Internal work. Both projects run at my employer. I can’t link the code, so this page only describes them.
What it is
Two projects that work together through an MCP interface.
Fleet Monitor collects the state of the Windows and macOS devices every day (for example their join status with Entra ID) and shows it in a web portal. Each device has a device record. An MCP server makes the inventory and the records available to AI clients. Which data the MCP server covers is kept as a manifest in the repo.
The support agent is a troubleshooting agent for the IT team, built on the pi SDK with an LLM in the EU data zone. Through the MCP server it reads what the fleet knows about a device, diagnoses the user’s own Mac read-only via a fixed command catalog, and writes its findings back as an entry in the device record. It asks before every write.
Status
The agent is distributed to pilot users as a package via Intune. Sign-in goes through Entra ID, and permissions are re-checked before every prompt. Fleet Monitor runs on Azure PaaS, and the database is not publicly reachable.
What I learned
An agent only becomes useful once it can reach the data a human looks up first when troubleshooting. And it may only write where someone reviews the result. The MCP interface separates the two cleanly: reading is open, writing only goes into the record and only after confirmation.