Skip to main content
Glama
Sign In
Monitoring AIops

Monitoring AIops

by AIops-tools
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Monitoring AIops

Audit availability: Real writes require a committed pending audit row and stop before contacting the platform if storage is unavailable. Reads and previews may continue with a warning; new audit rows store outcome summaries rather than full responses.

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by SolarWinds, Paessler, Zabbix, or any monitoring vendor. SolarWinds, Orion, SWQL, THWACK, PRTG, Paessler and Zabbix are trademarks of their respective owners. MIT licensed.

Governed AI-ops for network / infrastructure monitoring across three NOC platforms in one server — SolarWinds Orion (SWIS REST + SWQL, port 17774 with an automatic fallback to the legacy 17778, HTTP Basic auth), Paessler PRTG (web API, port 443/8080, API token), and Zabbix 6.x/7.x (JSON-RPC 2.0 at /api_jsonrpc.php, API token) — with a built-in governance harness: unified audit log, policy engine, token/runaway budget guard, undo-token recording, and risk-tier labelling on the audit trail. One config can span all NOCs; each target names its own platform.

What it does

Answers the questions a NOC operator actually repeats, and guards the writes that follow:

  • Canned-SWQL library — the most-asked THWACK questions shipped as named, validated queries (nodes_down, flapping_interfaces, muted_report, high_cpu_nodes, volumes_full, unmanaged_scheduled), plus a validated read-only SWQL passthrough (SELECT-only) for everything else.

  • Active-alert dedup / rollup — collapses an interface-flap or node-down storm into a single counted entry instead of a wall of near-identical alerts, across SolarWinds, PRTG, and Zabbix (problems, with the 0-5 severity scale mapped to canonical levels).

  • Triple SolarWinds + PRTG + Zabbix coverage — one MCP server spans all three NOCs; no incumbent hobby MCP does.

  • Governed writes — mute/unmute, maintenance windows (incl. Zabbix maintenance.create with a replayable delete-undo), unmanage/remanage, node removal, and PRTG sensor pause/resume — each audited, risk-tiered, and the destructive ones gated with dry-run + double-confirm. Suppression and maintenance writes are time-boxed (they require an end time / duration).

Related MCP server: Network AI Assistant

What this tool does, and does not, decide

It delivers NOC operations — reads and writes — accurately and efficiently, and records every one of them. It does not decide whether a write is allowed to happen. That is the agent's judgement, or the permission of the account you connect it with: give it a SolarWinds/PRTG/Zabbix account with read-only monitoring scope and the writes fail at the server — the place that actually owns the permission.

So there is no read-only switch, no policy file, no approval gate to configure. The one thing the tool guarantees is that nothing is silent: every call, over MCP and over the CLI alike, lands an audit row in ~/.monitoring-aiops/audit.db, and destructive writes still capture their before-state and record an inverse where one exists.

Each tool declares a risk_level, kept in agreement with its [READ]/[WRITE] documentation tag by a test, and carried into the audit row as a descriptive tier — so a reviewer can see at a glance that a row was a high-risk node removal. It is a label, not a gate.

Running a smaller / local model? See agent-guardrails.md — it lists the guardrails this tool now enforces for you (so you don't spend prompt budget restating them) and gives a ready-made system prompt for what's left.

Capability matrix (42 MCP tools)

Group

Platform

Tools

Count

R/W

SWQL

SolarWinds

swql_library, swql_canned, swql_query

3

read

Alerts

all

active_alerts (dedup/rollup)

1

read

all

alert_acknowledge

1

write (low)

SolarWinds health

SolarWinds

node_status, nodes_list, interface_status, volume_status, application_status, topn, noc_rollup

7

read

SolarWinds writes

SolarWinds

list_events, list_unmanaged, list_muted

3

read

SolarWinds

mute_alerts, unmute_alerts, schedule_maintenance, remanage_node

4

write (med)

SolarWinds

unmanage_node, remove_node

2

write (high)

