{
  "markdown": "<!-- mcp-name: io.github.AIops-tools/monitoring-aiops -->\n\n# Monitoring AIops\n\n> **Disclaimer**: Community-maintained open-source project. **Not affiliated with, endorsed by, or sponsored by SolarWinds, Paessler, Zabbix, or any monitoring vendor.** SolarWinds, Orion, SWQL, THWACK, PRTG, Paessler and Zabbix are trademarks of their respective owners. MIT licensed.\n\nGoverned AI-ops for **network / infrastructure monitoring** across three NOC\nplatforms in one server — **SolarWinds Orion** (SWIS REST + SWQL, port 17774\nwith an automatic fallback to the legacy 17778, HTTP Basic auth), **Paessler\nPRTG** (web API, port 443/8080, API token), and\n**Zabbix 6.x/7.x** (JSON-RPC 2.0 at `/api_jsonrpc.php`, API token) — with\na **built-in governance harness**: unified audit log, policy engine,\ntoken/runaway budget guard, undo-token recording, and risk-tier labelling on\nthe audit trail. One config can span all NOCs; each target names its own\n`platform`.\n\n## What it does\n\nAnswers the questions a NOC operator actually repeats, and guards the writes\nthat follow:\n\n- **Canned-SWQL library** — the most-asked THWACK questions shipped as named,\n  validated queries (`nodes_down`, `flapping_interfaces`, `muted_report`,\n  `high_cpu_nodes`, `volumes_full`, `unmanaged_scheduled`), plus a **validated\n  read-only SWQL passthrough** (SELECT-only) for everything else.\n- **Active-alert dedup / rollup** — collapses an interface-flap or node-down\n  storm into a single counted entry instead of a wall of near-identical alerts,\n  across SolarWinds, PRTG, and Zabbix (problems, with the 0-5 severity scale\n  mapped to canonical levels).\n- **Triple SolarWinds + PRTG + Zabbix coverage** — one MCP server spans all\n  three NOCs; no incumbent hobby MCP does.\n- **Governed writes** — mute/unmute, maintenance windows (incl. Zabbix\n  `maintenance.create` with a **replayable delete-undo**), unmanage/remanage,\n  node removal, and PRTG sensor pause/resume — each audited, risk-tiered, and\n  the destructive ones gated with **dry-run + double-confirm**. Suppression and\n  maintenance writes are **time-boxed** (they require an end time / duration).\n\n## What this tool does, and does not, decide\n\nIt delivers NOC operations — reads and writes — accurately and efficiently, and\nrecords every one of them. It does **not** decide whether a write is allowed to\nhappen. That is the agent's judgement, or the permission of the account you\nconnect it with: give it a SolarWinds/PRTG/Zabbix account with read-only\nmonitoring scope and the writes fail at the server — the place that actually\nowns the permission.\n\nSo there is no read-only switch, no policy file, no approval gate to configure.\nThe one thing the tool guarantees is that nothing is silent: **every call, over\nMCP and over the CLI alike, lands an audit row** in\n`~/.monitoring-aiops/audit.db`, and destructive writes still capture their\nbefore-state and record an inverse where one exists.\n\n> Each tool declares a `risk_level`, kept in agreement with its `[READ]`/`[WRITE]`\n> documentation tag by a test, and carried into the audit row as a descriptive\n> tier — so a reviewer can see at a glance that a row was a high-risk node\n> removal. It is a label, not a gate.\n\nRunning a smaller / local model? See\n[agent-guardrails.md](skills/monitoring-aiops/references/agent-guardrails.md) — it lists\nthe guardrails this tool now enforces for you (so you don't spend prompt budget\nrestating them) and gives a ready-made system prompt for what's left.\n\n## Capability matrix (42 MCP tools)\n\n| Group | Platform | Tools | Count | R/W |\n|-------|----------|-------|:-----:|:---:|\n| **SWQL** | SolarWinds | `swql_library`, `swql_canned`, `swql_query` | 3 | read |\n| **Alerts** | all | `active_alerts` (dedup/rollup) | 1 | read |\n| | all | `alert_acknowledge` | 1 | write (low) |\n| **SolarWinds health** | SolarWinds | `node_status`, `nodes_list`, `interface_status`, `volume_status`, `application_status`, `topn`, `noc_rollup` | 7 | read |\n| **SolarWinds writes** | SolarWinds | `list_events`, `list_unmanaged`, `list_muted` | 3 | read |\n| | SolarWinds | `mute_alerts`, `unmute_alerts`, `schedule_maintenance`, `remanage_node` | 4 | write (med) |\n| | SolarWinds | `unmanage_node`, `remove_node` | 2 | write (**high**) |\n| **PRTG reads** | PRTG | `prtg_sensors`, `prtg_sensor_details`, `prtg_devices`, `prtg_groups`, `prtg_history`, `prtg_system_status`, `prtg_alarms` | 7 | read |\n| **PRTG writes** | PRTG | `pause_sensor`, `resume_sensor`, `schedule_maintenance_prtg` | 3 | write (med) |\n| **Zabbix reads** | Zabbix | `zabbix_problems`, `zabbix_hosts`, `zabbix_hostgroups`, `zabbix_triggers`, `zabbix_events`, `zabbix_item_history`, `zabbix_maintenances` | 7 | read |\n| **Zabbix writes** | Zabbix | `zabbix_create_maintenance` | 1 | write (med) |\n| | Zabbix | `zabbix_delete_maintenance` | 1 | write (**high**) |\n| **Undo** | all | `undo_list`, `undo_apply` | 2 | undo |\n\nThe CLI exposes a convenience subset; the full 42-tool surface is via the MCP\nserver.