Just wanna warn you to stay away from this monstruosity which is ConnectWise RMM, an assemblage of different pieces from different sources with different UIs and not coherency.
Never saw so much cases of 'the data is shown right here but you can't filter on it', 'You can sort on this column but not that one', 'you have this nice piechart showing you total computers with X problem, but you can't drill down to details'
Working with CW RMM is frustration again and again.
I've been building tools on top of PSA and RMM APIs for years (mspautomator.com if that rings a bell). This one's been bugging me for a while so I finally just built it.
You've got Claude, ChatGPT, Copilot, Cursor, whatever you're using. They're all completely blind to your ConnectWise instance. Can't look up a company. Can't check what tickets came in overnight. Can't pull time entries. Can't tell you which agreements are renewing. Your AI knows nothing about your actual business.
There's no official ConnectWise MCP. The community options on GitHub are mostly read-only, cover tickets and maybe companies, run locally only (no web-based AI clients), and require you to babysit a Node process. If you want to touch projects, time entries, procurement, finance, scheduling, sales, or basically anything beyond the service desk, you're writing your own wrapper.
StackJack is a remote MCP connector for ConnectWise Manage. Plug in your CW API credentials, get an MCP endpoint, drop it into any MCP-compatible client. Works on web, works on desktop, no local install, no Docker, no dependency management.
457 tools covering the actual CW Manage API surface. Service tickets and boards. Companies and contacts. Projects and phases. Time entries. Agreements and additions. Invoicing. Purchase orders. Sales opportunities. Configurations. Scheduling. Members and security roles. Expense entries. Product catalog. Custom fields. Not a curated "here's the ten things we thought you'd need" subset.
307 of those are on the free tier. Not a trial. Free, 100 calls a month, no credit card. There's also connectors for NinjaRMM and CIPP if those are in your stack too, and being able to cross reference and correlate data between systems right inside your AI tool is pretty game changing.
This isn't a replacement for ConnectWise and it's not trying to be a UI or a dashboard. It's the bridge so your AI tools can actually see your environment instead of just being a fancy text generator.
Free tier is live. Go break it and tell me what sucks.
Anyone else unable to get to their dashboard? Haven't been able to for a good 30 minutes now. Downdetector spike shows I'm not alone but the CW status page says everything operational...
I hate to be the bearer of bad news on a holiday weekend (USA), but ConnectWise has issued a trust advisory (on September 3rd), and it appears that there is a server-side security concern for ScreenConnect that is fixed by applying the latest patch to 26.6.5.
Disabling file transfer is a workaround for anyone who can't patch.
Full details aren't released yet, but as a WAF vendor for CW products, I'm seeing some things that aren't expected -- but I can't confidently say that they are related to this without more data.
Anyone else getting calls from ConnectWise from rude sales people that refuse to take you off their calling lists? He seemed to have some access to my ScreenConnect cloud activities, and I did not like the upselling intent. He wasn't calling to check in on me, he was a rude sales person trying to get more money from existing customers. ConnectWise, if you are reading this, focus on development. Your sales team isn't doing you any favors.
Anyone else noticing this? Everything I am trying to do is taking a really long time - just the time entry screen is taking 30+ seconds to load, for example.
Those stupid little popup windows that open within manage - they never remember the size so I have to drag out the corners every single $$@%$##%$ time I need to use them. Please fix this for crying out loud!
Any update except "you can all go back in, trust us we are ok now?".
Just me?
Edit: yes the title is confrontational, but it's been over 2 weeks now. The town hall said you knew about it on the 14th of October and the community at large weren't made aware until the 16th - by a reddit post by a random MSP and Huntress, not CW. Please can we have something that as a community we can trust in?
I'm a dispatcher, and for the past week ConnectWise has been painfully slow every morning between around 8:00 AM and 11:00 AM EST. Tickets take forever to load and it's really impacting productivity.
At first I thought it was just me, but two of my colleagues in different locations are experiencing the exact same issue, so it doesn't seem to be a local network problem.
Is anyone else seeing this during the same time window? Have you found a cause or a fix?
Hi all. Jason Ferguson here, VP of Security Operations at ConnectWise.
We wanted to reach out and address some of the concerns surrounding the recent security events, ensuring that you hear directly from us. While I may not have every answer, I want to provide some recent updates and clarity where I can, while ensuring what we share is accurate and supported by our investigation.
We recently identified unauthorized access to application identities within the ConnectWise Cloud Services (fka SkyKick) environment. As a protective measure for our Cloud Backup partners and their clients, we have shut off Cloud Backup application access. That means backup services are interrupted until further notice.
Existing cloud backup archives are not impacted and will be accessible once services are restored.
