Matrix42

Setup

1. In Matrix42 open Administration → Integration → API Tokens and create a token for a service account with the roles the agent needs. Matrix42 applies role-based access on top of the API, so a restricted account sees fewer fragments.
2. Set MATRIX42_URL to your instance root (e.g. https://esm.example.com/M42Services, no trailing slash) and MATRIX42_API_TOKEN to the token.
3. The adapter exchanges that token for a short-lived bearer at /api/ApiToken/Token and refreshes it automatically. AnythingMCP stores the bearer encrypted in connector_auth_cache.

Everything is a fragment. Matrix42's data model is Configuration Items made of typed fragments: SPSActivityTypeIncident for an incident, SPSAssetClassBase for an asset, SPSScUserClassBase for a user. The query API takes the fragment name plus the columns you want, and returns rows. There is no per-entity REST path — this is why every tool here takes a fragmentName.

columns is not optional in practice. Matrix42 fragments have dozens of columns and omitting the list returns all of them. Name what you need.

where is SQL-flavoured, e.g. State = 3 AND CreatedDate > '2026-09-01'. Column names are the fragment's, which differ from the labels shown in the web UI. matrix42_get_fragment_schema returns the real names.

$skip / $top page the result. There is no cursor.

Unverified. The paths and field names below follow the vendor's published documentation and have not been exercised against a live tenant. Treat a 404 as a docs-versus-reality gap and check the developer portal before concluding that the credential is wrong. A correction from anyone running this against a real system is genuinely welcome.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch.
• On an internal host (esm.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.