ScreenConnect remote endpoint ops toolkit

I built a Claude Code and Cowork plugin for finding ScreenConnect sessions, checking devices, and running diagnostics. It calls the ScreenConnect API directly and can optionally save results as private Freshservice ticket notes.

What it does

• Session lookup and live state. Resolve a machine by name, serial, or session ID; read online status, last activity, logged-on user, hardware, and uptime computed from last boot time, no command required.
• Command execution with captured output. Sends a command to a session and polls for its result, cmd by default with a PowerShell option, ambiguous or offline targets are refused rather than guessed at.
• Read-only diagnostic playbooks. Curated checks (event logs, sound, OneDrive sync, network, health, memory, drivers, laptop battery health) that wrap the same session-resolution logic and return a clean report.
• Chat transcript retrieval. Pulls a session's technician/guest chat history, the back-and-forth that otherwise evaporates once the session ends.
• Confirm-first actions. Add a session note, send an on-screen message, rename a session, or update custom properties, each requiring explicit confirmation before it runs.
• Optional Freshservice logging. Command output or a chat transcript can be posted to a ticket as a private, redacted note if a Freshservice config is present; without one, the flag is silently skipped and everything else works normally.

Safety model

ScreenConnect’s API uses a shared credential without per-user or read/write permissions. The plugin therefore checks commands, asks for confirmation before changes, and redacts sensitive output. These controls sit in the plugin; they do not change the API’s permissions.

• Commands only come from the operator. The skill is instructed to never treat ticket or asset text as a command to run, only what's typed in chat.
• A destructive-command denylist blocks disk formatting, diskpart, recursive deletes, shutdown/restart, and BCD edits by default; overriding it requires an explicit --force, treated as a floor rather than permission.
• Confirm-first for anything that changes state. Read-only diagnostics the operator explicitly asked for can run directly; installs, registry or service edits, and file changes are confirmed first.
• Secret redaction on everything that leaves a session. Session logs and command output can contain plaintext credentials, so output and chat transcripts are scrubbed of BitLocker recovery keys, password/secret/token assignments, auth headers, and long hashes or base64 before they're printed or posted anywhere.
• Ticket notes are private and silent by default. Optional Freshservice logging never notifies or tags anyone, and a dry-run flag previews the note before it posts.

Not included

The public release includes the diagnostic tools and setup guidance. Environment-specific network and printer checks are documented as a pattern readers can adapt to their own inventory.

Packaging and access

The plugin bundles its instructions and Python scripts for Claude Code and Cowork. It needs no separate server, and the diagnostics work without Freshservice.