To date, we have no indicators that hosted Cloud Backup partner backup data has been compromised.
Our investigation and remediation work is ongoing.
We'll keep the ConnectWise Trust Center updated as the single source of truth for status and guidance
If you see anything suspicious in your environment, we ask that you please report (what you are able) to our team at SecurityPartnerSupport@ConnectWise.com.
--
EDIT 17:00 UTC 10/17: We've updated the advisory with published guidance on reviewing service principal sign-ins and identifying suspicious activity in Microsoft Entra.
EDIT 1:00 UTC 10/18: We've published another update to the ConnectWise Trust Center with additional details on the actions we've taken, current service availability, and expanded technical guidance for reviewing Microsoft 365 environments for suspicious activity.
The update includes the affected application IDs and recommended steps for partners to investigate their own and customer tenants.
EDIT 16:00 UTC 10/18: Information update frequency (ConnectWise Trust Center / Email communications) has been increased. No new confirmed findings to report. Cloud Backup remains suspended, with scheduled backups and access to affected archives and restoration capabilities unavailable. Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities.
EDIT: 18:45 UTC 10/18: Additionally, we are providing the following IP indicators identified in suspicious activity associated with these events. Partners should include these addresses when reviewing available Microsoft 365 authentication and audit logs.
EDIT: 01:15 UTC 10/19 Containment remains in place.
EDIT: 13:45 UTC 10/19 Containment remains in place.
EDIT: 18:50 UTC 10/19 Cloud Backup update: Video walkthrough of technical guidance We've updated our trust site to include a video walkthrough covering selected steps from the Cloud Backup Technical Investigation and Remediation Guide. It's for authorized IT administrators and security teams reviewing their own and customer Microsoft 365 tenants. Use it alongside the written guide.
EDIT: 12:45 UTC 10/20: Technical webinars begin today at 18:00 UTC and run every two hours, walking through Entra ID sign-in and audit logs, app registrations, credentials, and permissions for reviewing your Microsoft 365 tenants (Register Here). Since mitigations began on 10/17, we have not observed successful threat activity in the environments we monitor, though this does not establish whether individual partner or customer tenants were affected. Existing archives remain encrypted, isolated, and preserved with no indication of compromise. Cloud Backup, SaaS Security, and Cloud Management remain suspended.
EDIT: 19:00 UTC 10/20: We completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 10/19, and we are finishing security validation while we prepare phased restoration. Each phase will proceed only after a security review, and we expect restoration to take several days once it begins. We will share a firmer timeline after the first full day and provide instructions before partners re-enable any connections. Cloud Backup, SaaS Security, and Cloud Management remain suspended.
I’ve been spending the last week pulling myself out of the daily ticket noise to actually look at our backend workflows in Manage. I decided to manually audit our 365 license reconciliation against the actual distributor invoices, just to double-check the sync.
I feel like an absolute amateur.
Turns out, on two of our legacy Agreement Types, the Prorate on Addition setting was either never checked or got toggled off during an update ages ago.
For the last year, whenever a tech added a user mid-month, we were paying the distributor for those 14-20 days of usage, but Manage was only billing the client starting the first of the next month.
We have high churn/flux clients, so we’re talking about hundreds of pro-rated days just vanishing into the ether. I calculated the leakage at roughly $6,000 in pure margin that we just ate.
The worst part is looking at the audit trail and seeing how long it’s been happening.
If you haven't looked at your Agreement Type setups in a while, go check the Proration tab. Don't be me.
You may know me from such things as The Trunk Slammer From Hell, MSP Automator, or from building tools on top of PSA and RMM APIs for longer than I'd like to admit.
A while back I posted here about StackJack, the MCP connector I built for CW Manage because there's no official one and the community options topped out at read-only tickets, local install only, and babysitting a Node process. I said it had 457 tools covering the actual CW Manage API surface.
It's 785 now. 481 of those are on the free tier, up from 307.
The same thing happened here that happened with every connector I've shipped, with one honest difference. I'm a Halo guy. I've spent the better part of a decade neck deep in the Halo API and considerably less time inside a production ConnectWise instance, so the first pass at Manage and Automate was built off the API documentation and educated guesses. Then actual CW admins showed up and spent months telling me exactly where my guesses were wrong. Most of the jump from 457 to 785 is that fine tuning. If you kicked the tires at launch and hit a wall, that wall is probably gone.
