servosity/msp-skills/datto-rmm

Datto RMM - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the datto-rmm-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/datto-rmm/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/datto-rmm/install.ps1 | iex ``

1. Verify: datto-rmm-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the datto-rmm-cli and datto-rmm-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

datto-rmm-cli mirrors the full Datto RMM v2 API (sites, devices, alerts, jobs, audit, variables) and syncs your whole multi-site fleet into local SQLite. That unlocks questions no single API call can answer: stale devices, alert storms, software sprawl, warranty cliffs, patch and AV gaps, and one-shot QBR scorecards - all offline, agent-native, and composable with jq.

When to Use This CLI

Use this CLI when an agent or MSP technician needs to answer fleet-wide questions about a Datto RMM account - which endpoints are stale, unprotected, behind on patches, or out of warranty - or to script bulk reads/writes (alerts, variables, quick jobs) that the web UI makes tedious. It is the right tool when the question spans more than one customer site, because the answer lives in the local store, not a single API call.

Anti-triggers

Do not use this CLI for:

• Do not use this CLI for one-off interactive tasks better done in the Datto RMM web console (remote-control sessions, monitor policy editing, component authoring) - the API does not expose those surfaces.
• Do not use it for other RMM platforms (NinjaOne, N-central, ConnectWise Automate) - each has its own connector.
• Do not use it for Datto BCDR/backup appliances - that is the datto-bcdr connector, a separate API.
• Do not use fleet analytics output as live truth without running sync first - the local store starts empty and reflects the last sync, not the current console.
• Do not script destructive bulk writes (resetApiKeys, site moves, bulk resolve) without --dry-run/plan-only review first; fleet resolve-storm refuses to act without --confirm.

Unique Capabilities

Fleet hygiene that compounds

• `fleet stale` - Lists every device across all customer sites that hasn't checked in within a chosen window, so you catch dead agents before the customer does.

_Reach for this when you need the authoritative list of unreachable or abandoned endpoints across the entire fleet, not just one site._

``bash datto-rmm-cli fleet stale --days 30 --agent --select hostname,siteName,lastSeen,online ``

• `fleet sprawl` - Rolls up audited software across the whole fleet to show how many installs of an app exist and the spread of versions, exposing license waste and unpatched copies.

_Reach for this when you need a license-true or vulnerability-true count of an application across every endpoint, not a per-device lookup._

``bash datto-rmm-cli fleet sprawl --name "Google Chrome" --agent ``

• `fleet agent-drift` - Shows which devices run out-of-date RMM agents across the fleet, ranked by how far behind the newest version they are.

_Reach for this to find endpoints whose stale RMM agent may be missing monitors before troubleshooting visibility gaps._

``bash datto-rmm-cli fleet agent-drift --agent --select hostname,siteName,cagVersion,lastSeen ``

• `fleet udf` - Rolls one device user-defined field up across every synced site: each distinct value with its device and site counts, how many devices leave it empty, and the devices behind one value or behind the gaps.

_Reach for this when a UDF carries an MSP convention (contract tier, backup state, owner) and you need every device across every customer that breaks it._

``bash datto-rmm-cli fleet udf udf7 --agent ``

Alert intelligence

• `fleet storms` - Ranks the noisiest devices and sites by alert volume over a time window so the NOC can tune monitors instead of drowning in tickets.

_Reach for this to find the alert-fatigue offenders driving ticket volume before recommending monitor or threshold changes._

``bash datto-rmm-cli fleet storms --days 7 --top 20 --agent ``

• `fleet av-gaps` - Finds every device fleet-wide where antivirus is missing, disabled, or not running, so security gaps surface before an incident does.

_Reach for this when you need the definitive list of unprotected endpoints across all customers for a security review or incident sweep._

``bash datto-rmm-cli fleet av-gaps --status not-running --agent --select hostname,siteName,antivirus.antivirusProduct,antivirus.antivirusStatus ``

• `fleet resolve-storm` - Bulk-resolves the open alerts on the noisiest devices and sites from the storm ranking, so Monday triage ends with a clean queue instead of a worklist.

_Reach for this when a monitor misfire flooded the queue and you need to act on the ranking, not just look at it; defaults to a plan-only preview, and nothing resolves without --confirm._

``bash datto-rmm-cli fleet resolve-storm --days 7 --top 10 --agent ``

• `fleet device-timeline` - Stitches one device's alerts and activity-log entries (which surface job, audit, and user actions) into a single chronological timeline from the local store.

_Reach for this during triage when a device keeps misbehaving and you need its full recent history in one stream, not four console tabs._

``bash datto-rmm-cli fleet device-timeline ACME-DC01 --days 30 --agent ``

Lifecycle and compliance

• `fleet patch-gaps` - Ranks every device by missing-patch count across all sites so you remediate the most-exposed endpoints first.