PRTG reads

PRTG

prtg_sensors, prtg_sensor_details, prtg_devices, prtg_groups, prtg_history, prtg_system_status, prtg_alarms

7

read

PRTG writes

PRTG

pause_sensor, resume_sensor, schedule_maintenance_prtg

3

write (med)

Zabbix reads

Zabbix

zabbix_problems, zabbix_hosts, zabbix_hostgroups, zabbix_triggers, zabbix_events, zabbix_item_history, zabbix_maintenances

7

read

Zabbix writes

Zabbix

zabbix_create_maintenance

1

write (med)

Zabbix

zabbix_delete_maintenance

1

write (high)

Undo

all

undo_list, undo_apply

2

undo

The CLI exposes a convenience subset; the full 42-tool surface is via the MCP server.

Quick start

As a Claude Code plugin

One install gives an agent both the skill and the MCP server:

/plugin marketplace add AIops-tools/marketplace
/plugin install monitoring-aiops@aiops-tools

The MCP server is fetched with uv and pinned to the package version this plugin declares, so an audit row can be traced back to the code that wrote it. Credentials are still configured with monitoring-aiops init — see below.

As an OpenClaw plugin

The same bundle is published on ClawHub, where one install delivers the skill and its MCP server together:

openclaw plugins install clawhub:@zw008/monitoring-aiops
openclaw skills info monitoring-aiops          # expect: Visible to model: yes

Restart the OpenClaw gateway afterwards so it loads the plugin. The MCP server is fetched with uv, pinned to this exact release, so uvx has to be on PATH — without it the skill still installs but reports Visible to model: no. Credentials are configured exactly as below.

As a CLI or standalone MCP server

uv tool install monitoring-aiops          # or: pipx install monitoring-aiops
monitoring-aiops init                     # wizard: pick platform (solarwinds/prtg/zabbix) + store the secret (encrypted)
monitoring-aiops doctor                   # verify config, secrets, connectivity
monitoring-aiops overview                 # NOC summary: platform + active/unacked alerts + top rollup
monitoring-aiops swql library             # list the canned SWQL queries
monitoring-aiops swql canned nodes_down   # run a named canned query

Run as an MCP server (stdio):

export MONITORING_AIOPS_MASTER_PASSWORD=...   # unlock secrets non-interactively
monitoring-aiops mcp

Where that password then lives: an exported variable is readable by every process this shell starts and is recorded by shell history. On a shared or long-lived host, prefer the interactive prompt, or inject it from a secret manager for the life of the one command that needs it.

Governance

Every MCP tool passes through the bundled @governed_tool harness:

  • Audit — every call (params, outcome summary, status, duration, risk tier, approver, rationale) is logged to ~/.monitoring-aiops/audit.db (relocatable via MONITORING_AIOPS_HOME).

  • Budget / runaway guard — token and call budgets trip a circuit breaker on tight poll/retry loops. It is a safety backstop, not authorization.

  • Risk-tier labelling — each tool's declared risk_level is carried into the audit row as a descriptive tier (a label, not a gate). MONITORING_AUDIT_APPROVED_BY / MONITORING_AUDIT_RATIONALE are optional audit annotations, recorded when set and never required.

  • Undo recording — reversible writes record an inverse descriptor (mute_alerts→unmute, unmanage_node→remanage, pause_sensor→resume, zabbix_create_maintenance→delete that maintenance id).

Supported scope & limitations

  • Platforms: SolarWinds Orion (SWIS REST + SWQL), Paessler PRTG (web API), and Zabbix 6.x/7.x (JSON-RPC 2.0; API token via Bearer header on 6.4+/7.x, with a legacy auth-field fallback for 6.0).

  • Zabbix scope: problems/triggers/hosts/host groups/events, bounded item history, maintenance windows (create/delete), and event acknowledge via the cross-platform alert_acknowledge. Template/discovery/user CRUD and trend.get are not covered — open an issue if you need them.

