Andrew For the IT Glue Integration, the MCP server only exposes Read endpoints for the IT Glue API, so you shouldn't need to worrry about write. It also doesn't have the ability to query credentials:

These are the read permissions the MCP Server gets:

search_organizations

get_organization

search_configurations

get_configuration

search_locations

get_location

search_documents

get_document

list_document_folders

list_document_sections

list_attachments

list_flexible_asset_types

search_flexible_assets

search_user_metrics

itglue_health_check

Dustin McClure great stuff. Where did you find that list?

Andrew If you go to https://<your-tenant>.hatz.ai/workshop/integrations and click on the gear next to IT Glue, it is listed under the MCP Connection section.

Andrew I came here to request this for IT glue and saw your comment. AutoTask is something you can set a shared credential up for already. This is available at the tenant level under integrations and tools in the MSP Admin Portal

Dustin McClure thank you!! I missed that possibility!

Looks like IT Glue is available there too. But we need a way to restrict API calls to Read Only (GET) since the IT Glue API is full rights only. Probably not something we want all staff to be able to leverage.

Dustin McClure I had assumed IT Glue would work as a shared credential as it's in the list, but it doesn't. Do you get the same issue?

"Could not add the credential: Sharing denied: an IT Glue API key reads every client organization, so connect IT Glue in the MSP's own workspace instead." - Unusual as the same could be said for the Autotask credentials.

100% need an option to share IT Glue creds to staff as the API can't be handed around as its too powerful / full access.

Andrew Yea, that is what I get as well.

This ticket was created to address this hopefully, but ultimately, it is a Hatz decision as to whether they want to allow MSPs to make that choice.

I understand why they might have disabled it in the first place: you can't scope an IT Glue API key in the same way you can other API keys like AutoTask, and it doesn't automatically limit access to that of the signed in user in the way that an integraiton like M365 does. So, if you share the credential with everyone they have access to read everything in IT Glue.

You can give the IT Glue API key that you have generated selectively to employees that you want to have access, but then you also have that many employees in possession of an API key that can read anything from IT Glue about your infrastructure. You are increasing the risk that the key falls into someone elses hands with each additional employee.

The way we do things like AutoTask or IT Glue is to share the credential and then set up a role for users who should have access to the integration. No API keys are shared directly. This is what I would like to see for IT Glue.

Dustin McClure agree that it would be better to let the MSP decide. The API key itself is read/write so it's not something I am going to give out - even though all our staff can read/write in the UI, if the key somehow leaked that would be a disaster. Far better solution is to share via Hatz. Fingers crossed they see it the same way :)