Level + AI in 60 seconds
Unofficial. Community-built Claude Code Skill and MCP server for the Level API. Not affiliated with, endorsed by, or sponsored by Level.
Awaiting live verification - passes every mechanical gate (build, command-surface, claims, install). Be the first to confirm it against your tenant: report it works.
Ask “which Level endpoints are most at risk right now?” and get one ranked list across active alerts, missing patches, low security scores, and dark devices - not four portal tabs. levelio-cli syncs your whole Level fleet into a local mirror, then answers portfolio-wide questions the portal shows one device at a time: patch exposure, stale agents, alert clusters, and per-client QBR scorecards. Offline, instant, and read-only-safe.
New to the term? An MCP server is the same thing ChatGPT calls an app or connector, Claude on the web calls a connector, and Claude Code calls a Skill. One thing, many names →
Install in 60s → View on GitHub →
Instead of clicking through Level, just ask
Instead of Clicking through Level device by device to work out which endpoints need attention first across alerts, patches, and security scores
just ask: “Which Level devices are most at risk right now?”
Your agent runs: levelio-cli at-risk --top 20 --agent
Instead of Filtering the device list by last-seen date to catch the machines that quietly stopped checking in
just ask: “Which Level devices have gone dark in the last 30 days?”
Your agent runs: levelio-cli stale --days 30 --agent
Instead of Opening each client’s group and tallying patch exposure and open criticals by hand for the QBR deck
just ask: “Give me a per-client posture scorecard for my Level fleet”
Your agent runs: levelio-cli client-scorecard --agent
See it in 30 seconds
Demo data is simulated. Every command shown exists in the real CLI.
What it does
| Question your MSP keeps asking | Command your agent runs |
|---|---|
| Which devices are most at risk across alerts, patches, score, and staleness? | levelio-cli at-risk --top 20 |
| Which devices have gone dark and stopped checking in? | levelio-cli stale --days 30 |
| What is my fleet-wide patch exposure, by category? | levelio-cli patch-posture --category security |
| How is my fleet broken down by OS, platform, or group? | levelio-cli fleet --by os |
| Where are my active critical fires, clustered by group? | levelio-cli alert-triage --severity critical |
| Give me a per-client posture scorecard for QBRs. | levelio-cli client-scorecard |
| Which devices are below my security-score threshold? | levelio-cli security-posture --below 70 |
| Which devices are waiting on a reboot to finish patching? | levelio-cli reboot-due |
| Which monitors fire most often across the fleet? | levelio-cli alert-recurrence --top 15 |
| What changed since yesterday - new alerts, updates, device activity? | levelio-cli since --days 1 |
Full command reference at github.com/servosity/msp-skills/blob/main/skills/levelio/guide.md.
What makes this one different
Most Level integrations and MCP servers proxy each question into a single live API call - fine for one device, useless for ‘across the whole fleet.’ This skill syncs Level into a local SQLite mirror with full-text search, so a portfolio-wide question becomes one offline join: instant, rate-limit-free, and the AI sees the answer, not raw bulk data.
Level’s portal surfaces devices one at a time and does not roll exposure up across every client at once; this skill answers the cross-entity, time-windowed questions - at-risk ranking, fleet-wide patch posture, dark-device sweeps, and per-client QBR scorecards - from one local mirror you can read every line of.
The pain this closes
- The Level portal answers one device at a time - there is no single screen for ‘which endpoints across every client need attention first.’
- Patch exposure and reboot debt live per-device; rolling them up across the whole fleet for a QBR means tallying by hand.
- Dark devices and alert noise hide in the queue, so the systemic fires never separate themselves from one-off blips.
Install
Works in any of these agents - pick yours:
| Agent | Quick install |
|---|---|
| Claude Desktop | Step-by-step → |
| ChatGPT (Plus/Pro+) | Step-by-step → |
| Claude Code | Step-by-step → |
| Codex CLI | Step-by-step → |
| Cursor, Windsurf, Cline, Continue, Zed, Copilot, Gemini, Hermes, OpenClaw | Which agent? → |
Quickest path for everyone else (terminal):
macOS / Linux:
bash <(curl -fsSL https://raw.githubusercontent.com/servosity/msp-skills/main/skills/levelio/install.sh)
Windows (PowerShell):
iwr -useb https://raw.githubusercontent.com/servosity/msp-skills/main/skills/levelio/install.ps1 | iex
After install, authenticate once with your Level credentials, then verify with levelio-cli --version.
Safety model
| Tier | Examples | Recommended agent policy |
|---|---|---|
| Read | at-risk, patch-posture, fleet, alert-triage, stale, client-scorecard, security-posture, every list/show, search, sync | Allow |
| Write (routine) | devices update, groups/tags/custom-fields create and update, custom-field-values update, alerts resolve, import | Preview with –dry-run, then a reviewed write |
| Destructive / device actions | devices/groups/tags/custom-fields delete, automations (runs scripts on endpoints), auth set-token | Human-in-the-loop only |
The skill reads everything - reports, rollups, search, and a sync to a local mirror that never writes back to Level. It can also change Level records when you let it: update devices, manage groups, tags, and custom fields, resolve alerts, import data, and trigger automations that run on real endpoints. Recommended policy: give autonomous agents a read-only API key, preview every write with –dry-run, and keep a human in the loop for automations, deletes, and credential changes. Full details in governance.md.
Frequently asked questions
Does this work with ChatGPT?
Yes, on paid ChatGPT plans. ChatGPT connects to remote MCP servers over HTTPS, so you expose the local Level MCP server via a secure bridge. Step-by-step in the install guide.
Do I need to know how to code?
No. Paste one sentence into Claude Code or Codex and your agent does the install, or run a one-line installer. You enter your credentials once.
Is my Level data safe?
Your data stays on your machine. The CLI, MCP server, and the local mirror are all local. The AI sees query results, not raw bulk data, and credentials are never bundled or transmitted by MSP Skills.
What does it cost?
Free. Apache-2.0 licensed. You pay only for whichever AI agent you already use.
Will this hit my Level API rate limits?
Only ‘sync’ calls the Level API, and it paginates politely. Every report, rollup, and search after that runs against the local SQLite mirror - zero API calls, no rate-limit pressure. Re-sync when you want fresh data.
Do I need a paid Level plan or to be a Level partner?
You need a Level account and an API key (Settings > API keys). A read-only key is enough for every report and rollup here, and you can scope it tighter than your portal login. The skill itself is free and open source.
Status
Beta. Validated against the Level API surface and being validated with MSPs running it live against their own production tenants in our weekly Build Sessions.
Standards. Conforms to the open Agent Skills spec (Anthropic, Dec 2025; 40+ agents). MCP-compatible - works with any MCP-capable agent including Hermes. OpenClaw-ready (frontmatter pre-wired, awaiting OpenClaw launch).
Maintained by Servosity for the MSP community. Apache-2.0 licensed. Built with CLI Printing Press.