vibeMK-MCP 🚀

CheckMK Monitoring via LLM - Professional MCP Server

A maintained continuation of chexma/vibeMK by Andre, whose last release was in August 2025. This fork keeps the project going: it carries the original work forward under the same GPL-3.0 licence, preserves its history and authorship, and adds fixes verified against the OpenAPI document a CheckMK site publishes for itself. Tool names are unchanged (vibemk_*), so existing client configurations keep working, with the exception of the three tools listed under Verification. If the original author resumes, everything here is offered back.

🎯 Overview

vibeMK enables complete management of your CheckMK monitoring environment directly through LLM interfaces using natural language. This project is in the alpha stage and under development. I accept no liability for any damage resulting from the use of this software.

Related MCP server: Linuxfabrik MCP Server for Icinga

vibeMK - Current Features

Live Monitoring ✅

• Host Status: Real-time host state (UP/DOWN/UNREACHABLE) with hard state detection

• Service Status: Live service monitoring (OK/WARNING/CRITICAL/UNKNOWN)

• Performance Metrics: Retrieve metrics data with automatic discovery

• Current Problems: Auto-detect all active monitoring issues

Downtime Management ✅

• Schedule Downtimes: Create host/service downtimes with flexible duration parsing ("2h", "1h30m")

• List & Filter: View all downtimes or filter for active ones only

Problem Management ✅

• Acknowledge Problems: Set acknowledgements for host/service issues (sticky/persistent options)

• List Acknowledgements: View all current problem acknowledgements

• Remove Acknowledgements: Delete by pattern or individual removal

Configuration Management ✅

• Folders: Create/delete monitoring folder structures

• Rules: Create rules for 2000+ CheckMK ruleset types with proper format handling

• Time Periods: Create custom notification schedules (business hours, 24/7, etc.)

• Host Groups: Organize hosts into logical groups

User & Security ✅

• User Accounts: Create/manage user accounts with role assignment

• Password Management: Set passwords with policy enforcement

• Contact Groups: Manage notification groups

• Host/Service Tags: Comprehensive tagging system

🚀 Quick Start

1. git clone https://github.com/SirTificate/vibemk-mcp.git
2. Edit the configuration file of your LLM Client, e.g. Claude Desktop - claude_desktop_config.json (See examples)
3. Start your LLM Client
4. CheckMK automation user setup (Administrator permissions or a customized role if changes are to be made, read-only if only analyses are to be performed.)
5. voila - configure checkmk using natural language

Complete Installation Guide: See INSTALL.md for detailed step-by-step instructions. More Examples: See examples/llm_configs/ and INSTALL.md
Visual Examples: See examples/Screenshots/ for example prompts and usage patterns

💡 Practical Prompt Examples

# Add new server
"Create a new host 'web-server-05' in folder 'Servers' with IP 192.168.1.105 and discover all services"

# Schedule maintenance
"Schedule a 2-hour downtime for the service Check_MK on 'cephnode01' starting at 22:00 tomorrow for 'Debian Updates'"

# Downtimes 
"show me all current scheduled downtimes."

# Metric analysis
"Compare the “response_time” metric of the “HTTPS Webservice” service of the two hosts www.google.de and www.heise.de for the last ten minutes."

# Ruleset analysis
"analyze and compare the rulesets "Filesystems (used space and growth)" and see, if there are duplicates or if rules can be combined."

Advanced Usage: See examples/ExamplePrompts.md for complex scenarios and tips

📚 Checkmk version compatibility

The REST API is served at version 1.0 up to and including CheckMK 2.4. CheckMK 2.5 introduces a versioned v1 path that is compatible with 1.0; support for it is not implemented yet.

🔍 How this is verified

A test suite that mocks the HTTP client cannot tell whether an endpoint exists — a call to a path CheckMK does not serve looks exactly like one that works. Seven calls in this codebase turned out to have nothing behind them, and no test had ever noticed.

Every endpoint call is now checked against the OpenAPI document the site publishes for itself:

{server_url}/check_mk/api/1.0/openapi-doc.yaml

That document carries the exact version and edition, so it cannot describe an endpoint a given site does not have. The converse does not hold: a Raw site's document cannot show what only the commercial editions serve, and an endpoint missing from it looks exactly like one that exists nowhere. Two calls go to such endpoints (see the edition section below); the script lists them separately instead of failing. The other 151 match a path and a verb that 2.4.0p36 Raw serves.

You can check this against your own site, which is the point — your version and edition are not necessarily mine:

python scripts/verify_endpoints.py          # reads the document from the site in your .env
python scripts/verify_endpoints.py --spec downloaded.yaml

It exits non-zero when a call has no matching path and verb, so it works as a pre-push check. The one dependency is PyYAML.

vibemk_reschedule_check was removed rather than left to fail quietly: CheckMK's REST API offers no equivalent. 0.5.0 removed vibemk_get_custom_graph and vibemk_search_metrics with it on the same reasoning, which was wrong for those two — their endpoints exist in the commercial editions. Both are back. 116 tools.

There is also a read-only smoke test against a live instance, behind LIVE_SMOKE_TEST=true and deliberately kept out of CI:

LIVE_SMOKE_TEST=true python -m pytest tests/test_live_smoke.py -v

Checkmk Edition Support

Every tool but two uses REST API endpoints that CheckMK registers for all editions, including Raw (CRE). The exceptions are vibemk_get_custom_graph and vibemk_search_metrics: they call metric/actions/get_custom_graph and metric/actions/filter, which only the commercial editions serve. On a Raw site both answer 404, and both say so in their description and in their answer.

Comparing the API documents of a Raw and an Ultimate 2.5.0p14 site, which the upstream maintainer did in chexma/vibeMK#6, finds 21 paths only the commercial edition serves: the Agent Bakery, DCD, licensing, SAML, SLA, and the two metric actions above. The Agent Bakery is not implemented here, and on a Raw site there is nothing to implement: the agent domain offers only actions/download, with no baking endpoint at all.

A correction to the original README, which is not a claim about this server: it listed Business Intelligence and the Event Console as Enterprise-only. That is wrong — CheckMK registers both for every edition, Raw included. Neither is implemented here (see below); the point is only that nothing would stop an implementation on Raw.

Not implemented

The REST API is larger than this server. Of 131 endpoints a 2.4.0p36 Raw site publishes, 59 are used. The notable gaps, in case you were expecting them:

• Business Intelligence — aggregations, packs and BI rules

• Event Console — listing, acknowledging and changing event state

• Site management — the site_connection endpoints

• Auxiliary tags, audit log, LDAP connections, broker connections, Quick setup

• Bulk delete for hosts, and modifying an existing downtime rather than deleting and recreating

Labels are not exposed as their own feature either. CheckMK has no label endpoint — labels are host attributes — so vibemk_update_host can set them, but no tool schema mentions them.

Security considerations

This lets a language model create and delete hosts, rules and users in your monitoring, and "activate changes" is a real button.

• Start with a read-only automation user. Widen the role later, once you have seen what the model actually does with it. A custom role scoped to what you need beats an Administrator account.

• Keep the log. Every tool call is recorded at INFO with its name — that log is the only record of what the model did. Arguments are deliberately not logged, since they carry host names, comment text and, for the password tools, secrets.

• Check the CheckMK audit log after the first few sessions. It sees the changes from the other side.

• Use at your own risk. No liability is accepted for actions performed by an AI.

To report a security issue, see SECURITY.md.

📄 License

This project is licensed under the GNU General Public License v3.0.

Happy Monitoring with CheckMK and LLMs! 🎉