A fork of a public open-source ConnectWise Manage MCP server, extended so every staff member at a US managed service provider acts in the PSA as themselves from Claude. Forked, extended and live as the organisation connector for the whole company inside three days.

The problem with the upstream server is subtle and important. It authenticates the user through Entra ID and then acts on the PSA with one shared credential, so the audit trail says the service did it, not who asked. The fork adds the missing piece: each signed-in member is impersonated as their own PSA member, with one key pair per member persisted in Key Vault, an audit line written per tool call, a cw_whoami tool so the model knows who is signed in, and a licence-class filter so only full-licence members qualify. Time-entry notes are held to the company's work-summary standard by the server rather than by convention.

Around that: an Azure Pipelines build to a container registry and a Container App, with an image purge keeping the two newest tags plus latest, a user-assigned identity, two Key Vaults split into read-only configuration and read-write per-member tokens, and Log Analytics with a daily ingestion cap. A search parameter layer and a tool shadowing mechanism sit over every search tool.

The part I would show first is the runbook. Thirteen sections, written so a developer who has never seen the project can make a change safely. It carries a file-by-file repo map saying what is ours and what is upstream's and where a merge will conflict, a dated timeline of every change, and the open items. Forking someone else's actively maintained server is a promise to merge it again later, and the map is how that promise gets kept.

Honest limits: the server and 51 of its 52 tools are the upstream maintainer's work. The claim here is the impersonation layer, the deployment and the runbook.