servosity/msp-skills/connectwise-automate

ConnectWise Automate Claude Code Skill

Prerequisites: Install the CLI

This skill drives the connectwise-automate-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/connectwise-automate/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/connectwise-automate/install.ps1 | iex ``

1. Verify: connectwise-automate-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the connectwise-automate-cli and connectwise-automate-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

ConnectWise Automate's value is locked behind a per-server console built for one-endpoint-at-a-time work. This CLI syncs your whole fleet - computers, clients, locations, alerts, and patch history - into local SQLite, then answers the questions MSPs actually ask across clients: where the offline agents are (stale-agents), who's behind on patches (patch-compliance), and what changed overnight (since). Everything is offline, scriptable, and agent-native.

When to Use This CLI

Use this CLI when an agent or tech needs cross-client answers from ConnectWise Automate - fleet-wide health, stale-agent sweeps, patch compliance by client, alert triage, or overnight drift - rather than clicking through the per-server console one endpoint at a time. It is also the right tool for scripting Automate reads into other automation and for safe, dry-run-first command/patch actions.

Unique Capabilities

Cross-client roll-ups the per-server UI can't do

• `fleet-health` - See every agent across every client in one roll-up: online/offline, last-contact age, and open-alert count, grouped by client.

_Reach for this when an agent needs the whole-fleet posture in one shot instead of paging the Computers endpoint client by client._

``bash connectwise-automate-cli fleet-health --agent ``

• `stale-agents` - List computers not seen in N days, grouped by client - the offline agents bleeding license and hiding risk.

_Use before license true-ups or security reviews to find agents that stopped checking in._

``bash connectwise-automate-cli stale-agents --days 30 --agent ``

• `patch-compliance` - Per-client patch posture from synced patch history joined to computers - worst offenders first.

_Pull this before a QBR or a security conversation to name the clients that are behind._

``bash connectwise-automate-cli patch-compliance --agent ``

• `client-rollup` - One-line-per-client snapshot: computers, locations, offline agents, and open alerts - built for the client review.

_The fastest way to brief on a client's whole environment without clicking through the console._

``bash connectwise-automate-cli client-rollup --agent ``

Triage and inventory

• `alert-triage` - Open alerts across every client, ranked by priority and joined to computer → location → client, with duplicates collapsed.

_Start the morning here to see what actually needs a human across the whole book of business._

``bash connectwise-automate-cli alert-triage --min-priority 3 --agent ``

• `os-inventory` - Fleet-wide operating-system distribution with end-of-life OSes (Windows 7, Server 2008/2012) flagged for upgrade planning.

_Use for security and hardware-refresh planning when you need the EOL exposure across every client at once._

``bash connectwise-automate-cli os-inventory --eol-only --agent ``

• `since` - Fleet activity in the last N hours from the records' own timestamps: alerts created, agents that checked in, and patches installed.

_Run first thing to catch overnight activity across the fleet without paging each endpoint._

``bash connectwise-automate-cli since --hours 24 --agent ``

• `agent-versions` - Automate agent versions across every client, newest first, with the computers still behind counted per client.

_Run after a server upgrade to find the agents that did not update: they are the ones that stop patching and running scripts first._

``bash connectwise-automate-cli agent-versions --behind-only --agent ``

--ca-cert, CONNECTWISE_AUTOMATE_CA_CERT, or ca_cert adds a PEM CA bundle to the system trust roots. --tls-server-name, CONNECTWISE_AUTOMATE_TLS_SERVER_NAME, or tls_server_name is the name checked against the certificate. Precedence is flag, then environment, then the config file. A config file other users can change does not supply these settings. doctor reports the trust in use and names the setting that fixes a chain or hostname failure.

Command Reference

alerts - Open monitor alerts across the fleet

• connectwise-automate-cli alerts get - Get a single alert by Id
• connectwise-automate-cli alerts list - List open alerts across all computers

apitoken - Mint and refresh API bearer tokens

• connectwise-automate-cli apitoken mint - Mint a bearer token from username + password (needs CONNECTWISE_AUTOMATE_SERVER + clientId header)
• connectwise-automate-cli apitoken refresh - Refresh an existing (still-valid) bearer token

clients - Clients (companies / customers) in Automate

• connectwise-automate-cli clients get - Get a single client by Id
• connectwise-automate-cli clients list - List all clients

commands - Available commands that can be executed on agents

• connectwise-automate-cli commands get - Get a single command by Id
• connectwise-automate-cli commands list - List all available commands