  • Validation status. Behaviour is exercised by the test suite against mocked SWIS/PRTG/Zabbix responses; it has not been run against a live NOC (see docs/VERIFICATION.md). PRTG has a free perpetual 100-sensor Freeware edition with the API, and Zabbix is fully open source (a Docker-compose appliance is a 10-minute live check) — the easiest live checks. SolarWinds is a 30-day trial only; past the trial this tool is mock-only, which is the largest verification debt. monitoring-aiops doctor is the fastest live check (a SWQL query for SolarWinds, /api/status.json for PRTG, unauthenticated apiinfo.version + an authed host count for Zabbix).

Missing a capability?

Want another canned query, a platform dialect fixed, or a capability that isn't here? Open an issue or a PR — feedback and contributions are welcome.

Available Tools

42 tools
active_alertsA
Read-only

[READ] Active alerts with dedup/rollup by message (SolarWinds or PRTG).

Rolls up storms (e.g. interface-flap repeats) into one counted entry so the signal isn't buried under duplicates.

Args: target: Monitoring target name from config; omit for the default.

Inputs: target.

alert_acknowledgeA
Destructive

[WRITE][risk=medium] Acknowledge one active alert (reversible triage action).

Pass dry_run=True to preview (reports the platform whose acknowledge API would be called — the three platforms take different endpoints and different id shapes, so it is the part of this call most worth confirming first).

Args: alert_id: Alert id (AlertActiveID on SolarWinds, sensor objid on PRTG, problem event id on Zabbix). dry_run: If True, preview without acknowledging. target: Monitoring target name from config; omit for the default.

Inputs: alert_id (required), target, dry_run.

application_statusB
Read-only

[READ] SAM application status (Orion.APM.Application); resilient if absent.

Args: target: SolarWinds target name from config; omit for the default.

Inputs: target.

interface_statusA
Read-only

[READ] Interface status + utilization (Orion.NPM.Interfaces).

With top set, sets truncated: true when more interfaces existed than were returned — the whole table is fetched and ranked before the cut, so the flag is measured rather than inferred.

Args: top: If given, return only the top-N interfaces by peak utilization. target: SolarWinds target name from config; omit for the default.

Inputs: top, target.

list_eventsA
Read-only

[READ] Most recent SolarWinds Orion events (newest first).

Sets truncated: true when more events exist than were returned.

Args: top: Number of events to return (newest first). target: SolarWinds target name from config; omit for the default.

Inputs: top, target.

list_mutedB
Read-only

[READ] Objects currently in an alert-suppression (muted) window.

Args: target: SolarWinds target name from config; omit for the default.

Inputs: target.

list_unmanagedB
Read-only

[READ] Nodes unmanaged now or with a scheduled future unmanage window.

Args: target: SolarWinds target name from config; omit for the default.

Inputs: target.

mute_alertsA
Destructive

[WRITE][risk=medium] Time-boxed alert suppression for an entity. Inverse: unmute_alerts.

Args: entity_uri: SWIS entity URI to suppress (e.g. from list_muted / SWQL). minutes: Suppression window length in minutes. target: SolarWinds target name from config; omit for the default.

Inputs: entity_uri (required), target, minutes.

noc_rollupA
Read-only

[READ] One-shot NOC glance: down/warning counts + top-3 worst CPU nodes.

A count that could not be queried is null with the reason in countErrors — never report a null count as "0 down".

Args: target: SolarWinds target name from config; omit for the default.

Inputs: target.

nodes_listA
Read-only

[READ] List SolarWinds nodes, optionally filtered by status.

Args: status: Optional Orion status filter (1=Up, 2=Down, 3=Warning). target: SolarWinds target name from config; omit for the default.

Inputs: status, target.

node_statusA
Read-only

[READ] One SolarWinds node's health by caption or IP (Orion.Nodes).

Args: name_or_ip: Node caption or IP address to look up. target: SolarWinds target name from config; omit for the default.

