Skip to main content
Glama
Zabbix MCP Server

Zabbix MCP Server

ceprule_get

Read-only

Retrieve Zabbix 8.0+ CEP rules that match problem events by name, tags, severity, host, or time window, and inspect their filters, windows, and operations.

Instructions

Retrieve CEP rules (Zabbix 8.0+ complex event processing): the rules that match incoming problem events by name, tags, severity, host, host group or time period, collect them in a time or count window (window_type 0 none, 1 simple window, 2 cause / symptom, 3 simple window once, 4 pattern match) and run operations on them (close, discard, set or change severity, suppress, add / set / rename / remove tags, copy as a new event, close the window). Use selectFilter, selectWindow and selectOperations in extra_params for the full rule; 'error' carries the server's last processing error. Zabbix 8.0 deprecates event correlation (correlation_*) in favour of these rules.

Input Schema

NameRequiredDescriptionDefault
limitNoMaximum number of records to return.
filterNoReturn only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Only these keys are accepted: cep_ruleid, name, window_type, stop, sortorder, status. Text properties cannot be filtered; use 'search' for them.
outputNoProperties of the ceprule object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: cep_ruleid, name, status, window_type, stop, sortorder. Properties: cep_ruleid, description, error, name, sortorder, status, stop, window_type.
searchNoReturn results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Only these keys are accepted: name, description, error.
serverNoTarget Zabbix server. Available: default. Defaults to 'default' if omitted.
raw_jsonNoStrips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true.
sortfieldNoSort by one or more of: cep_ruleid, name, stop, sortorder, status (a list for several; pair with 'sortorder'). No other property is sortable.
sortorderNoSort order: 'ASC' or 'DESC'.
cep_ruleidsNoReturn only CEP rules with the given IDs.
countOutputNoReturn the count of matching rules instead of the records.
extra_paramsNoOther native ceprule.get parameters, merged into the request as-is. Sub-object selects (value 'extend', 'count' or a list of property names): selectFilter, selectOperations, selectWindow. Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed10 schema fields changedv1.42.2
    • addedInput schema / additionalProperties
      Added value: +false
    • changedInput schema / properties / extra_params / anyOf
      Previous value: -[
      -  {
      -    "additionalProperties": true,
      -    "type": "object"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "propertyNames": {
      +      "enum": [
      +        "editable",
      +        "excludeSearch",
      +        "preservekeys",
      +        "searchByAny",
      +        "searchWildcardsEnabled",
      +        "startSearch",
      +        "selectFilter",
      +        "selectOperations",
      +        "selectWindow"
      +      ]
      +    },
      +    "type": "object"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedInput schema / properties / filter / anyOf
      Previous value: -[
      -  {
      -    "additionalProperties": true,
      -    "type": "object"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "propertyNames": {
      +      "enum": [
      +        "cep_ruleid",
      +        "name",
      +        "window_type",
      +        "stop",
      +        "sortorder",
      +        "status"
      +      ]
      +    },
      +    "type": "object"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedInput schema / properties / output / anyOf
      Previous value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "enum": [
      +      "extend",
      +      "count"
      +    ],
      +    "type": "string"
      +  },
      +  {
      +    "items": {
      +      "enum": [
      +        "cep_ruleid",
      +        "description",
      +        "error",
      +        "name",
      +        "sortorder",
      +        "status",
      +        "stop",
      +        "window_type"
      +      ],
      +      "type": "string"
      +    },
      +    "minItems": 1,
      +    "type": "array"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedInput schema / properties / output / description
      Previous value: -"Properties of the ceprule object to return. Pass 'extend' for all, 'count' for the number of matches only, or a comma-separated list of property names. Default when omitted: cep_ruleid, name, status, window_type, stop, sortorder. Properties: cep_ruleid, description, error, name, sortorder, status, stop, window_type."New value: +"Properties of the ceprule object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: cep_ruleid, name, status, window_type, stop, sortorder. Properties: cep_ruleid, description, error, name, sortorder, status, stop, window_type."
    • changedInput schema / properties / search / anyOf
