> For the complete documentation index, see [llms.txt](https://support.suptask.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.suptask.com/integrations-automations-and-workflows/integration-guides/pdq-connect.md). # PDQ Connect Integrate with PDQ and manage devices and vulnerabilities from ticket directly The PDQ Connect connector links Suptask to your PDQ Connect organization. Once connected, the AI Assistant on an Inbox can look up devices, software, packages, deployments and vulnerabilities — and, depending on the tools you enable, deploy packages, create groups and remediate vulnerabilities directly from a ticket in Slack. PDQ Connect is connected natively through its public MCP server. There is no app registration and no API key to create: you click **Connect**, sign in to PDQ, and approve access. {% hint style="info" %} You set up this connector in the Suptask Web App as an admin under Intelligence. Your agents then use it from Slack while working on tickets. {% endhint %} *** ### What you can use it for * **Answer device questions from a ticket** — an agent asks which devices are missing an app, which are pending a reboot, or when a machine last checked in, without leaving Slack. * **Resolve software requests** — a user asks for an application, the Assistant finds the package and deploys it to the right device or group. * **Triage vulnerabilities** — surface the CVEs affecting your fleet, rank the most exposed devices, and deploy the recommended remediation. * **Enrich tickets with fleet context** — attach the requester's device details, OS build or software inventory to the ticket automatically. * **Close the loop on IT requests** — the ticket, the action and the audit trail all stay connected. *** ### Before you begin You'll need: * An **admin** role in Suptask. * A **PDQ Connect** account. * A PDQ user with the permissions you want the Assistant to have. The connector acts as the user who authorizes it - see [How permissions work](https://claude.ai/chat/06e5a618-4dd4-4e42-b501-10144ceb0839#how-permissions-work). * The **Inbox** you want to connect PDQ Connect to. What you'll do: * Add the PDQ Connect connector on your Inbox * Authorize with PDQ using OAuth * Choose which tools your Assistant may use {% hint style="warning" %} The PDQ Connect MCP is in Early Access with PDQ. The available tools and their names may change as PDQ continues to build it out. {% endhint %} *** ### Step 1: Connect PDQ Connect in Suptask 1. In the Suptask Web App, open the **Inbox** you want to connect PDQ Connect to. 2. Go to the **AI Assistant** settings and open **Connectors**. 3. Add the **PDQ Connect** connector. 4. Click **Authorize**. 5. A PDQ sign-in window opens. Sign in with the PDQ account you want the Assistant to act as, select your **organization**, and approve access. When it's done, the connector status changes to **Connected**. {% hint style="info" %} No Client ID, Client Secret or redirect URL is needed. PDQ Connect is a native MCP connector — the entire setup is the OAuth approval. {% endhint %} *** ### Step 2: Choose which tools your Assistant may use The connector provides a set of **tools** to the AI Assistant. Each tool can be set individually, so you can let the Assistant read your fleet without allowing it to change anything. Each tool can be set to: * **Auto** — the Assistant uses the tool on its own when it's relevant. * **Ask** — the Assistant prepares the action and pauses for an agent to approve before it runs. * **Off** — the Assistant can't use the tool at all.
