SaaS Alerts
OCI · GHCR.IO/WYRE-TECHNOLOGY/SAAS-ALERTS-MCP:V1.2.4
MCP server for Kaseya SaaS Alerts — SaaS security monitoring for M365 & Google Workspace.
Available components
Last scanned (1 hour ago)
Scores higher than 70% of OCI servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency6
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: the license (NOASSERTION) isn't a recognized OSI-approved license. See how to fix → Fail
- Actively maintained (last published 56 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1857 tokens (~61/item across 30 items; 30 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety92
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "saas_alerts_events_query_advanced" implies "execute" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 −3
No change was recorded against any check on this day. Stability & Change Management went from 97 to 80.
- 10 Oct 26 +2
No change was recorded against any check on this day. Stability & Change Management went from 87 to 97. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Oct 26 −2
- Stability: pass → 0.87 functional
- 4 Oct 26 0
- Stability: 0.97 → pass security
- 3 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed oci/ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
saas_alerts_billing_get_details ~53
Retrieve billing details for a specific billing date. Use saas_alerts_billing_list_dates first to discover available dates.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_date | string | yes | Billing date in YYYY-MM-DD format |
No output schema declared.
No examples provided.
saas_alerts_billing_list_dates ~40
List all available billing dates for the authenticated partner. Use the returned dates as input to saas_alerts_billing_get_details.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_customers_create ~42
Create a new SaaS Alerts customer for the authenticated partner.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Customer creation payload (see SaaS Alerts API docs) |
No output schema declared.
No examples provided.
saas_alerts_customers_delete ~62
⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently deletes a SaaS Alerts customer and all associated data. This action cannot be undone. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID to delete |
No output schema declared.
No examples provided.
saas_alerts_customers_get ~33
Get a single SaaS Alerts customer by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_list ~24
List all SaaS Alerts customers for the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_customers_set_account_whitelists ~68
⚠ HIGH-IMPACT. Replace the account-level whitelist for a customer. This overwrites the existing account whitelist. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Account whitelist payload |
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_set_whitelists ~73
⚠ HIGH-IMPACT. Replace the IP/country whitelist for a customer. This overwrites the existing whitelist. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Whitelist payload (IPs and/or country codes) |
| customer_id | string | yes | Customer ID |
No output schema declared.
No examples provided.
saas_alerts_customers_update ~45
Update an existing SaaS Alerts customer by ID.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Fields to update |
| customer_id | string | yes | Customer ID to update |
No output schema declared.
No examples provided.
saas_alerts_devices_list_ignored ~37
List devices that have been explicitly marked as ignored.
| Name | Type | Req | Description |
|---|---|---|---|
| organization_ids | array | yes | Organization IDs to filter by |
No output schema declared.
No examples provided.
saas_alerts_devices_list_mapped ~44
List devices that have been mapped (unified) to SaaS Alerts customer organizations.
| Name | Type | Req | Description |
|---|---|---|---|
| organization_ids | array | yes | Organization IDs to filter by |
No output schema declared.
No examples provided.
saas_alerts_devices_list_orgs ~24
List all device organizations visible to the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_devices_list_unmapped ~98
List devices that have NOT yet been mapped to a SaaS Alerts organization. Optionally filter by confidence score or whether mapping suggestions are available.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | number | – | Minimum confidence threshold (0–1) for mapping suggestions |
| only_with_suggestions | boolean | – | If true, return only devices that have at least one mapping suggestion |
| organization_ids | array | yes | Organization IDs to include in the search |
No output schema declared.
No examples provided.
saas_alerts_events_count ~104
Count security events matching the given filters without fetching full records.
| Name | Type | Req | Description |
|---|---|---|---|
| alert_status | string | – | Filter by alert severity |
| customer_id | string | – | Filter by customer ID |
| end_date | string | – | End of range — ISO-8601 timestamp or epoch ms (inclusive) |
| event_type | array | – | Filter by event types |
| start_date | string | – | Start of range — ISO-8601 timestamp or epoch ms (inclusive) |
No output schema declared.
No examples provided.
saas_alerts_events_count_advanced ~37
Count events using a raw Elasticsearch query body without fetching full records.
| Name | Type | Req | Description |
|---|---|---|---|
| query | object | yes | Elasticsearch query body |
No output schema declared.
