just mcp-asd + the MCP server toolsThe MCP (Model Context Protocol) gateway exposes PMA's operator surface to AI agents. Two pieces:
just mcp-asd(the credential-guarded wrapper around the asd CLI), and theclaude_ai_PMAMCP server (per-service tools agents can call).
just mcp-asd — the credential gatewayPer Golden Rule 3, every asd invocation that touches credentials / tunnels / Caddy routes goes through just mcp-asd. The wrapper enforces ASD_CLIENT_ID=gwkh (the persistent prod client id) and blocks invocations that would overwrite credentials.
# Wrong (bypasses guards)
bun .asd/cli.ts net apply
# Right
just mcp-asd net apply
| Recipe | What it does |
|---|---|
just mcp-asd <command> [args] |
Run any asd command with credential guards active |
just mcp-asd tunnel |
Run asd net apply --tunnel (most-used) |
just mcp-asd tunnel-start SERVICE |
Start tunnel for one service |
just mcp-asd tunnel-reset |
Reset all tunnels |
just mcp-asd verify |
Check credential status |
just mcp-asd status |
Show credential state |
just mcp-asd net-apply --caddy |
Reload Caddy routes |
just mcp-asd caddy-start / caddy-stop |
Caddy lifecycle |
For the full gateway model + which commands are protected / blocked / safe, see docs/framework/MCP-GATEWAY.md in the asd-pma repo (legacy Dutch page at /pma-v2/architecture/mcp-gateway).
claude_ai_PMA MCP server — agent-callable toolsPMA ships an MCP server that exposes structured tools to AI agents (Claude / GPT / etc.). Each tool is a typed contract — input schema, output shape, attribution.
| MCP tool | What it does |
|---|---|
service_status |
Health for one service |
service_health |
Health probe (HTTP) |
service_logs |
Recent logs |
ecosystem_health |
Overall stack health |
| MCP tool | What it does |
|---|---|
redmine_issue ID |
Get one issue |
redmine_issues [filter] |
Search issues |
redmine_epics |
List epics (tracker_id=4) |
redmine_create_ticket |
File new ticket |
redmine_update_ticket |
Update status, etc. |
redmine_close_ticket |
Close with notes |
redmine_reopen_ticket |
Reopen |
redmine_add_note |
Append journal note |
redmine_attach_file |
Upload + attach (fixed in #3917) |
| MCP tool | What it does |
|---|---|
zammad_tickets |
List tickets |
zammad_ticket ID |
Get one |
zammad_search QUERY |
Search |
zammad_create_ticket |
File new |
zammad_update_ticket |
Update |
zammad_add_article |
Comment on ticket |
zammad_users / zammad_user ID |
Users |
zammad_groups / zammad_states / zammad_priorities |
Reference data |
zammad_ticket_history |
Audit trail |
zammad_ticket_overview |
Aggregate view |
| MCP tool | What it does |
|---|---|
n8n_list_workflows |
List all |
n8n_get_workflow ID |
Get one |
n8n_create_workflow |
Create from JSON |
n8n_update_workflow |
Update |
n8n_delete_workflow |
Delete |
n8n_activate_workflow / _deactivate_workflow |
Toggle |
n8n_trigger_workflow |
Manually trigger |
n8n_workflow_executions |
Recent executions |
n8n_execution_details ID |
Inspect one |
n8n_delete_execution |
Clean up |
n8n_list_credentials |
Credential refs |
| MCP tool | What it does |
|---|---|
email_send |
Send mail |
email_test |
Test SMTP |
email_health |
Check email service |
email_logs |
Recent send logs |
| MCP tool | What it does |
|---|---|
package_list |
All packages |
package_info NAME |
One package's manifest summary |
package_search QUERY |
Find packages |
command_list |
All just recipes |
command_search QUERY |
Find recipes |
command_modules |
List modules |
mcp_info |
The MCP server's own info |
mcp_tools |
List all MCP tools |
developer_hook_setup |
Configure dev-time MCP hooks |
When an AI agent calls a tool that mutates state (redmine_create_ticket, zammad_update_ticket, etc.), the call is attributed to the agent via X-Redmine-Switch-User (Redmine) or equivalent. The audit trail in the target service shows "filed by Claude Code (Opus 4.7)" rather than "admin".
Set the attribution per-tool-call via the ai_agent parameter:
{"ai_agent": "claude-code", "tracker": "feature", "subject": "..."}
Valid ai_agent values: claude-code, cursor, github-copilot, windsurf, aider, continue, codex, manual.
In your AI agent's MCP config (e.g. .claude/settings.json):
{
"mcpServers": {
"pma": {
"command": "bun",
"args": ["/opt/asd-pma/packages/mcp-server/server.ts"]
}
}
}
Restart the agent. Tools appear as mcp__pma__<toolname> (or however your agent prefixes MCP tools).
When an AI agent completes a piece of work, it can file the ticket:
agent → mcp__pma__redmine_create_ticket(
subject="Fix #1234 — implemented + tested",
tracker="feature",
epic_id=1234,
ai_agent="claude-code",
description="..."
)
The ticket lands in Redmine attributed to a claude-code user (which needs to exist in Redmine — set up via just authentik-user-create claude-code claude@your-org.com).
/pma/internals/mcp-gateway (planned) — how the gateway works internally.CLAUDE.md — why mcp-asd is mandatory.redmine_attach_file --json bug discovered + fixed during the /asd wiki build.