AnchorDesk / Documentation

Everything under the hood, in one place.

Release details, platform capabilities, setup, theming, integration status, and extension guides for the current AnchorDesk release line.

Current release — v2.4.1 Checklist MCP Parity

The whole checklist workflow now travels with the agent.

2.4.1 completes checklist parity over MCP: agents can list, apply, add, edit, reorder, complete, and delete ticket items; admin connections can manage reusable templates. The advertised contract is protocol-tested, and the upgrade guide explains how to refresh ChatGPT's frozen action snapshot.

Complete ticket checklists

Read, build, work, reorder, and clean up without leaving MCP.

Ten named checklist tools cover templates and working items, while get_ticket keeps the ordered checklist in the ticket record.

Admin template parity

Reusable runbooks are manageable through the same agent connection.

Create, replace, activate, and delete templates through role-gated tools; copied ticket items remain independent.

Wire-level verification

The contract clients actually receive is now under test.

An SDK client verifies initialize metadata, tools/list names and schemas, checklist calls, and non-admin denial over an in-memory transport.

ChatGPT action refresh

Server upgrades and workspace approval are separate steps.

Enterprise/Edu admins refresh actions; Business workspaces recreate and republish the app so ChatGPT replaces its frozen approved-tool snapshot.

Platform

Helpdesk, operations console, and agent surface in one system.

AnchorDesk can run standalone, then attach the pieces of your MSP or IT stack as adapters.

TicketsLocal-first ticketing

Create, set manual deadlines, route to teams, assign, capture and filter typed custom fields, save views, label, bulk update, and work tickets from card, board, and optional table views.

EmailThreaded IMAP and SMTP

Poll multiple mailboxes, dedupe by Message-ID, tag subjects with public ticket numbers, and reply with identities, templates, signatures, Cc/Bcc, and inline images.

DevicesConfiguration records and network map

Asset data stays local while probes and RMMs refresh operational context; map type indicators and the selected-device reference list expose what each provider knows.

RMMOne device, multiple providers

Tactical RMM, NinjaOne, and Datto identities merge onto one device; technicians select the provider for live snapshots, scripts, or quick jobs.

SyncTwo-way PSA issue sync

ConnectWise Manage and Jira Cloud can pull and push ticket state, hold conflicts, and ask a human to keep local or remote changes.

IdentitySSO, MFA, RBAC, MCP OAuth

Local accounts, OIDC, SAML, TOTP MFA, personal access tokens, and built-in OAuth for MCP all resolve to a real user and role.

AgentsWorkflow-complete MCP

Authenticated agents can work deadlines, tickets, complete checklists, notes, time, email, labels, teams, custom fields, saved views, ranked search, and audit history; admins can manage checklist templates.

AutomationRules and SLA escalation

Ticket, note, SLA-warning, and breach events can update, route, label, annotate, or notify with named Automation attribution and a loop guard.

RealtimeWebSockets and notifications

Ticket lists, board cards, open modals, the notification bell, SLA state, and automation results update without refresh.

FilesAttachments and export

Drag/drop files onto tickets, store bytes locally or in S3-compatible storage, and export a printable ticket with safe inline activity.

AuditActor-attributed history

Managed changes append before/after values with the user and channel, including web, API token, MCP, and named automation activity.

MobilePocket-sized helpdesk

Mobile-first by requirement: 105 states across five touch profiles verify advanced search, ticket history/cockpit, checklists and their template editor, the composer, touch Kanban, and a pinch-zoomable network map from 344px upward.

How it works

The database is the core. Integrations are adapters.

Tickets land locally

UI, IMAP, ConnectWise, Jira, and API-created tickets normalize into PostgreSQL.

Queues and rules move the work

Teams, saved views, custom fields, and audited automation translate service-desk policy into the local workflow.

Device identities converge

Provider references merge RMM and probe observations into one asset record linked to companies and tickets.

People and agents act in context

Technicians and OAuth/PAT-authenticated MCP clients share RBAC, audit attribution, and the same ticket workflow primitives.

# PostgreSQL and Adminer
docker compose up -d db adminer

# Backend config and schema
cp backend/.env.example backend/.env
cd backend
npm ci
npx prisma db push
npm start              # :8060

# Web client
cd ../web-client
npm ci
npm run dev            # :5173

# Current images
ghcr.io/spillers-technology/anchordesk-backend:2.4.1
ghcr.io/spillers-technology/anchordesk-web-client:2.4.1

Setup, 2am-proof

From clone to working desk, half asleep.

Every step tells you what you should see before you move on. If a step doesn't look like that, jump to the troubleshooting table below — the ten most likely mistakes are all there.

Start the stack

docker compose up --build — wait for it to settle. You should see: the web client answering on :5173 and curl localhost:8060/ping returning pong.

Set the two secrets that matter

In backend/.env: AUTH_SESSION_SECRET (any openssl rand -hex 32) and BOOTSTRAP_ADMIN_PASSWORD. You should see: the first boot logs "created bootstrap admin".

Sign in and enroll MFA

Log in as admin with the bootstrap password; scan the QR with any TOTP app. You should see: the board view with an empty queue. (Dev shortcut: OIDC_DISABLED=true skips auth entirely.)

Connect a mailbox

Admin → Mailboxes: IMAP host, credentials, poll interval. You should see: a test email to that address become a ticket within one poll cycle, tagged with the mailbox's label.