No examples provided.
saas_alerts_events_query ~264
Query security events from SaaS Alerts with optional filters. Returns a paginated list of events matching the specified criteria. Events are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — over-cap result sets are truncated to the first events that fit, so prefer a modest size with from/size pagination or a narrower date range.
| Name | Type | Req | Description |
|---|---|---|---|
| alert_status | string | – | Filter by alert severity |
| customer_id | string | – | Filter by SaaS Alerts customer ID |
| end_date | string | – | End of range — ISO-8601 timestamp or epoch ms (inclusive) |
| event_type | array | – | Filter by one or more event types |
| from | number | – | Offset for pagination |
| size | number | – | Maximum results to return (default 50) |
| start_date | string | – | Start of range — ISO-8601 timestamp or epoch ms (inclusive) |
| time_sort | string | – | Sort direction on event timestamp |
| user_email | string | – | Filter by user email (UPN) |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_events_query_advanced ~168
Execute an advanced Elasticsearch query against the SaaS Alerts events index. Accepts a raw Elasticsearch query body for maximum flexibility. Event hits are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — over-cap hit lists are truncated to the first hits that fit (hits.total still reports the true match count), so prefer a modest size with from/size in the query body.
| Name | Type | Req | Description |
|---|---|---|---|
| query | object | yes | Elasticsearch query body (e.g. { "query": { "term": { "alertStatus": "critical" } } }) |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_events_scroll ~163
Continue paginating through a previous event query result set using a scroll ID. Call after saas_alerts_events_query_advanced returns a scroll ID. Event hits are compacted to triage-relevant fields by default; pass verbose: true for full raw records. Compact responses are capped at ~40,000 characters — if a scroll page exceeds the cap it is truncated, and the trimmed events canNOT be recovered by continuing the scroll (the server cursor has already advanced past them); re-run the originating query with a smaller size instead.
| Name | Type | Req | Description |
|---|---|---|---|
| scroll_id | string | yes | Scroll ID returned by a previous query |
| verbose | boolean | – | Return full raw event records (large). Default false: events are compacted to triage-relevant fields. |
No output schema declared.
No examples provided.
saas_alerts_navigate ~67
Browse a domain to see its available tools and descriptions. All tools are callable at any time — navigation is optional discovery, not a gate.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to inspect. One of: events, customers, users, devices, billing, reports, partner |
No output schema declared.
No examples provided.
saas_alerts_partner_get_profile ~24
Get the partner profile associated with the authenticated API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_partner_update_branding ~63
⚠ HIGH-IMPACT. Update the partner branding settings (logo, colours, etc.). This overwrites existing branding. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Branding payload (logoUrl, primaryColor, etc.) |
No output schema declared.
No examples provided.
saas_alerts_recommended_actions ~38
Get the list of recommended remediation actions for SaaS Alerts event types. Use this to map detected event types to actionable guidance.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_reports_create_scheduled ~38
Create a new scheduled report.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | yes | Scheduled report configuration payload (see SaaS Alerts API docs) |
No output schema declared.
No examples provided.
saas_alerts_reports_delete_scheduled ~58
⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently delete a scheduled report. This action cannot be undone. Confirm with the user before invoking.
| Name | Type | Req | Description |
|---|---|---|---|
| report_id | string | yes | Scheduled report ID to delete |
No output schema declared.
No examples provided.
saas_alerts_reports_get_scheduled ~34
Get a specific scheduled report by its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| report_id | string | yes | Scheduled report ID |
No output schema declared.
No examples provided.
saas_alerts_reports_list_scheduled ~24
List all scheduled reports configured for the authenticated partner.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_status ~34
Check connectivity to SaaS Alerts by fetching the authenticated MSP user. Returns the list of available domains and connection status.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_users_get_msp ~35
Get the MSP user profile associated with the authenticated API key. Also used as a connectivity / credential check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
saas_alerts_users_list_by_customer ~40
List all users belonging to a specific SaaS Alerts customer.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Customer ID to list users for |
No output schema declared.
No examples provided.
saas_alerts_users_list_partner ~23
List all users associated with the authenticated partner account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the SaaS Alerts MCP server?
SaaS Alerts runs locally as a container image, launched with docker run --rm -i -e SAAS_ALERTS_API_KEY -e MCP_TRANSPORT -e AUTH_MODE -e LOG_LEVEL ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
claude mcp add wyre-technology-saas-alerts-mcp -- docker run --rm -i -e SAAS_ALERTS_API_KEY -e MCP_TRANSPORT -e AUTH_MODE -e LOG_LEVEL ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4
This image reads SAAS_ALERTS_API_KEY, MCP_TRANSPORT, AUTH_MODE and LOG_LEVEL. Set them in your client's env block for this server; docker run -e passes each one through to the container.
What is the SaaS Alerts MCP server?
SaaS Alerts is an MCP server listed in the public MCP registry as io.github.wyre-technology/saas-alerts-mcp. MCP server for Kaseya SaaS Alerts, SaaS security monitoring for M365 & Google Workspace. This page covers its container image (ghcr.io/wyre-technology/saas-alerts-mcp:v1.2.4).
Is the SaaS Alerts MCP server safe to use?
SaaS Alerts scores 48 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SaaS Alerts MCP server expose?
SaaS Alerts exposes 30 tools: saas_alerts_navigate, saas_alerts_status, saas_alerts_events_query, saas_alerts_events_count, saas_alerts_events_query_advanced, and 25 more. Their descriptions and schemas cost roughly 1,857 tokens of context every time the server is loaded.
Is the SaaS Alerts MCP server still maintained?
SaaS Alerts is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SaaS Alerts MCP server under?
SaaS Alerts declares the NOASSERTION licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.