Acidni MSP AI Control Center

Connect your AI assistant — Claude · ChatGPT · Gemini · Copilot Admin

Recommended · Connect with OAuth — no token pasting

Claude and ChatGPT can sign in to this hub directly. Add the connector with one of the URLs below and the AI client runs the OAuth flow itself: you sign in on this domain, approve the scopes, and it receives a short-lived, revocable token. Nothing long-lived is stored in the AI product.

MSP AI Gateway — for the MSP's own staff. Reaches the connectors your role allows across the whole MSP estate.

MSP AI Client Gateway — give this one to a client's own staff. They sign in with their own Microsoft work account and see only their own site's data, limited to the domains you have exposed for them.

Set up your AI assistant

  1. Claude (claude.ai or Desktop): Settings → Connectors → Add custom connector → paste the URL → Connect → sign in and approve.
  2. ChatGPT: Settings → Connectors → Create (or Developer mode → Add MCP server) → paste the URL → choose OAuth → sign in and approve.
  3. Google Gemini (CLI): add to ~/.gemini/settings.json, then run /mcp auth acidni in the CLI to complete sign-in:
    { "mcpServers": { "acidni": { "httpUrl": "<URL>" } } }
  4. Gemini Enterprise / Agentspace: an admin adds the URL as an MCP server for the workspace; users then approve on first use.
  5. Claude Code: claude mcp add acidni-hub --transport http "<URL>" then /mcp → authenticate.
  6. Microsoft Copilot Studio: Tools → Add a tool → Model Context Protocol → paste the URL → choose OAuth.
  7. Cursor — ~/.cursor/mcp.json; VS Code — .vscode/mcp.json:
    { "servers": { "acidni": { "type": "http", "url": "<URL>" } } }

Any MCP client that speaks streamable HTTP works — the hub advertises everything it needs (RFC 9728 protected-resource metadata, RFC 8414 server metadata, RFC 7591 dynamic registration, PKCE S256). If your client supports "custom MCP server with OAuth", paste the URL and it will do the rest.

A client's directory must be linked to their client record in the Control Panel first — an unrecognised Microsoft directory is refused, so the same URL is safe to hand out.

Scopes: msp.read/msp.act for the MSP gateway, client.read/client.act for the client gateway. RBAC still applies per call — a scope can never widen what your role allows.

Alternative · Paste an access token

For clients that cannot run OAuth. The same bearer token you use against the gateway API — an Entra ID token in production (e.g. az account get-access-token --resource <gateway appId>) or a dev token locally. It is only used to build the URLs below; nothing is sent anywhere. The URL embeds the token — treat it like a password.

MSP AI Gateway — for the MSP's own AI

Full pipeline access: discover licensed connectors and dispatch namespaced tool calls (list_connectors, call_tool). Every call is RBAC/entitlement-checked and audited.

MSP Client Gateway — for a client's AI

Scoped bridge access: query exposed domains (tickets, invoices, …) and raise front-desk actions (bridge_query, bridge_action). Domains default OFF until the MSP enables them.

If it does not connect

401 on connect Expected once — it is how the client discovers where to sign in. If it repeats, your Microsoft directory is not linked to a client record yet; ask your MSP to add it.
403 after sign-in You signed in successfully but your role does not allow that tool, or the domain is not exposed for your site. Both are set by your MSP.
No tools listed The connector authenticated but nothing is licensed/enabled for you yet.
Action "queued" Not an error — actions wait for a named person at your MSP to approve them.

Every call is recorded with who asked, what was asked, when, and the decision — including refusals. Ask your MSP for the audit trail if you need it.

How the three components fit together

This hub is the MSP AI Control Center. Behind it, an MSP AI Gateway reaches the MSP's own systems and an MSP AI Client Gateway sits at each client site — both enroll outbound to this hub and never expose an inbound port. Every AI call crosses identity, RBAC, entitlement, and the audit log here before it reaches any on-prem system. Gateway fleet status lives in Admin.