      Previous value: -[
      -  {
      -    "additionalProperties": true,
      -    "type": "object"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "propertyNames": {
      +      "enum": [
      +        "name",
      +        "description",
      +        "error"
      +      ]
      +    },
      +    "type": "object"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedInput schema / properties / sortfield / anyOf
      Previous value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "enum": [
      +      "cep_ruleid",
      +      "name",
      +      "stop",
      +      "sortorder",
      +      "status"
      +    ],
      +    "type": "string"
      +  },
      +  {
      +    "items": {
      +      "enum": [
      +        "cep_ruleid",
      +        "name",
      +        "stop",
      +        "sortorder",
      +        "status"
      +      ],
      +      "type": "string"
      +    },
      +    "minItems": 1,
      +    "type": "array"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedInput schema / properties / sortfield / description
      Previous value: -"Sort by one or more of: cep_ruleid, name, stop, sortorder, status (comma-separated for several; pair with 'sortorder'). No other property is sortable."New value: +"Sort by one or more of: cep_ruleid, name, stop, sortorder, status (a list for several; pair with 'sortorder'). No other property is sortable."
    • changedInput schema / properties / sortorder / anyOf
      Previous value: -[
      -  {
      -    "type": "string"
      -  },
      -  {
      -    "type": "null"
      -  }
      -]New value: +[
      +  {
      +    "enum": [
      +      "ASC",
      +      "DESC"
      +    ],
      +    "type": "string"
      +  },
      +  {
      +    "items": {
      +      "enum": [
      +        "ASC",
      +        "DESC"
      +      ],
      +      "type": "string"
      +    },
      +    "minItems": 1,
      +    "type": "array"
      +  },
      +  {
      +    "type": "null"
      +  }
      +]
    • changedOutput schema / (root)
      Previous value: -{
      -  "properties": {
      -    "result": {
      -      "title": "Result",
      -      "type": "string"
      -    }
      -  },
      -  "required": [
      -    "result"
      -  ],
      -  "title": "ceprule_getOutput",
      -  "type": "object"
      -}New value: +null
  2. First observedv1.41.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description adds domain behaviour beyond that — the meaning of each window_type value, the catalogue of operations a rule can run, and the fact that 'error' carries the server's last processing error. It does not mention result ordering defaults or what happens when extra_params selectors are omitted, which would have pushed it higher.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core verb and resource, then progressively denser detail; the long opening sentence earns its length by encoding window types and operations that no structured field supplies. It is dense but not padded, though the trailing deprecation note could be one clause shorter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter read tool with no output schema, the description covers the resource model, the extra_params expansion path and one notable return field ('error'). What is thinner is the return shape itself — the default returned property set is only stated in the schema, and the description never says results are a list of rule objects, so a reader relying on the description alone has a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3, but the description earns above it by decoding window_type (0 none, 1 simple window, 2 cause/symptom, 3 simple window once, 4 pattern match), which the schema only lists as a bare property name, and by explaining what selectFilter/selectWindow/selectOperations add to the returned rule. It does not clarify the interaction between cep_ruleids and filter, or the sortfield/sortorder pairing beyond what the schema already says.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Retrieve CEP rules') and then defines the resource domain precisely: rules that match problem events by name, tags, severity, host, host group or time period, collect them in a window, and run operations. It also distinguishes itself from the sibling correlation_get by noting that Zabbix 8.0 deprecates event correlation (correlation_*) in favour of these rules, so an agent can route between the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use and names the sibling it supersedes, plus tells the agent to pass selectFilter, selectWindow and selectOperations via extra_params to get the full rule rather than the default shallow output. It stops short of explicit when-not guidance (e.g. when to prefer correlation_get on older releases, or when to page via limit) and gives no pagination advice for large rule sets.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.