GLPI

GLPI needs two tokens, and both are easy to confuse.

1. App-Token — identifies the application. In GLPI go to Setup → General → API, enable 'Enable Rest API' and 'Enable login with external token', add an API client, and copy its application token. Put it in GLPI_APP_TOKEN.
2. User-Token — identifies the person. Open the GLPI user the agent should act as, go to the API tab of their profile, and regenerate the remote access key (personal API token). Put it in GLPI_USER_TOKEN.
3. Set GLPI_URL to the instance root (no trailing slash); the adapter appends /apirest.php.

The adapter calls /initSession with Authorization: user_token <token> plus the App-Token, caches the session token GLPI returns, and sends it back as Session-Token: … on every call, refreshing it when GLPI expires it. AnythingMCP keeps the session encrypted in the connector_auth_cache table.

Why a user token rather than a username and password. GLPI's initSession also accepts HTTP Basic credentials, but this connector deliberately does not use them: a login credential would have to be spelled out in the request, and a user token can be revoked on its own without changing the person's password. It is also the only one of the two that works when the GLPI user authenticates against LDAP or SSO.

Range, not page. GLPI's list endpoints do not take a page number; they take a range of start-end, e.g. 0-49. Ask for 0-49, then 50-99. The response carries Content-Range so you know when to stop.

The search engine is the powerful part. glpi_search takes criteria[0][field], criteria[0][searchtype] and criteria[0][value] and can express far more than the list endpoints. Field numbers are itemtype-specific — glpi_list_search_options returns the map for a given itemtype, and you will need it.

Entities scope everything. A user restricted to one entity sees only that entity's tickets and assets, and GLPI reports the rest as simply absent.

Self-hosted, which is the thing to plan for.

• On AnythingMCP Cloud the instance must be reachable from the public internet on a real hostname with a valid TLS certificate. A self-signed certificate will fail: the connector offers no trust-anything switch.
• On an internal host (glpi.intern, 10.0.0.x), self-host AnythingMCP on the same network and add that host to SSRF_ALLOWED_HOSTS, or the outbound guard refuses the call before it is made.