#### Read tools These tools only look things up. They're safe to leave on **Auto**. | Tool | What it does | | --------------------------------- | -------------------------------------------------------- | | **Search Devices** | Search and query devices in your fleet | | **Search Groups** | Find device groups | | **Search Packages** | Find packages available to deploy | | **Search Deployments** | Search and query deployments and their status | | **Search Automations** | List and filter automations | | **Search Software** | Find software across your organization | | **List Software Devices** | List the devices a given piece of software is on | | **Search Vulnerabilities** | Find and rank CVEs affecting your organization | | **Search Device Vulnerabilities** | Find CVEs detected on specific devices | | **Rank Top Vulnerable Devices** | Rank devices by number of open vulnerabilities | | **Get Vulnerability Details** | Look up a CVE's details and your organization's exposure | #### Write tools These tools change something in PDQ Connect. Set them to **Ask** so an agent reviews the action before it runs. | Tool | What it does | | ------------------------------------ | ------------------------------------------------ | | **Create Group** | Create a device group | | **Create Deployment** | Deploy packages to devices or groups | | **Create Automation** | Create or update an automation | | **Deploy Vulnerability Remediation** | Deploy the recommended package to fix CVEs | | **Ignore Org Vulnerabilities** | Ignore or un-ignore CVEs across the organization | | **Ignore Device Vulnerabilities** | Ignore or un-ignore CVEs on specific devices | {% hint style="info" %} A common setup is Auto for every read tool and Ask for every write tool. That gives agents instant answers while keeping a human in the loop before anything is deployed or changed. {% endhint %} *** ### How permissions work The connector inherits the permissions of the PDQ user who authorized it. It cannot grant access that the account doesn't already have. * If the authorizing user can't deploy a package in the PDQ console, the Assistant can't either. * The Assistant only sees the devices, groups and packages that the account already has access to. * Tool settings in Suptask sit **inside** those permissions. They can restrict what the Assistant does, never expand it. {% hint style="warning" %} Authorize with an account that has the right scope — no more. If you authorize with a full administrator, every tool set to Auto runs with full administrator rights in PDQ. {% endhint %} *** ### Use different PDQ access per Inbox Each Inbox in Suptask has its own connector, so different teams can work against PDQ Connect in different ways: * **IT Helpdesk Inbox** — read devices and software, deploy packages on **Ask**. * **Security Inbox** — read vulnerabilities and remediate on **Ask**. A ticket in one Inbox only reaches the tools enabled on that Inbox's connector. *** ### How to use the integration The connector is used by the AI Assistants you set up in Suptask. Agents work with it in Slack, from inside the ticket. Examples of what an agent can ask in a ticket thread: ``` @Suptask does the requester's laptop have Chrome installed? ``` ``` @Suptask which devices in the Finance group are pending a reboot? ``` ``` @Suptask deploy the 7-Zip package to this user's device ``` When a tool is set to **Ask**, the Assistant posts the prepared action in the ticket and waits for an agent to approve it before running. {% content-ref url="/pages/EMXzCysY1oz2JPFXI8gH" %} [AI Assistants](/suptask-ai/ai-assistants.md) {% endcontent-ref %} *** ### Auditing and revoking access Everything the Assistant changes in PDQ Connect is recorded in your PDQ **Audit Logs**, alongside actions taken in the console. Read-only lookups are not logged, since they don't change anything. In PDQ, the **App connections** settings page lists every app connected through MCP. From there you can see who authorized each connection and **revoke** it. Revoking immediately cuts off access — the Suptask connector stops working until it's authorized again. {% hint style="info" %} Revoking a connection in PDQ only removes that app's access. It does not change the account's own roles or permissions in PDQ Connect. {% endhint %} *** ### Troubleshooting * **Authorization window closes without connecting** — the sign-in wasn't completed, or the account belongs to a different PDQ organization. Click **Authorize** again and confirm you're selecting the right organization. * **The Assistant can't find a device or package** — it may sit outside the organization you connected, or the authorizing PDQ account doesn't have access to it. * **The Assistant can read but won't deploy** — the write tool is set to **Off**, or it's set to **Ask** and is waiting for an agent to approve. Check the tool settings on the Assistant. * **PDQ denies an action the tool allows** — the authorizing PDQ account lacks that permission in the console. Tool settings in Suptask can't grant access the account doesn't have. * **It worked before and stopped** — the connection may have been revoked from the **App connections** page in PDQ, or the authorizing account was disabled. Reconnect the connector. * **A tool disappeared or changed name** — the PDQ Connect MCP is in Early Access and its tool list evolves. Reopen the connector to review the current tools and their settings. *** ### Need help? Reach out to [Suptask Support](https://claude.ai/getting-started/contact-support.md) and our team will help you connect PDQ Connect.