Tactical Rmm Exec MCP Server
Tactical RMM agent search and read-only PowerShell execution via Microsoft Entra.
Data last scanned today · Reviewed today
Overview
This MCP server provides a controlled interface for Tactical RMM environments, enabling discovery of agents and execution of diagnostic scripts. It leverages Microsoft Entra for authentication, ensuring only authorized personnel can connect. The system is designed to provide visibility into machine status, audit logs, and hardware configurations without allowing administrative changes. Safety is enforced through a multi-layered guard mechanism within the PowerShell execution environment. It restricts usage to pre-approved read-only cmdlets while actively blocking dangerous tokens and obfuscated commands that could potentially alter system state.
Our verdict
With a high-risk security score of 22/100, this tool should be treated with extreme caution. The project lacks a software license and operates as a community-maintained repository without editorial review. While it implements a technical guardrail for read-only PowerShell commands, the author explicitly warns that this is not a sandbox; users must limit the TRMM_API_KEY to an account with a restricted blast radius to avoid accidental system impact.
- Strict PowerShell cmdlet verb allowlist prevents mutating operations.
- Entra-gated authentication restricts server access to authorized users.
- Zero direct dependencies minimize the software supply-chain surface area.
- Real documentation provided for setup and security guardrail logic.
- No detected software license creates ambiguity regarding legal usage.
- Community-maintained status lacks formal vendor verification or support.
- Single contributor architecture creates a high bus-factor risk.
Tools
| Tool | Description | Risk |
|---|---|---|
| search_agents | Find machines (filter by hostname/type/platform/status). | low |
| get_agent | Full detail for one agent (hardware, OS, IPs, checks, reboot state). | low |
| resolve_agent | Hostname to agent_id (errors if 0/>1). | low |
| search_audit_log | TRMM's own audit trail (who did what in TRMM). | low |
| run_readonly_script | Run information-gathering PowerShell (event logs, services, software, config). Mutating scripts refused. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›How does the server ensure that PowerShell scripts remain read-only?
The server employs a two-layer guard. It uses a cmdlet verb allowlist to restrict actions to read-only verbs like Get and Test, and a dangerous-token denylist to block state-changing commands, obfuscation techniques, and native destructive utilities.
›What authentication mechanism is used for this MCP server?
The server uses Microsoft Entra authentication. It validates audience-bound tokens and requires that users belong to a specific Entra security group with assignment enabled.
›What permissions are required for the Tactical RMM account associated with this server?
The account requires both read and Send Command permissions on the Tactical RMM platform. While the server's guard prevents state-changing scripts, the account should be scoped appropriately, especially when dealing with domain controllers.
›Can I disable authentication for testing purposes?
Yes, you can set MCP_AUTH_ENABLED to false to bypass Entra authentication when testing the server locally using the MCP Inspector.
›Is this server a secure sandbox for running arbitrary scripts?
No, this is not a sandbox. The read-only guard is a defense-in-depth backstop, and you must still ensure that the provided TRMM_API_KEY is restricted to an account with an acceptable blast radius.
Badge
Maintain this server? Add the live badge to your README.