computers - Managed endpoints (agents) - the core RMM inventory

• connectwise-automate-cli computers alerts - Open alerts for one computer
• connectwise-automate-cli computers command-execute - Execute a command on one computer (WRITE - runs a real command on the agent)
• connectwise-automate-cli computers command-history - Recent command execution history for one computer
• connectwise-automate-cli computers get - Get a single computer by Id
• connectwise-automate-cli computers list - List computers across the fleet (paginated, filterable)
• connectwise-automate-cli computers patching-stats - Patch installation statistics for one computer
• connectwise-automate-cli computers software - Installed software inventory for one computer

contacts - Client contacts

• connectwise-automate-cli contacts - List all client contacts

groups - Computer groups (organizational + policy grouping)

• connectwise-automate-cli groups get - Get a single group by Id
• connectwise-automate-cli groups list - List all groups

locations - Locations (sites) belonging to clients

• connectwise-automate-cli locations get - Get a single location by Id
• connectwise-automate-cli locations list - List all locations

monitors - Monitors and their per-monitor statistics

• connectwise-automate-cli monitors list - List monitors with their alerting statistics
• connectwise-automate-cli monitors sensor-checks - List sensor checks

network-devices - Discovered network devices (non-agent)

• connectwise-automate-cli network-devices - List discovered network devices

patching - Patch history, compliance information, and patch policies

• connectwise-automate-cli patching approval-policies - Patch approval policies
• connectwise-automate-cli patching deploy-approved - Deploy all approved patches (WRITE - triggers fleet patch deployment)
• connectwise-automate-cli patching deploy-security - Deploy all security patches (WRITE - triggers fleet patch deployment)
• connectwise-automate-cli patching information - Global patch information / catalog status
• connectwise-automate-cli patching list - Fleet-wide patch installation history
• connectwise-automate-cli patching microsoft-policies - Microsoft update policies
• connectwise-automate-cli patching reattempt-failed - Reattempt failed patches (WRITE - retries failed patch installs)
• connectwise-automate-cli patching thirdparty-policies - Third-party update policies

scripts - Automation scripts and their run state

• connectwise-automate-cli scripts list - List all scripts
• connectwise-automate-cli scripts running - List scripts currently running across the fleet
• connectwise-automate-cli scripts schedules - List scheduled script runs

server - Automate server metadata (used by doctor / health)

• connectwise-automate-cli server db-time - Current database server time
• connectwise-automate-cli server get - Server version and metadata

agent-versions

• connectwise-automate-cli agent-versions - Automate agent versions across every client, newest first, with the computers still behind counted per client.

alert-triage

• connectwise-automate-cli alert-triage - Open alerts across every client, ranked by priority and joined to computer → location → client, with duplicates collapsed.

client-rollup

• connectwise-automate-cli client-rollup - One-line-per-client snapshot: computers, locations, offline agents, and open alerts - built for the client review.

fleet-health

• connectwise-automate-cli fleet-health - See every agent across every client in one roll-up: online/offline, last-contact age, and open-alert count, grouped by client.

os-inventory

• connectwise-automate-cli os-inventory - Fleet-wide operating-system distribution with end-of-life OSes (Windows 7, Server 2008/2012) flagged for upgrade planning.

patch-compliance

• connectwise-automate-cli patch-compliance - Per-client patch posture from synced patch history joined to computers - worst offenders first.

since

• connectwise-automate-cli since - Fleet activity in the last N hours from the records' own timestamps: alerts created, agents that checked in, and patches installed.

stale-agents

• connectwise-automate-cli stale-agents - List computers not seen in N days, grouped by client - the offline agents bleeding license and hiding risk.

Finding the right command

When you know what you want to do but not which command does it, ask the CLI directly:

connectwise-automate-cli which "<capability in your own words>"

which resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code 0 means at least one match; exit code 2 means no confident match - fall back to --help or use a narrower query. --json (and other machine formats) keep that exit-2 contract and write {"matches":[]} on stdout so agents can inspect the envelope without treating a miss as success.

Recipes

Morning triage across all clients

connectwise-automate-cli alert-triage --min-priority 3 --agent --select client,computer,priority,message

Narrows the alert payload to the four fields that matter so an agent doesn't burn context on the full alert objects.

Find offline agents for a license true-up

connectwise-automate-cli stale-agents --days 45 --agent

Lists computers not seen in 45 days, grouped by client, straight from the local store.

Patch posture for a QBR

connectwise-automate-cli patch-compliance --agent