Attach your RMM

Admin → Integrations: fill the card for Tactical, NinjaOne, or Datto. You should see: the card flip to "configured", then Admin → Devices → "Sync from …" pull your fleet.

Connect a ticket source

Admin → Ticket Sync separates the Jira connection (site and credentials) from each sync job (project/query/filter scope). ConnectWise remains one legacy account until its client is tenant-safe. Save the Jira connection, then test it — a saved credential is not a working one. You should see: "Connected as <your account>" plus the projects that account can actually read. Run history then shows Healthy, Degraded, or Failed independently of the incremental watermark.

Set service promises

Admin → SLA Policies: one default response/resolution policy is enough to start. You should see: new tickets carrying SLA chips with live countdowns.

When it doesn't look right

Symptom	Almost always
Backend exits immediately on boot	`DATABASE_URL` points at `localhost` inside Docker — use the compose service name `db`.
Login page loops back to itself	`AUTH_SESSION_SECRET` missing/changed, or the app is served over http while cookies are marked secure — set `APP_BASE_URL` to match how you actually reach it.
No bootstrap admin was created	The users table wasn't empty (an earlier attempt created one). Reset the password via `npx prisma studio` or drop the dev volume.
Emails aren't becoming tickets	IMAP app-password needed (Gmail/M365 block basic auth), or the mailbox poll hasn't run yet — check Admin → Mailboxes last-poll time.
Outbound replies never arrive	SMTP relay rejects the chosen From identity — same-domain aliases only, or watch for the 422 "relay may not permit this From".
RMM card says configured but sync returns nothing	API key scopes — Tactical needs agent-read, NinjaOne the client-credentials grant, Datto the API-enabled user.
Jira job is Failed or imports nothing	Open Admin → Ticket Sync → History. Re-test the connection and confirm that account can see the selected project; Jira can return an empty 200 response for invalid anonymous credentials.
Devices duplicate after adding a second RMM	No shared MAC/serial/hostname+company to merge on — fill serial or company on one record and re-sync.
SLA chips never appear	No policy matches the ticket's priority/company — add a catch-all default policy.
MCP client can't connect	Token pasted with a trailing newline, or `APP_BASE_URL` doesn't match the origin the client discovered — OAuth metadata is served from that URL.
ChatGPT connects but new MCP tools are missing	The workspace still has its frozen approved-action snapshot — Enterprise/Edu admins refresh under Action control; Business workspaces recreate and republish the app.
Everything is slow on first page load	You're running the dev servers — use the production compose stack or the GHCR images.

Appearance

One workspace shape. Seven distinct atmospheres.

Palette changes are personal, not cosmetic shortcuts: canvas, surfaces, text, dividers, accents, and semantic states are tuned together while layout stays familiar. Pick yours under Account → Appearance.

⚓ Default Light

Bright watchCool white · indigo

⚓ Default Dark

Night watchSlate · periwinkle

⚓ Solarized Light

Paper chartWarm ivory · blue

⚓ Solarized Dark

Deep waterBlue-black · cyan

⚓ Nord

Arctic bridgeFrost · polar night

⚓ Gruvbox

Signal roomCharcoal · amber

⚓ Dracula

After hoursInk · violet · pink

Motion cues

A little movement where it helps.

The app favors practical feedback: closing work falls off the board, and OAuth/MCP discovery has a short, explicit consent loop.

Kanban close animation

MCP OAuth handshake

Integrations

Use the tools you already run.

Credentials seed from environment variables and can be managed later from Admin. Alpha providers are gated until configured.

AvailableIMAP + SMTP

Email-to-ticket, shared/personal send-from identities, templates, signatures, inline images, and attachments.

AvailableConnectWise Manage

Inbound and outbound ticket sync with notes, sync states, and conflict handling.

BetaJira Cloud

Two-way issue sync using Jira Cloud v3, ADF bodies, and status transitions — exercised against a live Cloud tenant. Multiple Jira accounts can be connected, each with its own sync jobs and filters.

AvailableTactical RMM

Device sync, live agent snapshots, script catalog, run-now, scheduled jobs, and ticket output.

AlphaNinjaOne

OAuth client credentials, device sync, live snapshots, and saved automation script runs.

AlphaDatto RMM

Device sync and async quick jobs by component UID, with job status retained.

Availablenetviz probes

LAN discovery posts devices into AnchorDesk and feeds the radial Network view.

StorageS3-compatible files

Local disk, AWS S3, MinIO, Cloudflare R2, and Backblaze B2 are supported attachment stores.

Guides

Go deeper.

Start with the README for setup, then branch into architecture, MCP auth, schema, mobile verification, and provider extension docs.

QuickstartLocal Compose, backend config, schema push, and web client. 2.4.1 release guideComplete MCP checklist surface, ChatGPT action refresh, and image tags. ArchitectureSource-of-truth database, auth flow, adapters, repositories, and delivery status. MCP AuthPersonal tokens, built-in OAuth, complete tool coverage, and ChatGPT action refresh. ProvidersHow to add ticket sync providers and identity-safe device/RMM adapters. Database schemaTables, relations, and the audit/event model behind the source of truth. Mobile contractThe 360px rule, five-device screenshot matrix, and phone-width test guards. UpgradingPull, restart, done — schema and data migrate on boot; per-version notes. ChangelogEvery release line from first anchor drop through Checklist MCP Parity.