Tickiti MCP Server

tickiti-mcp

An MCP (Model Context Protocol) server that exposes the Tickiti helpdesk API to AI assistants such as Claude. It is a thin shim over the Tickiti Public API v1 (/api/v1/...): each MCP tool forwards to a v1 endpoint, adding your bearer token and — for writes — an idempotency key. The token's abilities are the security boundary: the server only relays calls, it never widens them, so a read-only token gives a read-only assistant.

📖 Full documentation: https://www.tickiti.com/docs/topic/mcp_server/

Tools

The ticket tools have full, validated inputs; the rest of the API is reachable through two general tools, so the whole surface is available without a separate tool per endpoint.

Tickets

Settings, templates, mail, administration

For anything beyond the named tools (mail, templates, workflow writes, administration, supervisor), the assistant uses list_endpoints to discover the action, then tickiti_call to run it — covering all of the v1 API.

Requirements

• Node.js 20 or newer
• A Tickiti API token, minted from Administration → API keys, scoped to the abilities you want the assistant to have
• An MCP-capable client — e.g. Claude Code or the Claude desktop app

Install

git clone https://github.com/tickiti/tickiti-mcp.git
cd tickiti-mcp
npm install
npm run build

The built server is dist/server.js.

Configure

The server reads two environment variables (it fails fast on startup if either is missing):

More than one instance

To reach several Tickiti installs from one server (production and staging, say), add TICKITI_INSTANCES: JSON, or the path of a JSON file, mapping a name to { "base", "token" }. The TICKITI_API_BASE / TICKITI_API_TOKEN pair stays the default instance, named by TICKITI_INSTANCE_NAME (default default).

TICKITI_INSTANCE_NAME=production
TICKITI_INSTANCES='{"staging": {"base": "https://staging.example.com", "token": "…"}}'

Every tool then takes an optional instance argument; list_instances shows the names.

Use with Claude Code

claude mcp add tickiti \
  --env TICKITI_API_BASE=https://support.example.com \
  --env TICKITI_API_TOKEN=YOUR_TICKITI_API_TOKEN \
  -- node /absolute/path/to/tickiti-mcp/dist/server.js

Confirm with claude mcp list (or /mcp in a session). Remove with claude mcp remove tickiti.

Other MCP clients configure servers in their own settings file, but the shape is the same: run node /absolute/path/to/tickiti-mcp/dist/server.js as a stdio server with TICKITI_API_BASE and TICKITI_API_TOKEN set in its environment.

Permissions & security

The server adds no permissions of its own. Every call runs as the staff user the token belongs to, gated by the token's abilities — exactly as a direct API call would be. To limit what an assistant can do, mint a narrowly-scoped token:

• A read-only token (e.g. tickets:read, reports:read) gives an assistant that can look but not change anything.
• Grant write abilities only for the families the assistant needs to act on.
• If a call is refused, the server reports the reason (missing ability, role or plan).

The ticket-writing tools send an idempotency key with every call, so a retried request never creates a duplicate ticket or response.

Long bodies can be given as content_path (a local file) instead of content, and files and images always go by path: the server reads them, so their bytes never pass through the model.

How it works

Maintainers

src/generated/manifest.ts is generated from Tickiti's own route table (php artisan route:list --json), so abilities, roles, plan gates and path params are never hand-maintained. Regenerate against a Tickiti checkout after the API changes:

TICKITI_DIR=/path/to/tickiti npm run manifest

There is an end-to-end sweep over every endpoint in tests/all-paths.mjs (npm run test:paths, needs a base URL and a full-ability token against a scratch instance), and an offline check of the tool registration in tests/smoke-tools.mjs (npm run build && node tests/smoke-tools.mjs).

Several tools call endpoints added to Tickiti in October 2026. Against an older install they return 404; list_endpoints describes the newest API.

License

MIT © Oxenic