_Reach for this to prioritize patch remediation fleet-wide by exposure rather than checking one device at a time._

``bash datto-rmm-cli fleet patch-gaps --min-missing 5 --agent ``

• `fleet warranty` - Surfaces every device whose hardware warranty expires within a window, sorted by date and site, ready to drop into a QBR refresh plan.

_Reach for this when preparing a hardware-refresh or QBR budget conversation that needs the expiring-warranty list across all customers._

``bash datto-rmm-cli fleet warranty --within 60 --agent --select hostname,siteName,warrantyDate,deviceType.type ``

• `fleet scorecard` - Produces a one-shot per-site health card fusing device counts, alert volume, patch coverage, AV coverage, warranty exposure, and agent drift for QBRs.

_Reach for this when you or a vCIO need an instant customer-health summary to open a QBR or flag an at-risk account._

``bash datto-rmm-cli fleet scorecard "Acme Corporation" --agent ``

• `fleet orphans` - Cross-references long-stale, suspended, or deleted devices that still count against a site so you stop billing and monitoring phantom endpoints.

_Reach for this when cleaning up a site's device roster or auditing billing accuracy against what is actually alive._

``bash datto-rmm-cli fleet orphans --stale-days 90 --agent ``

Receipts and data trust

• `fleet job-results` - Fetches every device's result for one quick job and rolls them into a single pass/fail table, so a 200-device push is verified in one command.

_Reach for this after any quick-job push to answer which devices errored or printed nothing; fetches live per device, so it needs credentials and a synced cohort (--devices, --site, or --all)._

``bash datto-rmm-cli fleet job-results 8d3f2c1a-4b6e-4f0a-9c2d-1a2b3c4d5e6f --devices 0a1b2c3d-uid1,4e5f6a7b-uid2 --failed-only --agent ``

• `fleet snapshot` - Freezes the current synced fleet state into a labeled, dated archive so any number you report can be reproduced later as a receipt.

_Reach for this before a QBR or audit so a disputed number weeks later can be proven against the dated snapshot; run sync first so the receipt reflects fresh data._

``bash datto-rmm-cli fleet snapshot --label q2-acme --note "QBR baseline" ``

• `fleet diff` - Diffs two fleet snapshots (or a snapshot vs the live store) to show devices added or removed and warranty, patch, AV, and agent-version movement since the baseline.

_Reach for this in QBR prep to lead with the delta story: what got better, what slipped, what arrived and left; both sides read the synced store, so sync before snapshotting._

``bash datto-rmm-cli fleet diff --from q1-acme --to q2-acme --agent ``

• `fleet sync-gaps` - Verifies every synced resource pulled all pages by comparing stored row counts against the API's reported totals, so you can trust fleet numbers before reporting them.

_Reach for this after sync and before any fleet report; an incomplete devices table makes every downstream number quietly wrong._

``bash datto-rmm-cli fleet sync-gaps --agent ``

Command Reference

account - Manage account

• datto-rmm-cli account create-variable - Creates an account variable
• datto-rmm-cli account delete-variable - Deletes the account variable identified by the given variable Id.
• datto-rmm-cli account get-components - Fetches the components records of the authenticated user's account.
• datto-rmm-cli account get-dnet-site-mappings - Fetches the sites records with its mapped dnet network id for the authenticated user's account.
• datto-rmm-cli account get-sites - Fetches the site records of the authenticated user's account.
• datto-rmm-cli account get-user - Fetches the authenticated user's account data.
• datto-rmm-cli account get-user-closed-alerts - If the muted parameter is not provided, both muted and umuted alerts will be queried.
• datto-rmm-cli account get-user-devices - Fetches the devices of the authenticated user's account.
• datto-rmm-cli account get-user-open-alerts - If the muted parameter is not provided, both muted and umuted alerts will be queried.
• datto-rmm-cli account get-users - Fetches the authentication users records of the authenticated user's account.
• datto-rmm-cli account get-variables - Fetches the account variables.
• datto-rmm-cli account update-variable - Updates the account variable identified by the given variable Id.

activity-logs - Manage activity logs

• datto-rmm-cli activity-logs - Fetches the activity logs.

alert - Manage alert

• datto-rmm-cli alert <alertUid> - Fetches data of the alert identified by the given alert Uid.

audit - Manage audit

• datto-rmm-cli audit get-device - Fetches audit data of the generic device identified the given device Uid.
• datto-rmm-cli audit get-device-by-mac-address - Fetches audit data of the generic device(s) identified the given MAC address in format: XXXXXXXXXXXX
• datto-rmm-cli audit get-device-software - Fetches audited software of the generic device identified the given device Uid.
• datto-rmm-cli audit get-esxi-host - Fetches audit data of the ESXi host identified the given device Uid.
• datto-rmm-cli audit get-printer - Fetches audit data of the printer identified the given device Uid.

device - Manage device