ScreenConnect remote endpoint ops toolkit

A Claude/Cowork plugin that talks directly to a ScreenConnect (ConnectWise Control) instance's RESTful API Manager extension: look up a session by name, serial, or ID; pull live machine facts (OS, uptime, logged-on user, hardware); run a command and capture its output; retrieve chat transcripts; and run curated read-only diagnostic playbooks (event logs, sound, OneDrive sync, network, health, memory, drivers, battery). No MCP server, no hosting, no separate integration to stand up: it calls the extension's HTTP endpoint directly from the sandbox each time it runs, and Freshservice ticket-note logging is an optional integration that no-ops cleanly if it isn't configured.

What it does

• Session lookup and live state. Resolve a machine by name, serial, or session ID; read online status, last activity, logged-on user, hardware, and uptime computed from last boot time, no command required.
• Command execution with captured output. Sends a command to a session and polls for its result, cmd by default with a PowerShell option, ambiguous or offline targets are refused rather than guessed at.
• Read-only diagnostic playbooks. Curated checks (event logs, sound, OneDrive sync, network, health, memory, drivers, laptop battery health) that wrap the same session-resolution logic and return a clean report.
• Chat transcript retrieval. Pulls a session's technician/guest chat history, the back-and-forth that otherwise evaporates once the session ends.
• Confirm-first actions. Add a session note, send an on-screen message, rename a session, or update custom properties, each requiring explicit confirmation before it runs.
• Optional Freshservice logging. Command output or a chat transcript can be posted to a ticket as a private, redacted note if a Freshservice config is present; without one, the flag is silently skipped and everything else works normally.

Safety model

The extension's shared-secret auth authorizes every method it exposes, including remote command execution, with no per-user or read-vs-write scoping at the API layer, so the guardrails live in the plugin itself rather than upstream.

• Commands only come from the operator. The skill is instructed to never treat ticket or asset text as a command to run, only what's typed in chat.
• A destructive-command denylist blocks disk formatting, diskpart, recursive deletes, shutdown/restart, and BCD edits by default; overriding it requires an explicit --force, treated as a floor rather than permission.
• Confirm-first for anything that changes state. Read-only diagnostics the operator explicitly asked for can run directly; installs, registry or service edits, and file changes are confirmed first.
• Secret redaction on everything that leaves a session. Session logs and command output can contain plaintext credentials, so output and chat transcripts are scrubbed of BitLocker recovery keys, password/secret/token assignments, auth headers, and long hashes or base64 before they're printed or posted anywhere.
• Ticket notes are private and silent by default. Optional Freshservice logging never notifies or tags anyone, and a dry-run flag previews the note before it posts.

Not included

A network and print-triage check (cross-referencing a site's WAN/LAN inventory and a printer asset list to verdict on reachability) isn't part of the public release, since that kind of check only works against a specific environment's own network documentation and asset export. The README documents the pattern instead, reading the device's LAN/WAN IP from the session, matching it to a known subnet, checking reachability, for anyone who wants to wire up the equivalent against their own inventory.

What this demonstrates

• Designing for an unscoped credential. Where the underlying API has no per-user permissions, the guardrails (denylist, confirm-first, redaction) are built into the tool itself rather than assumed away.
• Optional integrations that degrade cleanly. Freshservice logging is additive when configured and a no-op when it isn't, so the tool doesn't force a dependency it doesn't need.
• Shipping as a portable plugin. Packaged as a Claude Code / Cowork plugin (SKILL.md plus scripts) that installs the same way anywhere, not tied to a hosted server.