Skip to main content
Glama
Sign In
Zabbix MCP Server

Zabbix MCP Server

by initMAX
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

anomaly_detect

Read-only

Detect anomalous hosts by comparing a metric’s trend values across a host group and flagging hosts whose z-score deviates from the group baseline.

Instructions

Detect anomalous hosts by comparing metric values across a host group. Uses z-score analysis on trend data to find hosts that deviate significantly from the group average. Requires at least 2 hosts with data.

Needs identifiers resolved beforehand: a host group ID (hostgroup_get) or a host ID (host_get), and an item key that exists on those hosts (item_get).

Input Schema

NameRequiredDescriptionDefault
hostidNoSingle host ID (from host_get) - compare against group baseline. One of hostgroupid or hostid is required.
periodNoAnalysis period (default: '7d'). A number followed by h (hours), d (days) or m (months of 30 days), e.g. '1h', '6h', '7d', '30d'.7d
serverNoTarget Zabbix server. Available: default. Defaults to 'default' if omitted.
item_keyYesItem key to analyze, matched as a substring of key_ on every host (e.g. 'system.cpu.util', 'vm.memory.utilization'). An item key must be one that exists in Zabbix, never an invented one: when it is not known, resolve it with item_get (hostids or a host filter, search on name or key_; output itemid, name, key_, units, value_type) and use the key_ it returns.
raw_jsonNoStrips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true.
thresholdNoZ-score threshold for anomaly (default: 2.0 = 2 standard deviations)
hostgroupidNoHost group ID (from hostgroup_get) - analyze all hosts in this group. One of hostgroupid or hostid is required.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed7 schema fields changedv1.42.2
    • addedInput schema / additionalProperties
      Added value: +false
    • changedInput schema / properties / hostgroupid / description
      Previous value: -"Host group ID — analyze all hosts in this group"New value: +"Host group ID (from hostgroup_get) - analyze all hosts in this group. One of hostgroupid or hostid is required."
    • changedInput schema / properties / hostid / description
      Previous value: -"Single host ID — compare against group baseline"New value: +"Single host ID (from host_get) - compare against group baseline. One of hostgroupid or hostid is required."
    • changedInput schema / properties / item_key / description
      Previous value: -"Item key pattern to analyze (e.g. 'system.cpu.util', 'vm.memory.utilization')"New value: +"Item key to analyze, matched as a substring of key_ on every host (e.g. 'system.cpu.util', 'vm.memory.utilization'). An item key must be one that exists in Zabbix, never an invented one: when it is not known, resolve it with item_get (hostids or a host filter, search on name or key_; output itemid, name, key_, units, value_type) and use the key_ it returns."
    • changedInput schema / properties / period / anyOf
      Previous value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "pattern": "^\\s*[0-9]+[hdmHDM]\\s*$",
+    "type": "string"
+  },
+  {
+    "type": "null"
+  }
+]
    • changedInput schema / properties / period / description
      Previous value: -"Analysis period: '1d', '7d', '30d' (default: '7d')"New value: +"Analysis period (default: '7d'). A number followed by h (hours), d (days) or m (months of 30 days), e.g. '1h', '6h', '7d', '30d'."
    • changedOutput schema / (root)
      Previous value: -{
-  "properties": {
-    "result": {
-      "title": "Result",
-      "type": "string"
-    }
-  },
-  "required": [
-    "result"
-  ],
-  "title": "_anomaly_detectOutput",
-  "type": "object"
-}New value: +null
  2. First observedv1.41.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint=false, so safety is covered. The description adds meaningful behavior beyond that: the z-score method, the default threshold of 2 standard deviations, the default 7d period, and the data-sufficiency requirement. It does not describe the shape of the returned anomalies, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short paragraphs, front-loaded with purpose, then prerequisites. No filler, though the prerequisite paragraph slightly duplicates what individual schema parameter descriptions already say about hostgroup_get/host_get/item_get.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only analytical tool with full schema coverage and no output schema, the description covers method, inputs, defaults, and prerequisites. The remaining gap is that it never indicates what the anomaly result contains (which hosts, scores, deviations), which would help an agent interpret output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description nonetheless adds practical meaning by explaining how identifiers must be resolved before calling and implying the item_key must exist on the target hosts, beyond the schema's own wording.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Detect anomalous hosts'), names the exact mechanism ('z-score analysis on trend data') and the statistical basis ('deviate significantly from the group average'). This is clearly distinct from every sibling get/report tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit prerequisites and routing: resolve identifiers first via hostgroup_get, host_get, and item_get, and it states the minimum-data condition ('Requires at least 2 hosts with data'). It does not contrast with related analysis siblings such as capacity_forecast or item_threshold_search, but the context for use is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools