wyre-technology-saas-alerts-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"
]
}
}
} {
"servers": {
"wyre-technology-saas-alerts-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"
]
}
}
} codex mcp add wyre-technology-saas-alerts-mcp -- docker run --rm -i ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"wyre-technology-saas-alerts-mcp": {
"type": "local",
"command": [
"docker",
"run",
"--rm",
"-i",
"ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"
],
"enabled": true
}
}
} mcp_servers:
wyre-technology-saas-alerts-mcp:
command: "docker"
args: ["run", "--rm", "-i", "ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"] {
"McpServers": {
"wyre-technology-saas-alerts-mcp": {
"Transport": "stdio",
"Command": "docker",
"Arguments": [
"run",
"--rm",
"-i",
"ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"
]
}
}
} {
"mcpServers": {
"wyre-technology-saas-alerts-mcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Aug 26 39
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Aug 2026 · Analysed oci/ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
saas_alerts_billing_get_details ~53
Retrieve billing details for a specific billing date. Use saas_alerts_billing_list_dates first to discover available dates.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_date | string | yes | Billing date in YYYY-MM-DD format |
No output schema declared.
No examples provided.
saas_alerts_billing_list_dates ~40
List all available billing dates for the authenticated partner. Use the returned dates as input to saas_alerts_billing_get_details.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_customers_create ~42
Create a new SaaS Alerts customer for the authenticated partner.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Customer creation payload (see SaaS Alerts API docs) |
No output schema declared.
No examples provided.
saas_alerts_customers_delete ~62
⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently deletes a SaaS Alerts customer and all associated data. This action cannot be undone. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID to delete |
No output schema declared.
No examples provided.
saas_alerts_customers_get ~33
Get a single SaaS Alerts customer by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_list ~24
List all SaaS Alerts customers for the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_customers_set_account_whitelists ~68
⚠ HIGH-IMPACT. Replace the account-level whitelist for a customer. This overwrites the existing account whitelist. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Account whitelist payload |
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_set_whitelists ~73
⚠ HIGH-IMPACT. Replace the IP/country whitelist for a customer. This overwrites the existing whitelist. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Whitelist payload (IPs and/or country codes) |
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_update ~45
Update an existing SaaS Alerts customer by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Fields to update |
| customer_id | string | yes | Customer ID to update |
No output schema declared.
No examples provided.
saas_alerts_devices_list_ignored ~37
List devices that have been explicitly marked as ignored.
| Name | Type | Req | Description |
|---|---|---|---|
| organization_ids | array | yes | Organization IDs to filter by |
No output schema declared.
No examples provided.
saas_alerts_devices_list_mapped ~44
List devices that have been mapped (unified) to SaaS Alerts customer organizations.
| Name | Type | Req | Description |
|---|---|---|---|
| organization_ids | array | yes | Organization IDs to filter by |
No output schema declared.
No examples provided.
saas_alerts_devices_list_orgs ~24
List all device organizations visible to the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_devices_list_unmapped ~98
List devices that have NOT yet been mapped to a SaaS Alerts organization. Optionally filter by confidence score or whether mapping suggestions are available.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | – | Minimum confidence threshold (0–1) for mapping suggestions |
| only_with_suggestions | boolean | – | If true, return only devices that have at least one mapping suggestion |
| organization_ids | array | yes | Organization IDs to include in the search |
No output schema declared.
No examples provided.
saas_alerts_events_count ~104
Count security events matching the given filters without fetching full records.
| Name | Type | Req | Description |
|---|---|---|---|
| alert_status | string | – | Filter by alert severity |
| customer_id | string | – | Filter by customer ID |
| end_date | string | – | End of range — ISO-8601 timestamp or epoch ms (inclusive) |
| event_type | array | – | Filter by event types |
| start_date | string | – | Start of range — ISO-8601 timestamp or epoch ms (inclusive) |
No output schema declared.
No examples provided.
saas_alerts_events_count_advanced ~37
Count events using a raw Elasticsearch query body without fetching full records.
| Name | Type | Req | Description |
|---|---|---|---|
| query | object | yes | Elasticsearch query body |
No output schema declared.
No examples provided.
saas_alerts_events_query ~264
Query security events from SaaS Alerts with optional filters. Returns a paginated list of events matching the specified criteria. Events are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — over-cap result sets are truncated to the first events that fit, so prefer a modest size with from/size pagination or a narrower date range.
| Name | Type | Req | Description |
|---|---|---|---|
| alert_status | string | – | Filter by alert severity |
| customer_id | string | – | Filter by SaaS Alerts customer ID |
| end_date | string | – | End of range — ISO-8601 timestamp or epoch ms (inclusive) |
| event_type | array | – | Filter by one or more event types |
| from | number | – | Offset for pagination |
| size | number | – | Maximum results to return (default 50) |
| start_date | string | – | Start of range — ISO-8601 timestamp or epoch ms (inclusive) |
| time_sort | string | – | Sort direction on event timestamp |
| user_email | string | – | Filter by user email (UPN) |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_events_query_advanced ~168
Execute an advanced Elasticsearch query against the SaaS Alerts events index. Accepts a raw Elasticsearch query body for maximum flexibility. Event hits are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — over-cap hit lists are truncated to the first hits that fit (hits.total still reports the true match count), so prefer a modest size with from/size in the query body.
| Name | Type | Req | Description |
|---|---|---|---|
| query | object | yes | Elasticsearch query body (e.g. { "query": { "term": { "alertStatus": "critical" } } }) |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_events_scroll ~163
Continue paginating through a previous event query result set using a scroll ID. Call after saas_alerts_events_query_advanced returns a scroll ID. Event hits are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — if a scroll page exceeds the cap it is truncated, and the trimmed events canNOT be recovered by continuing the scroll (the server cursor has already advanced past them); re-run the originating query with a smaller size instead.
| Name | Type | Req | Description |
|---|---|---|---|
| scroll_id | string | yes | Scroll ID returned by a previous query |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_navigate ~67
Browse a domain to see its available tools and descriptions. All tools are callable at any time — navigation is optional discovery, not a gate.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to inspect. One of: events, customers, users, devices, billing, reports, partner |
No output schema declared.
No examples provided.
saas_alerts_partner_get_profile ~24
Get the partner profile associated with the authenticated API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_partner_update_branding ~63
⚠ HIGH-IMPACT. Update the partner branding settings (logo, colours, etc.). This overwrites existing branding. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Branding payload (logoUrl, primaryColor, etc.) |
No output schema declared.
No examples provided.
saas_alerts_recommended_actions ~38
Get the list of recommended remediation actions for SaaS Alerts event types. Use this to map detected event types to actionable guidance.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_reports_create_scheduled ~38
Create a new scheduled report.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Scheduled report configuration payload (see SaaS Alerts API docs) |
No output schema declared.
No examples provided.
saas_alerts_reports_delete_scheduled ~58
⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently delete a scheduled report. This action cannot be undone. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| report_id | string | yes | Scheduled report ID to delete |
No output schema declared.
No examples provided.
saas_alerts_reports_get_scheduled ~34
Get a specific scheduled report by its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| report_id | string | yes | Scheduled report ID |
No output schema declared.
No examples provided.
saas_alerts_reports_list_scheduled ~24
List all scheduled reports configured for the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_status ~34
Check connectivity to SaaS Alerts by fetching the authenticated MSP user. Returns the list of available domains and connection status.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_users_get_msp ~35
Get the MSP user profile associated with the authenticated API key. Also used as a connectivity / credential check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_users_list_by_customer ~40
List all users belonging to a specific SaaS Alerts customer.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID to list users for |
No output schema declared.
No examples provided.
saas_alerts_users_list_partner ~23
List all users associated with the authenticated partner account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the SaaS Alerts MCP server?
SaaS Alerts is an MCP server listed in the public MCP registry as io.github.wyre-technology/saas-alerts-mcp. MCP server for Kaseya SaaS Alerts, SaaS security monitoring for M365 & Google Workspace. This page covers its container image (ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4).
Is the SaaS Alerts MCP server safe to use?
SaaS Alerts scores 39 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SaaS Alerts MCP server expose?
SaaS Alerts exposes 30 tools: saas_alerts_navigate, saas_alerts_status, saas_alerts_events_query, saas_alerts_events_count, saas_alerts_events_query_advanced, and 25 more. Their descriptions and schemas cost roughly 1,857 tokens of context every time the server is loaded.
Is the SaaS Alerts MCP server still maintained?
SaaS Alerts is still listed as active in the MCP registry. We last reached this channel on 22 August 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SaaS Alerts MCP server under?
SaaS Alerts declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.