Afi + AI in 60 seconds
Unofficial. Community-built Claude Code Skill and MCP server for the Afi API. Not affiliated with, endorsed by, or sponsored by Afi.
Awaiting live verification - passes every mechanical gate (build, command-surface, claims, install). Be the first to confirm it against your tenant: report it works.
Ask your AI ‘which mailboxes aren’t backed up in Afi?’ and get the answer across every tenant at once. This skill walks your whole Afi fleet into a local store, then answers coverage gaps, stale backups, license drift, and per-tenant posture offline - no per-tenant portal clicking, no tripping Afi’s rate limits - and runs a verified archive-then-release when someone leaves.
New to the term? An MCP server is the same thing ChatGPT calls an app or connector, Claude on the web calls a connector, and Claude Code calls a Skill. One thing, many names →
Install in 60s → View on GitHub →
Instead of clicking through Afi, just ask
Instead of Open the Afi portal, click into each client tenant, and eyeball which users actually have a backup policy attached.
just ask: “Which resources across the whole fleet have no backup protection?”
Your agent runs: afi-cli coverage-gaps --agent
Instead of Tab through every tenant’s task history hunting for the nightly backups that quietly stopped landing.
just ask: “Show me protected resources whose newest backup is older than 48 hours.”
Your agent runs: afi-cli backup-stale --max-age 48h --agent
Instead of Stitch two portal screens into a spreadsheet to compare licenses purchased against seats actually protected.
just ask: “Where am I over- or under-provisioned on Afi licenses?”
Your agent runs: afi-cli reconcile-licenses --agent
See it in 30 seconds
Demo data is simulated. Every command shown exists in the real CLI.
What it does
| Question your MSP keeps asking | Command your agent runs |
|---|---|
| Which resources have no backup protection at all? | afi-cli coverage-gaps --agent |
| Which protected resources have a stale backup (silent failures)? | afi-cli backup-stale --max-age 48h --agent |
| Is the whole fleet green this morning, or who failed? | afi-cli fleet-health --failed-only --agent |
| What is one tenant’s full backup posture for a QBR or ticket? | afi-cli tenant-scorecard <tenant-id> --agent |
| Am I over- or under-licensed on Afi seats? | afi-cli reconcile-licenses --agent |
| Who is jane.doe@example.com in Afi, across Multi-Geo tenants? | afi-cli resolve <email-or-id> --agent |
| Safely back up then release a departing employee’s mailbox? | afi-cli offboard <resource-id> --tenant <tenant-id> --reason "employee departure" |
Full command reference at github.com/servosity/msp-skills/blob/main/skills/afi/guide.md.
What makes this one different
Most Afi integrations proxy each question into a live API call - fine for one lookup, but it falls over when you ask a fleet-wide question across dozens of tenants, and Afi’s rate limits punish the polling. This skill syncs the whole hierarchy into a local SQLite mirror once, then answers coverage, staleness, and licensing as offline SQL joins: instant, and gentle on the API.
The Afi portal answers one tenant at a time and has no cross-tenant rollup or coverage-gap report. This skill adds the fleet-wide views - coverage gaps, stale backups, license reconciliation, and a verified archive-then-release offboard - that neither the portal nor the rate-limited public API serves directly.
Also from Servosity. Backup & DR is Servosity’s own field - the first-party Servosity connector brings this same fleet-wide, local-mirror approach (fleet attention, stale backups, restores, QBR reporting) to Servosity Backup and DR.
The pain this closes
- A new mailbox or site gets created in Microsoft 365 or Google Workspace but never gets a backup policy attached - and nobody notices until a restore request arrives and the data was never being protected.
- A backup quietly stops landing on a protected resource; the portal still shows the policy attached, so the silent failure stays invisible until the day you actually need that archive.
- Verifying backup coverage across dozens of client tenants means walking the Afi portal one tenant tab at a time, and the public API throttles you for polling.
Install
Works in any of these agents - pick yours:
| Agent | Quick install |
|---|---|
| Claude Desktop | Step-by-step → |
| ChatGPT (Plus/Pro+) | Step-by-step → |
| Claude Code | Step-by-step → |
| Codex CLI | Step-by-step → |
| Cursor, Windsurf, Cline, Continue, Zed, Copilot, Gemini, Hermes, OpenClaw | Which agent? → |
Quickest path for everyone else (terminal):
macOS / Linux:
bash <(curl -fsSL https://raw.githubusercontent.com/servosity/msp-skills/main/skills/afi/install.sh)
Windows (PowerShell):
iwr -useb https://raw.githubusercontent.com/servosity/msp-skills/main/skills/afi/install.ps1 | iex
After install, authenticate once with your Afi credentials, then verify with afi-cli --version.
Safety model
| Tier | Examples | Recommended agent policy |
|---|---|---|
| Read | coverage-gaps, backup-stale, fleet-health, tenant-scorecard, reconcile-licenses, resolve, fleet-sync, and every list/get command | Allow |
| Write (routine) | orgs create, import, tenants resources protections-protect, tenants jobs tasks-trigger | Preview with –dry-run, then a reviewed write |
| Destructive / config | offboard (releases protection), tenants resources protections-unprotect, tenants archives delete | Human-in-the-loop only |
The skill reads your Afi fleet (installations, orgs, tenants, resources, protections, policies, archives, quotas, and task stats) and can run a small set of writes: create a child org, import records, trigger a backup, and add a protection. Three commands are genuinely destructive - offboard, protections-unprotect, and archives delete - because they release backup coverage or delete an archive. Let an agent run reads freely; require a human to approve every write, and especially the destructive tier. Full details in governance.md.
Frequently asked questions
Does this work with ChatGPT?
Yes, on paid ChatGPT plans. ChatGPT connects to remote MCP servers over HTTPS, so you expose the local Afi MCP server via a secure bridge. Step-by-step in the install guide.
Do I need to know how to code?
No. Paste one sentence into Claude Code or Codex and your agent does the install, or run a one-line installer. You enter your credentials once.
Is my Afi data safe?
Your data stays on your machine. The CLI, MCP server, and the local mirror are all local. The AI sees query results, not raw bulk data, and credentials are never bundled or transmitted by MSP Skills.
What does it cost?
Free. Apache-2.0 licensed. You pay only for whichever AI agent you already use.
Will this trip Afi’s API rate limits?
Not if you use it as designed. Afi throttles - and may suspend - applications that poll continuously, so this skill walks the fleet into a local store in one respectful, rate-limited pass with fleet-sync, then answers every question offline against that store. You sync on a schedule, not on every question.
Do I need to be an Afi customer, and what access does the key need?
Yes - you need an Afi account and an Application API key (created in the Afi portal: org level under Configuration to Apps, or tenant level under Service to Settings to Apps). The key inherits the Application’s installation scope, so the CLI sees exactly the orgs and tenants that Application is installed on. Each Application supports two keys for rotation.
Will this replace the Afi portal?
No. Restores, exports, and policy editing still happen in the Afi portal - the public API does not expose them. This skill is the read, report, and guarded-offboard layer: it answers fleet questions and runs the verified archive-then-release, then hands you back to the portal for the actions only it can do.
Status
Beta. Validated against the Afi API surface and being validated with MSPs running it live against their own production tenants in our weekly Build Sessions.
Standards. Conforms to the open Agent Skills spec (Anthropic, Dec 2025; 40+ agents). MCP-compatible - works with any MCP-capable agent including Hermes. OpenClaw-ready (frontmatter pre-wired, awaiting OpenClaw launch).
Maintained by Servosity for the MSP community. Apache-2.0 licensed. Built with CLI Printing Press.