LLM Backend
Pick where the slot-fill extractor runs. Both cards save independently — flipping the radio doesn't lose the other's settings. Review-queue Claude suggestions are separate and unaffected by this choice.
/v1/chat/models for the saved key (grouped by
vendor; credit band in brackets). Pick Custom… to type an id by hand.
anthropic.claude-haiku-4-5 is the cost-efficient pick for ticket grading.
X-API-Key. Stored as a server-side secret, shown masked —
leave the masked value to keep the current key.
VLLM_BASE_URL / VLLM_MODEL). The
Save Launcher Config button in the Docker launcher panel writes the
vLLM flags to config/vllm.json and auto-syncs those two values for you.
Deployment URLs
Where the public DMLLM site lives. This URL gets embedded in every escalation email and Teams card — techs click it to land on the approval page. It must be the frontend / Vercel URL (where users sign in) and not the backend / Tailscale Funnel URL — otherwise the page loads without the viewer's Supabase session and the "Claim this" / "Transfer" / "Loop in" buttons stay hidden.
Performance logging
Logs a WARNING when a chat turn or a single
LLM call is slow — with timing, token counts, and (for
turns) the truncated request + reply. Turn it on to
diagnose latency, then back off. Off
means no conversation text is written to the logs.
Slide BCDR
Global Slide API key — this single key gives access to all client devices. Per-client linking is configured on the Clients tab.
Autotask PSA
Credentials for the ticket-lookup workflow. The three values below come from the API User you create in Autotask (Admin → Resources → new API User, Security Level: "API User (system)"). Per-client Autotask company IDs are configured on the Clients tab so each DMLLM customer only sees tickets scoped to their own companies.
IT Glue
Shows each customer's IT Glue Quick Notes (and the org Alert) in a sidebar on the portal ticket page — MSP viewers only, read-only. The ticket's Autotask company is matched to the PSA-synced organization. Generate the key in IT Glue → Admin → Settings → API Keys.
TimeZest
Adds a Request appointment card to the portal ticket page (MSP viewers only): pick agents/teams + an appointment type, then send the scheduling request (TimeZest emails the customer per your workflow) or generate a URL. Existing requests for the ticket are listed with their status. Needs a read/write key from TimeZest → Settings → API Keys.
Customer Issue Reporting (MSPTrack)
The reporting engine pulls a year of Autotask tickets per customer, summarizes them, and writes the report into MSPTrack's separate Supabase project for its front-end to render. These two values point DMLLM at that project (service-role key — stored in app_secrets, never exposed to browsers). Leave blank to keep reporting off.
Pulls each consented + linked customer's verified Microsoft 365 domains into MSPTrack's domains list. Use the button to run it now and verify linking + Domain.Read.All consent; insert-only, safe to re-run.
Teams Meeting Recaps (MSPTrack)
The recap worker consumes MSPTrack's meeting ingest queue, downloads Teams transcripts from Microsoft Graph, summarizes them on-box, writes results into MSPTrack, and emails recaps to enrolled internal users. It authenticates to Graph as MSPTrack's app registration (the one the Teams access policy is granted to — NOT itbot). All values apply live on the next worker tick, no restart.
⚠ Tenant prerequisites (separate from app permissions):
Microsoft added two tenant controls for Graph
transcript access, both OFF by default (enforced 2026):
EnableGraphTranscriptAccess — subscription create
fails 403 "…access to transcripts is disabled…"
without it; and EnableAttributedTranscripts — the
worker fetches the speaker-named (attributed) VTT for
action-item ownership, which 403s
SpeakerAttributionNotAllowed without it (the meeting
then bounces pending forever). A Teams/Global admin enables
both tenant-wide (Teams PowerShell 7.9+):
Connect-MicrosoftTeams
Access-gates, not transcription settings, so they apply
RETROACTIVELY to existing transcripts. Propagates in up to a
few hours; the worker/renew clears on its next attempt.
Set-CsTeamsMeetingConfiguration -Identity Global -EnableGraphTranscriptAccess $true -EnableAttributedTranscripts $true
Daily Morning Briefing
Each weekday morning (local time), every enrolled staff member gets a personalized "top things to focus on today" email synthesized from their tickets, tasks, meeting action items, calendar, and inbox. Enrollment is managed in msptrack → Meetings → Daily briefings. Graph auth reuses the MSPTrack app registration above; the calendar and inbox sections need Mail.Read + Calendars.Read admin consent on that app and skip gracefully until granted. All values apply live on the next tick.
Live Monitor Exporters
For the split-host setup (vLLM on a separate GPU box). DMLLM applies these live — the monitor picks them up within ~2s, no restart. Blank = read GPU/CPU/RAM locally. An env var on the DMLLM box overrides these.
Autotask Ticket Defaults
Defaults applied to every ticket DMLLM creates, regardless of customer. Single global routing — when a user hits "Create ticket" via chat the form pre-fills these so the user never has to pick. Picklists below come from your live Autotask install; pick the values you want every ticket to land with.
Portal Ticket Views
Named "views" shown as tabs on the customer portal next to Open / Waiting / Closed / All. Each view can FILTER OUT one or more Autotask queues (Ctrl/Cmd-click to pick several) — e.g. a "User Tickets" view that hides the Monitoring Alerts queue, alongside an "All Tickets" view that hides nothing. Pick which view the portal opens on by default.