Inputs: name_or_ip (required), target.

pause_sensorA
Destructive

[WRITE][risk=medium] Pause a PRTG object; reversible via resume_sensor.

Open-ended when minutes is 0, otherwise auto-resumes after minutes.

Args: object_id: PRTG object id (sensor/device/group) to pause. minutes: Auto-resume after this many minutes; 0 pauses indefinitely. message: Pause message shown in PRTG. target: Monitoring target name from config; omit for the default.

Inputs: object_id (required), target, message, minutes.

prtg_alarmsA
Read-only

[READ] Active PRTG alarms — sensors in a down state (status 5).

Args: target: PRTG target name from config; omit for the default.

Inputs: target.

prtg_devicesB
Read-only

[READ] List monitored PRTG devices (objid, device, host, status, group).

Args: target: PRTG target name from config; omit for the default.

Inputs: target.

prtg_groupsC
Read-only

[READ] List PRTG device groups with their rollup status.

Args: target: PRTG target name from config; omit for the default.

Inputs: target.

prtg_historyA
Read-only

[READ] Historic data points for one PRTG sensor over the recent window.

Args: sensor_id: PRTG sensor object id (objid). hours: Look-back window in hours (default 24). target: PRTG target name from config; omit for the default.

Inputs: sensor_id (required), hours, target.

prtg_sensor_detailsB
Read-only

[READ] Detailed status for one PRTG sensor (name, status, lastvalue, ...).

Args: sensor_id: PRTG sensor object id (objid). target: PRTG target name from config; omit for the default.

Inputs: sensor_id (required), target.

prtg_sensorsA
Read-only

[READ] List PRTG sensors (objid, sensor, device, status, message, lastValue).

Args: status: Optional PRTG status code to filter by (e.g. "5" for down). target: PRTG target name from config; omit for the default.

Inputs: status, target.

prtg_system_statusB
Read-only

[READ] System-wide PRTG sensor counters (up/down/warning/paused/alarms).

Args: target: PRTG target name from config; omit for the default.

Inputs: target.

remanage_nodeA
Destructive

[WRITE][risk=medium] Return a node to managed state (lift unmanage).

Args: node_id: Numeric Orion NodeID. target: SolarWinds target name from config; omit for the default.

Inputs: node_id (required), target.

remove_nodeA
Destructive

[WRITE][risk=high] Permanently delete a node from Orion. IRREVERSIBLE — no undo.

Pass dry_run=True to preview (reports the node's caption).

Args: node_id: Numeric Orion NodeID to delete. dry_run: If True, preview without deleting. target: SolarWinds target name from config; omit for the default.

Inputs: node_id (required), target, dry_run.

resume_sensorA
Destructive

[WRITE][risk=medium] Resume a paused PRTG object (inverse of pause_sensor).

Args: object_id: PRTG object id to resume. target: Monitoring target name from config; omit for the default.

Inputs: object_id (required), target.

schedule_maintenanceB
Destructive

[WRITE][risk=medium] Schedule a bounded maintenance window for a node.

An end time is REQUIRED — no open-ended maintenance.

Args: node_id: Numeric Orion NodeID. start_iso: Window start (ISO-8601 UTC timestamp). end_iso: Window end (ISO-8601 UTC timestamp) — required. target: SolarWinds target name from config; omit for the default.

Inputs: end_iso (required), node_id (required), start_iso (required), target.

schedule_maintenance_prtgA
Destructive

[WRITE][risk=medium] Time-boxed maintenance window (a pause of minutes).

Requires minutes > 0 — maintenance windows are never open-ended.

Args: object_id: PRTG object id to place in maintenance. minutes: Maintenance duration in minutes (must be > 0). target: Monitoring target name from config; omit for the default.

Inputs: minutes (required), object_id (required), target.

swql_cannedA
Read-only

[READ] Run a named canned SWQL query (e.g. nodes_down, flapping_interfaces).