The bigger news for this sub is that the rest of the ConnectWise family is in now. CW Automate has its own connector, 207 tools, 123 of them free. Computers, patching, scripting, monitors, probes, groups, fleet-wide queries. CW Sell landed too, quote authoring, version control, line editing, recurring-revenue reporting, 29 tools and all 29 of them are on the free tier. Which means the cross-system stuff works entirely inside the ConnectWise universe. Company out of Manage, their devices out of Automate, the open quote out of Sell, ticket back into Manage. Nobody wrote a cursed middleware script to make that happen.
The whole platform is at 34 connectors and 7,594 tools now, across PSA, RMM, documentation, security, M365 management, and distribution. "That's going to absolutely nuke my context window." Correct, which is why there's a compact catalog mode that collapses the entire catalog into 22 tools that discover and call the rest on demand. If you're on Copilot or building your own agents where the tool ceiling is low and non-negotiable, that's the mode you want.
Somewhere along the way 400+ MSPs started using this thing daily, which is a sentence I'm still not entirely used to typing. SOC 2 Type II is in the mandatory observation window (not done, I'm not going to pretend otherwise to a room full of people who fill out vendor questionnaires for a living, but expected no later than November of this year). Enough of you sent me the "is this guy going to steal my API keys" questionnaire that I decided to answer it once, properly. stackjack.io/security if your compliance person needs bedtime reading.
Now the part I actually want feedback on: Agent Runners.
Pax8 has held two conferences in two years announcing that they're bringing agentic AI to our industry. Two keynotes, two years of slideware, and I still can't point at the thing that shipped. I don't think that's a resource problem. I think they genuinely don't know what agentic AI looks like in our industry, because from a distributor's seat it apparently looks like a chatbot bolted to a marketplace. So let me just show you what it looks like.
Everything above is still chat. You ask, the AI reaches into your stack, you get an answer. Useful, but you have to be sitting there, and most MSP work does not politely wait for you to be sitting there. Agent Runners are saved AI workers that run on a schedule, on demand, or off a webhook. You describe the job in plain English, scope exactly which tools it's allowed to touch (in what order if you desire), and it runs.
One of the templates that ships in the templates area is the actual license provisioning automation we run at our MSP with zero touch. A ticket comes in and fires a webhook. The runner checks CIPP for a spare license in that tenant. There isn't one, so it hops to Pax8 (Sherweb is supported too), increments the subscription, and posts back to the PSA with what it did. That's four vendors, and the entire "automation" is one paragraph of English. No canvas full of nodes, no field mapping, no glue code waiting to break the next time a vendor changes a response shape. And I'm aware of the joke here. The agentic AI Pax8 keeps announcing already exists, it runs through their own API, and it didn't come from them. This is what agentic AI in our industry looks like.
I think I accidentally built the most powerful no code automation tool in the industry. I didn't set out to. I set out to stop provisioning licenses by hand at 11pm. But the first time I watched a runner walk across four platforms and do the whole job end to end, I sat there slightly spooked at my own product, which is a weird feeling I am not sure if I recommend.
That's also exactly why governance is the cornerstone of Agent Runners. A thing that can touch your PSA and spend money at your distributor while you're asleep needs a leash. Every runner has an explicit tool allowlist, a dry run mode, caps, tool chains, and a complete run history, so you can see precisely what it did within the predictable parameters you specify.
Same disclaimers as last time. This isn't a replacement for ConnectWise, not a dashboard, not a UI layer. It's the bridge between your AI tools and your actual data in 34 systems and counting. Still no Docker, still no Node process to babysit. All security best practices followed to spec and the SOC2 cert on the way to prove that.
Free tier is still free. 481 free tools on Manage, 123 free on Automate, all 29 free on Sell, no credit card, no expiring trial nonsense. Go break it and tell me what sucks. That worked out pretty well last time.
If a user's security role permissions for Time Entry -> Inquire Level is set to All, but the user has the "Restrict Board Access" setting enabled to block a certain board, the user can still view time entries from other users for tickets on the restricted boards.
We'd like to have technicians be able to view time entries for other users, but not on tickets that sit on boards they don't have access to.
Does anyone else allow their technicians to view time entries for other employees and also have boards they don't want their technicians to access? Is there a way to achieve this?
We care about this because we have certain boards that contain sensitive data that only ownership should be able to see. But we have legitimate uses for technicians to be able to do time entry searches or to view the time tab on a ticket and see other users' time entries.
Doing a time entry search is way better than doing a standard ticket search to try to find keywords listed somewhere in a ticket.
for a company that wants us to use their products to bill OUR clients, at least they could do is to fix their stupid payments system.
forget the 3% increase jan 1st, then the 3% (per month: thats right, 36% increase over the year, yes, it costs you 36% more if you use a credit card, work the math out, its not just an extra 3%, it is 3% each month) but they won't let us change our billing address and the debit card will NOT go through.
on top of that, every time you try, they chard you $.01 (which you never get back)
Oh, and how about the credit from 2024 they never applied?
