Matrix42

Setup

1. In Matrix42 open Administration → Integration → API Tokens and create a token for a service account with the roles the agent needs. Matrix42 applies role-based access on top of the API, so a restricted account sees fewer fragments.
2. Set MATRIX42_URL to your instance root (e.g. https://esm.example.com/M42Services, no trailing slash) and MATRIX42_API_TOKEN to the token.
3. The adapter exchanges that token for a short-lived access token at /api/ApiToken/GenerateAccessTokenFromApiToken/ (the API token travels in the Authorization: Bearer header of that call, never in a body) and renews it automatically. AnythingMCP stores the access token encrypted in connector_auth_cache.

Data definitions and CI types are different names. Matrix42 stores data in fragments of a Data Definition (e.g. SPSActivityClassBase for activities, SPSAssetClassBase for assets, SPSUserClassBase for people). An object of a Configuration Item type (e.g. SPSActivityTypeIncident, SPSActivityTypeServiceRequest) is made of several such fragments. The fragment query (/api/data/fragments/{ddName}) takes a Data Definition name; matrix42_get_object takes a CI type name and an object id.

Incidents and service requests are activities. matrix42_query_incidents and matrix42_query_service_requests query SPSActivityClassBase and add the A-SQL type filter UsedInTypeSPSActivityTypeIncident IS NOT NULL (or …ServiceRequest…) in front of your own where.

Name your columns. Without a column list Matrix42 returns only the fragment IDs, so every query tool requires it. Column expressions are A-SQL and can follow relations, e.g. ID,Name,SerialNumber or ID,Recipient.Primaryaccount.DisplayName AS Name.

where is A-SQL, e.g. State = 3 AND CreatedDate > '2026-09-01'. Column names are the Data Definition's, which differ from the labels shown in the web UI. matrix42_get_fragment_schema returns the type of each column you name and fails on a column that does not exist.

pageSize / pageNumber page the result and sort orders it (e.g. Name ASC, CreatedDate DESC). There is no cursor. Matrix42's documentation does not state whether the first page is 0 or 1; check the first call.

Not run against a live instance. The paths and parameters follow Matrix42's public API reference (docs.matrix42.com, Public API reference documentation and Web Services: Authentication types). A correction from anyone running this against a real system is genuinely welcome.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch.
• On an internal host (esm.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.