Returns the same envelope as swql_query: {"rows": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured against the full result set — do not treat a capped result as the complete answer.

Args: name: Canned query name (from swql_library). params: Optional query params (e.g. {"min": 90} for a threshold). target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

Inputs: name (required), limit, params, target.

swql_libraryA
Read-only

[READ] List the canned-SWQL library (name + description).

These answer the most-repeated SolarWinds SWQL questions directly — run one with swql_canned instead of hand-writing the query.

Args: target: Monitoring target name from config; omit for the default.

Inputs: target.

swql_queryA
Read-only

[READ] Run a validated read-only SWQL SELECT (row-capped).

Only SELECT is permitted — state changes go through the governed write tools. Returns {"rows": [...], "returned": N, "limit": L, "truncated": bool}; when truncated is true the query matched more rows than were returned — narrow the query or raise the limit rather than treating it as the full set.

Args: query: A SWQL SELECT statement. params: Optional named parameters referenced as @name in the query. target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

Inputs: query (required), limit, params, target.

topnA
Read-only

[READ] Top-N SolarWinds nodes by a health metric.

Returns {"nodes": [...], "returned": N, "metric": str, "error": str | None}. A non-null "error" means the SWQL query failed — the opposite finding from "no nodes are under load", so never report one as the other.

Args: metric: One of cpu, memory, latency, packetloss. n: How many nodes to return (default 10). target: SolarWinds target name from config; omit for the default.

Inputs: n, metric, target.

undo_applyA
Destructive

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited and its risk_level recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

Inputs: undo_id (required), target, dry_run.

undo_listA
Read-only

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

Inputs: limit, target.

unmanage_nodeA
Destructive

[WRITE][risk=high] Unmanage a node — masks its monitoring. Inverse: remanage_node.

Pass dry_run=True to preview. Reversible → remanage. An end time is required (no open-ended unmanage).

Args: node_id: Numeric Orion NodeID. start_iso: Unmanage window start (ISO-8601 UTC timestamp). end_iso: Unmanage window end (ISO-8601 UTC timestamp) — required. dry_run: If True, preview without unmanaging. target: SolarWinds target name from config; omit for the default.

Inputs: end_iso (required), node_id (required), start_iso (required), target, +1 more.

unmute_alertsA
Destructive

[WRITE][risk=medium] Resume alerts for an entity (lift suppression).

Args: entity_uri: SWIS entity URI to resume (from list_muted). target: SolarWinds target name from config; omit for the default.

Inputs: entity_uri (required), target.

volume_statusA
Read-only

[READ] Volumes at/above a fill threshold (Orion.Volumes), worst first.

Volumes whose usage Orion did not report are returned separately in unreadableVolumes (percentUsed: null) — they are unmeasured, not empty.

Args: min_percent: Minimum percent-used to include (default 0 = all). target: SolarWinds target name from config; omit for the default.

Inputs: target, min_percent.

zabbix_create_maintenanceA
Destructive

[WRITE][risk=medium] Create a time-boxed Zabbix maintenance window.

Requires minutes > 0 (never open-ended) and at least one host or group id. Reversible: the undo deletes exactly the maintenance id this call created.

Args: name: Maintenance window name shown in Zabbix. minutes: Window length in minutes (must be > 0). host_ids: Host ids to cover (from zabbix_hosts). group_ids: Host-group ids to cover (from zabbix_hostgroups). target: Zabbix target name from config; omit for the default.

Inputs: name (required), minutes (required), target, host_ids, +1 more.

zabbix_delete_maintenanceA
Destructive

[WRITE][risk=high] Delete a Zabbix maintenance window. IRREVERSIBLE — no undo.

Pass dry_run=True to preview (reports the window's full definition). The BEFORE definition lands in priorState.

Args: maintenance_id: Maintenance id to delete (from zabbix_maintenances). dry_run: If True, preview without deleting. target: Zabbix target name from config; omit for the default.