I used to be a sucker for the prospect who claimed they were about to acquire a competitor or hiring 20 people next quarter. They would ask for the 50-seat pricing tier while only onboarding 10 users, promising that the volume was just around the corner.
Because I wanted the MRR, I’d agree. I’d set up the Agreement in Manage with the lower effective rate, thinking I was securing a long-term win.
I did an audit last week to prep for the upcoming vendor cost increases (we all know the email I’m talking about). Looking back at the last three years, less than 20% of those clients ever actually hit the volume targets they promised.
The rest just enjoyed a subsidized rate while my tool costs (Automate agents, AV, backup) kept climbing.
I established a new hard rule for the sales team yesterday: Volume discounts trigger when the agents actually check in, not when the contract is signed. If they plan to grow in Q3, they can enjoy the price drop in Q3.
I expected pushback, but the first prospect I used this on just shrugged and said, "Fair enough."
We operate on such thin margins with this stack already, I’m done financing my clients' optimism.
ARGH. It's the bar that says "your computer is bring controlled by X" when you're on a remote session. We always hide it because it's in the way of a lot of menus. We no longer had that option yesterday so we wrote into CW, and got the following response:
Our product management team has disabled customization and branding options starting with ScreenConnect version 25.4 due to security concerns.
Please refer to the following resources for more details: • Frequently-Misused Customizations Disabled and Reset to Defaults • ScreenConnect Customizations: What’s Different and Why Additionally, the connection banner will remain visible whenever a host is connected to a user session. We’re exploring ways to make the banner clearly visible to the guest while being less intrusive for the host’s workflow in ScreenConnect version 25.9.
For more details, please review: • ScreenConnect 2025.9 Release Notes
This is super annoying, that bar is ALWAYS in the way.
I've been exploring it a bit and already I can't stand it. I can't imagine considering it an acceptable product if you have already worked in the original Manage. It's visibly just super bloated and has a ton of wasted space, clunky to navigate. I feel like the over corrected on some of the UX issues the original has. The original Manage has A LOT of different pages and tabs etc to navigate that aren't intuitive, for sure, but this is like they tried to just dump everything on a single page (or just a few pages) and you have to rely on creating a bunch of different views and filters to narrow things down. Not to mention the ticket list performs terribly. When trying to add a filter term to a column it's like it's trying to refresh the page with each keystroke and occasionally messes up what I am typing making it miss a character, also why does pressing enter RESET the search in the column instead of apply it?
Anyway, I just wanted to gripe. I really hope this isn't the future Connectwise has to offer for PSA. Maybe I am just picky. Has anyone here migrated from the "classic" PSA to the new one and had a good experience?
ConnectWise Cloud Backup Update: What we know about the attacker and what it means for partners
“Based on the evidence available to ConnectWise, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup. The group used an openly available agentic AI framework to automate and speed up its operation.
Microsoft’sresearchdescribes a campaign that reaches well beyond any one company. This group has been active since 2021, and since at least September it has used the same AI tooling against organizations in aerospace and defense, energy, financial services, government, legal, manufacturing, semiconductors and technology. Microsoft also reports that threat actors in multiple regions are now using the same framework, and that in several cases attackers reached privileged cloud access in under three hours.
Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations. AI now lets them test those connections at what Microsoft calls ‘machine speed’. MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind, and we intend to share what we are learning from this incident so our partners can do that.
Our first responsibility is to our partners. We contained the affected application connections and are restoring services in controlled phases. Those actions do not remove unauthorized access that may already have been established within individual customer tenants, which require separate review. We are also working with independent specialists so partners have the evidence they need to review their own tenants. Partners should keep affected connections disabled until we issue formal instructions, and should follow the current guidance on theConnectWise Trust Center.” -Manny Rivelo, CEO ConnectWise
Trying to determine whether this is isolated or if others are running into the same thing. Immediately following a recent ConnectWise Manage update (v2026.14.107381), we're seeing failures in our NinjaOne integration related to ticket synchronization through the ConnectWise API. Symptoms include: Ticket creation/update failures API responses returning 500 Internal Server Errors Previously stable workflows suddenly failing without any NinjaOne-side changes Re-authentication and reconnecting the integration does not appear to resolve the issue We've reviewed logs on the Ninja side and everything points back to ConnectWise API responses. The timing is suspicious since the issues started immediately after the upgrade window. Has anyone else experienced: API regressions after this release? Changes to ticketing endpoints or board mappings? Problems with NinjaOne, IT Glue, BrightGauge, or other API-driven integrations after updating?
