MCP server overview

rms-mcp is a Model Context Protocol server that exposes RMS operations as tools for LLM agents (Claude and other MCP clients). It ships in the devium-rms-tools package alongside the rms CLI and shares the same operations layer and authentication — so an agent can inspect and operate RMS conversationally.

Install

pipx install devium-rms-tools     # provides `rms` and `rms-mcp`

The server runs over stdio, which is how desktop and IDE MCP clients launch local servers.

Client configuration

Point your MCP client at the rms-mcp command and pass configuration through the environment:

{
  "mcpServers": {
    "rms": {
      "command": "rms-mcp",
      "env": {
        "RMS_BASE_URL": "http://localhost:8080",
        "RMS_TOKEN": "ey…",
        "RMS_MCP_MODE": "standard"
      }
    }
  }
}

RMS_BASE_URL and RMS_TOKEN resolve the same way as the CLI (and the shared config file). If no token is configured the server still starts, but tool calls fail fast with a structured auth error.

Authorization tiers

The registered toolset is chosen by RMS_MCP_MODE. The server is safe by default: only the tools for the resolved tier are registered at all.

Why default to standard rather than full parity? The actor is an LLM acting on natural-language intent and is exposed to indirect prompt injection through the data it reads, while destructive operations are irreversible. So the dangerous surface is off unless you deliberately opt in. Destructive tools additionally carry MCP destructive-hint annotations so clients can gate them.

Least-privilege identity

Run the server as a non-ROOT identity scoped to the organizations it manages, not a human super-admin token. This is defense in depth with the tier gate: even in admin mode, the backend rejects operations the token isn't authorized for. admin mode is therefore only fully effective when paired with a correspondingly privileged token — by design.

See the tools reference for the full per-tier tool list.