NinjaOne MCP server and AI skills

What it can do

• Organizations & sitesThe shape of the instance: the client organizations NinjaOne manages, their locations (sites), and the devices and sites under one org — the resolver for 'which client is this about'.5skills

  Reading only — no organization, location, or mapping is created or changed from here.

  • List customer organizations — resolve a client name to its org id.
  • Everything NinjaOne holds about one client — the record behind the name, when the id alone is not enough.
  • Locations (sites) across every organization.
  • Every endpoint that belongs to one client, so "what do we actually manage for them" has an answer before the renewal call.
  • The sites one client runs, which is how a fleet-wide problem gets narrowed to the office it is actually in.
• Devices & healthThe endpoint roster, from a fleet-wide health rollup down to one machine's full detail, plus the device-data query behind the inventory views.4skills

  Reading only — no device is moved, rebooted, or sent anything. Health flags are triage filters, not actions.

  • Page through devices, filtered by NinjaOne's device-filter syntax.
  • One machine opened in full — the whole record behind a health flag, not the summary row.
  • Device-health rollup across the fleet — the first call for 'what is unhealthy'.
  • Run a device-data query (the dataset engine behind software / patches / AV).
• Software, patches & AVFleet-wide inventory as three cursor-paged datasets: installed software, OS-patch status, and antivirus status.3skills

  Reading only — nothing is installed, patched, or scanned; a pending patch is a fact, not an instruction.

  • What is installed across the fleet — the fastest way to answer "who still has that application" when an advisory lands.
  • Where patching really stands across every client, so "are we behind" is a number rather than a feeling.
  • Which endpoints are reporting antivirus trouble right now — the protection gap, before someone else finds it.
• Alerts & activityThe 'what is happening right now' surface: active condition alerts, and the activity feed of jobs, alerts, and actions.2skills

  Reading only — no alert is reset or acknowledged, and no job is run.

  • What is firing right now across every client, so triage starts from the whole fleet instead of one console tab.
  • Activity feed — jobs, alerts, and actions, cursor-paged.
• Groups, roles & policiesThe fleet model a session reasons over: device groups (saved searches), device roles/node classes, and agent policies.3skills

  Reading only — no group, role, or policy is created, edited, or assigned.

  • Device groups (saved device searches), with counts.
  • How NinjaOne classifies the machines it manages — servers from workstations from hypervisors, when a question needs the right slice.
  • The agent policies in force, which is where "why is that machine behaving differently" usually has its answer.
• Ticketing & helpdeskNinjaOne's built-in helpdesk, read end to end: boards, the tickets on a board, one ticket in full, its comment/activity log, the status list, and the custom-field definitions.6skills

  Reading only — no ticket is created, assigned, commented on, or closed.

  • Ticketing boards (saved ticket views) — find a board id.
  • Tickets on a board (a server-side board run that only reads).
  • One ticket in full — attributes, requester, priority, severity.
  • A ticket's comment / activity log — the conversation and audit trail.
  • All ticket statuses, to translate a ticket's status.
  • Ticket custom-field (attribute) definitions.

How it has been taught to work it

Playbooks are the vetted techniques a session loads for this platform — what to check, in what order, and what a number means before it is reported.

• Active threats, vulnerabilities and firing alertsSecurity posture on NinjaOne — active or quarantined threats, critical and high vulnerabilities, antivirus product state, what alerts are firing right now, which clients are exposed.
  Vetted Sep 21, 2026
• NinjaOne — what the platform ISAlways when NinjaOne is attached. Its domain model — organizations/locations/devices, device health, alerts, tickets on boards — the definitions the mirror computes, and why it is neither Automate nor Asio.
  Vetted Sep 21, 2026Always on
• Offline devices, by organizationWhich clients have machines offline or not checking in, who has the worst coverage, is this device actually down, agent contact and fleet roster questions on NinjaOne.
  Vetted Sep 21, 2026
• Patch failures and pending patchesWhat is failing to patch, what is pending, which clients are behind on updates, OS versus third-party software patching, reboot-pending machines on NinjaOne.
  Vetted Sep 21, 2026
• Querying NinjaOne — paging, device filters and boardsAlways when NinjaOne is attached. How to page it — three different result shapes on one surface — how device filters behave, which ticket board is which, and the traps found live.
  Vetted Sep 21, 2026Always on
• Ticket backlog, unassigned and staleNinjaOne helpdesk questions — how big is the backlog, what is unassigned, what has been sitting, which client has the most open tickets, what happened on this ticket.
  Vetted Sep 21, 2026

Plus 18 more every session carries regardless of platform — how to shape an investigation, keep every number traceable, and say plainly when something is broken.