Inputs: maintenance_id (required), target, dry_run.

zabbix_eventsA
Read-only

[READ] Most recent Zabbix trigger events (newest first).

Sets truncated: true when more events exist than were returned; re-run with a higher top rather than treating the result as the whole history.

Args: top: Number of events to return (newest first, capped at 500). target: Zabbix target name from config; omit for the default.

Inputs: top, target.

zabbix_hostgroupsA
Read-only

[READ] Zabbix host groups (ids + names, for inventory and maintenance).

Args: target: Zabbix target name from config; omit for the default.

Inputs: target.

zabbix_hostsB
Read-only

[READ] Zabbix hosts with interfaces + owning groups (health inventory).

Args: target: Zabbix target name from config; omit for the default.

Inputs: target.

zabbix_item_historyA
Read-only

[READ] Bounded metric detail for one Zabbix item (meta + history points).

Sets truncated: true when the item had more points in the window than were returned — the series you got is the most recent slice, not all of it.

Args: item_id: Zabbix item id (from the host's items). hours: Look-back window in hours (capped at 168). limit: Max history points to return (capped at 500). target: Zabbix target name from config; omit for the default.

Inputs: item_id (required), hours, limit, target.

zabbix_maintenancesA
Read-only

[READ] Zabbix maintenance windows with their hosts/groups and periods.

Args: target: Zabbix target name from config; omit for the default.

Inputs: target.

zabbix_problemsB
Read-only

[READ] Current Zabbix problems (active alerts) with mapped severity levels.

Args: min_severity: Only problems at this Zabbix severity (0-5) or above. target: Zabbix target name from config; omit for the default.

Inputs: target, min_severity.

zabbix_triggersB
Read-only

[READ] Zabbix triggers, by default only those currently firing (PROBLEM).

Args: only_problems: If True (default), only triggers in PROBLEM state. target: Zabbix target name from config; omit for the default.

Inputs: target, only_problems.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3.4/5.0

    Scored across 42 tools

    Disambiguation4/5

    Most tools are clearly partitioned by platform prefix (prtg_*, zabbix_*) or by distinct SolarWinds resources, and descriptions are precise about what each returns. However, a few boundaries blur: active_alerts (cross-platform, deduped), zabbix_problems, and prtg_alarms all surface 'current problems', and schedule_maintenance (SolarWinds) vs schedule_maintenance_prtg vs zabbix_create_maintenance could be misselected at a glance.

    Naming Consistency3/5

    PRTG and Zabbix tools follow a clean prefix_noun pattern, but the SolarWinds set mixes verb-first (list_events, mute_alerts, remove_node) and noun-first (node_status, interface_status, topn, noc_rollup) styles with no platform prefix. Singular/plural also varies (node_status vs nodes_list), so the set is readable but not consistent.

    Tool Count3/5

    42 tools is heavy and above the 25-tool threshold, but the surface genuinely spans three separate monitoring platforms plus a write/undo governance layer, so the size is defensible rather than padded. It sits at the borderline end of manageable for an agent's working set.

    Completeness4/5

    Coverage is strong across read inventory, alerts, maintenance windows, mute/unmute, unmanage/remanage, node deletion, canned/raw SWQL, and an undo system, with acknowledge spanning all three platforms. Minor gaps remain (e.g. no explicit PRTG/Zabbix resource-deletion symmetry), but core lifecycle operations are present.

    Maintenance

    ActivityNo data
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • ninjaone-mcp

      WYRE-AI
      A
      license
      Not graded
      quality
      B
      maintenance
      An MCP server for the NinjaOne RMM platform, enabling tools to manage devices, organizations, alerts, jobs, and policies through NinjaOne's API.
      29
      Apache 2.0

    • Zabbix MCP Server

      leroylim
      A
      license
      C
      quality
      D
      maintenance
      Comprehensive MCP server for integrating with Zabbix monitoring systems, providing 90+ API tools across 19 categories for monitoring, alerting, and infrastructure management.
      100
      15
      MIT