Portal Ticket Status Views
Build your own status tabs for the customer portal. Each view is a name plus the Autotask statuses it shows (Ctrl/Cmd-click to pick several) — and the same status can appear in more than one view. A built-in "All" tab is always shown. Until you save any views, the portal seeds Open / Waiting / Closed from the status names. (Portal only — the MSP chat keeps its own Open / Waiting / Closed filters.)
Anthropic (Claude)
Admin-only — powers the 💡 Suggest button on the review queue. The live helpdesk chat still runs on local Ollama. Get a key at console.anthropic.com.
Kaseya Quote Manager
Powers the portal Quotes tab. Generate a read-only API key in KQM under Admin Center → My account → Developer API. Stored in Supabase — no local .env needed.
Microsoft 365 (MSP app)
The DMI multi-tenant app customers approve via the
Connect Microsoft 365 button on the Clients tab.
Set this once. On the app registration in Azure, add a Redirect
URI of {Backend URL}/api/azure/consent/callback.
Datto RMM (on-prem AD password resets)
The MSP's Datto RMM account. Used to reset AD-synced passwords on a customer's domain controller. Build the reset component once (Datto → Automation → Components, the PowerShell script) and paste its UID below. Each customer's site + DC device are set on the Clients tab.
AI Audit Dashboard (installed-software classifier)
The AI Audit Dashboard reads client computers' installed programs from Datto RMM. Every
6 hours (when the schedule is on), DMLLM asks it for up to
500 programs no rule covers yet, decides with the active LLM backend
whether each is an AI tool, and sends the verdicts back. Only program names are exchanged: no
client, computer or user names. A program's name can still include a client's name (an in-house
application, say), and the names go to the active backend, which may be a cloud model.
AI and Unsure verdicts always wait for a person on the dashboard's
Software Review page; confident Not AI verdicts become rules on their own only when
auto-apply is on below. The API key must equal the dashboard's SoftwareClassifierApiKey
app setting. Start with Run now and check the results before turning the schedule on.
Only programs the dashboard has seen at 2 or more Datto sites are searched (an in-house program, which may carry a client's name, is usually at one), and only by their normalized name; a name with a user folder in it is never searched. The search goes to Brave Search, so those names leave DMLLM. A verdict made with search results always waits for a person, whatever its confidence, and its reason lists the sources. Results are cached, and at most 50 searches run per run and 1500 per month (0 used this month).
Slide Alerts (Autotask tickets instead of alert e-mails)
Every 30 minutes (when on), DMLLM reads Slide's unresolved alerts (missed backup, backup failed, agent or box not checking in, storage) and opens one Autotask ticket per alert, in the default queue from Autotask Ticket Defaults unless a queue is named below. The Slide client is matched to an Autotask company through the tenant that lists both (Clients → Slide client IDs + Autotask companies); alerts for unmatched Slide clients go to the fallback company with the Slide client name in the title. When Slide resolves an alert the ticket is completed with a note; when a tech completes the ticket first, the Slide alert is marked resolved so Slide re-detects the problem if it is still there. A recurrence inside the grace period below is held rather than ticketed: if it clears in time only a history note goes on the original ticket, and if it is still unresolved when the period ends the original ticket is reopened so the engineer who closed it owns it again. Uses the Slide API key from the Slide BCDR card. Start with Run now and check the tickets before turning the schedule on.
Microsoft Teams Bot (optional — Phase 3a)
When a tech is transferred to or looped into an
approval, the Teams bot posts an @mention message
that pings them on their device — a hard
notification rather than a silent channel post.
Requires a Microsoft Bot resource + Teams app
install. See docs/azure-bot-setup.md
for the walkthrough. Leaving these blank disables
the bot — escalations still work, just without
the @mention.
System Prompt
This prompt defines how the LLM behaves. It sets the rules, workflows, and tone for all interactions.
Grading Rubric
The per-ticket prompt the LLM uses to score every ticket. Edits apply to new and force-re-enriched grades on the next pass (no restart) — existing grades stay until you click Force re-enrich. Must keep the JSON score keys and end with --- TICKET DATA ---. Preview before saving.
Backend service
The machine running the DMLLM backend. In production it is the DMLLM Backend
Windows service (services.msc / Get-Service DMLLM): install with
scripts\install-service.ps1 (elevated PowerShell), control with
scripts\dmllm-service.ps1 -Status|-Start|-Stop|-Restart|-Tail or plain
Restart-Service DMLLM. Deploys restart it automatically.
Live log
Tails logs\dmllm.log on the backend host. "Status noise" is the constant
chatter — live-sampler posts every 2 s, health polls, backend liveness probes — tagged
[noise] in the file and hidden here by default.
Create User
Users
Voice surface
Optional voice layer on top of the chat UI. STT (mic → text) runs locally on
faster-whisper;
TTS (text → voice) runs locally on Piper.
First-time setup needs scripts/setup-voice.ps1 to download the Whisper model + at least one Piper voice.
Both off by default — flip Enable voice features on once the deps + models are in place.
Speech-to-text (Whisper)
~/.cache/huggingface after.
en, es). Blank lets Whisper auto-detect per utterance — slower, only useful for multilingual sessions.
Text-to-speech
*.onnx in models/piper/. Kokoro: voices baked into voices-v1.0.bin (af_*, am_*, bf_*, bm_*).
0.85× gives a measured, wizardly cadence; 1.2× is brisk; 2.0× is double-time (useful for replaying long replies). 1.0× = native pace of the voice model.