\n\n## Quick start\n\n### As a Claude Code plugin\n\nOne install gives an agent both the skill and the MCP server:\n\n```\n/plugin marketplace add AIops-tools/marketplace\n/plugin install monitoring-aiops@aiops-tools\n```\n\nThe MCP server is fetched with [uv](https://docs.astral.sh/uv/) and pinned to the\npackage version this plugin declares, so an audit row can be traced back to the\ncode that wrote it. Credentials are still configured with `monitoring-aiops init` — see below.\n\n### As a CLI or standalone MCP server\n\n```bash\nuv tool install monitoring-aiops          # or: pipx install monitoring-aiops\nmonitoring-aiops init                     # wizard: pick platform (solarwinds/prtg/zabbix) + store the secret (encrypted)\nmonitoring-aiops doctor                   # verify config, secrets, connectivity\nmonitoring-aiops overview                 # NOC summary: platform + active/unacked alerts + top rollup\nmonitoring-aiops swql library             # list the canned SWQL queries\nmonitoring-aiops swql canned nodes_down   # run a named canned query\n```\n\nRun as an MCP server (stdio):\n\n```bash\nexport MONITORING_AIOPS_MASTER_PASSWORD=...   # unlock secrets non-interactively\nmonitoring-aiops mcp\n```\n\n## Governance\n\nEvery MCP tool passes through the bundled `@governed_tool` harness:\n\n- **Audit** — every call (params, result, status, duration, risk tier,\n  approver, rationale) is logged to `~/.monitoring-aiops/audit.db` (relocatable\n  via `MONITORING_AIOPS_HOME`).\n- **Budget / runaway guard** — token and call budgets trip a circuit breaker on\n  tight poll/retry loops. It is a safety backstop, not authorization.\n- **Risk-tier labelling** — each tool's declared `risk_level` is carried into\n  the audit row as a descriptive tier (a label, not a gate).\n  `MONITORING_AUDIT_APPROVED_BY` / `MONITORING_AUDIT_RATIONALE` are optional\n  audit annotations, recorded when set and never required.\n- **Undo recording** — reversible writes record an inverse descriptor\n  (`mute_alerts`→unmute, `unmanage_node`→remanage, `pause_sensor`→resume,\n  `zabbix_create_maintenance`→delete that maintenance id).\n\n## Supported scope & limitations\n\n- **Platforms**: SolarWinds Orion (SWIS REST + SWQL), Paessler PRTG (web API),\n  and Zabbix 6.x/7.x (JSON-RPC 2.0; API token via Bearer header on 6.4+/7.x,\n  with a legacy `auth`-field fallback for 6.0).\n- **Zabbix scope**: problems/triggers/hosts/host groups/events, bounded item\n  history, maintenance windows (create/delete), and event acknowledge via the\n  cross-platform `alert_acknowledge`. Template/discovery/user CRUD and\n  `trend.get` are not covered — open an issue if you need them.\n- **Validation status.** Behaviour is exercised by the test suite against mocked\n  SWIS/PRTG/Zabbix responses; it has not been run against a live NOC (see\n  [`docs/VERIFICATION.md`](docs/VERIFICATION.md)). **PRTG has a free perpetual 100-sensor Freeware\n  edition with the API, and Zabbix is fully open source (a Docker-compose\n  appliance is a 10-minute live check) — the easiest live checks.** SolarWinds\n  is a 30-day trial only; past the trial this tool is **mock-only, which is\n  the largest verification debt.** `monitoring-aiops doctor` is the fastest\n  live check (a SWQL query for SolarWinds, `/api/status.json` for PRTG,\n  unauthenticated `apiinfo.version` + an authed host count for Zabbix).\n\n## Missing a capability?\n\nWant another canned query, a platform dialect fixed, or a capability that isn't\nhere? **Open an issue or a PR — feedback and contributions are welcome.**\n",
  "bytes": 8477,
  "sha": "2f02c6e01501bc355512fc53ed7b0cf51c8b7f004a0c428b8d8a9a0dffe9ffc6",
  "repo_slug": "aiops-tools/monitoring-aiops",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_aiops_tools_monitoring_aiops_82b98e5e/readme"
}