Zabbix MCP Server
This Zabbix MCP server gives AI agents and CLI users task-shaped read access plus controlled, audited write access to Zabbix for incident triage, host diagnostics, metrics, alert-delivery troubleshooting, and maintenance changes.
List and inspect active problems, including suppressed problems and the maintenance window hiding them.
Investigate a host in one call: state, active problems, recent events, silent/unsupported items, and maintenance.
Get a short host health summary: availability, problems, data freshness, and maintenance.
Search hosts by name fragment, pattern, or host group.
Read latest item values and historical metrics with min/avg/max and human units.
Find monitored hosts Zabbix cannot poll, with recorded errors.
Explain why an alert did or did not arrive: suppression, delivery attempts, actions, media types, and recipient severity filters/active periods.
Resolve pasted notifications into event, host, and trigger identifiers.
List maintenance windows, including expired ones.
Describe changes without applying them and check existing plan status.
Apply permitted changes with audit logging: acknowledge events, manage maintenance windows, enable/disable triggers, and call allowed API methods.
Call raw Zabbix API read methods directly; write methods go through planning/approval or are refused.
Control write ability with
allow_write, profile scopes, and the risk registry; writes are audited.Use it as a CLI or MCP server; it never contacts a language model and returns a stable JSON contract with warnings and truncation metadata.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Zabbix MCP ServerWhat problems are currently active?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Zabbix AI CLI MCP — Zabbix MCP server and CLI for AI agents
zabbix-ai-cli-mcp is a Zabbix MCP server and command-line client in one Go
binary. It gives Claude Code, Claude Desktop, Codex, Cursor and any other
Model Context Protocol client task-shaped access to Zabbix — what is broken
right now, why a host is silent, why an alert never arrived — with bounded
output, a stable JSON contract, and one setting, allow_write, that decides
whether the agent applies a change or a person approves a plan.
It is for the people who get paged: SRE and DevOps teams running Zabbix who want an agent to triage an incident without handing it the whole API.
Requires Zabbix 6.4 or newer. Bearer-token authentication arrived in 6.4 and is the only scheme implemented; earlier versions expect the token in the request body instead.
It never contacts a language model. The AI decides, this program executes, Zabbix monitors.
zabbix-ai-cli-mcp login
zabbix-ai-cli-mcp problems list
zabbix-ai-cli-mcp host investigate server01
zabbix-ai-cli-mcp alert why 757474
zabbix-ai-cli-mcp mcpWhy not another Zabbix API wrapper
Wrapping host.get, problem.get and history.get hands the agent the API's
sharp edges along with its power. On a current Zabbix 7.4 server:
problem.gethas noselectHosts, so a problem list arrives without hosts.history.getdefaults to the numeric-unsigned table and returns nothing for a float item — silently, with no error.item.lastvalueanditem.lastclockstill exist and have returned a constant"0"for several major releases.host.availablewas removed in 5.4; availability lives on the interface.event.acknowledgetakes a bitmask whose own documentation contradicts itself.searchWildcardsEnabled: truedisables implicit substring matching, turning a name fragment into an exact match that quietly finds nothing.
Every one of those produces a confident, wrong answer rather than an error. This tool absorbs them behind commands that describe the task instead of the endpoint.
Related MCP server: Zabbix MCP Server
What it does
Command | Answers |
| What is broken now — including suppressed problems, with the maintenance window that hides them named |
| One call: host state, active problems, recent events, silent and unsupported items, maintenance |
| A handful of fields instead of twelve thousand characters of configuration |
| Why a notification did or did not arrive — suppression, delivery attempts, actions, media types, per-recipient severity filters |
| Turns a notification pasted out of chat into event, host and trigger identifiers |
| Monitored hosts Zabbix cannot poll, with the error it recorded |
| Values with the right history type, human units and |
| Open, extend, end or remove windows, with host patterns like |
| Restore or stop alert delivery by changing only a media type's status |
| Adjust lost LLD resource disable/delete policy with an impact plan |
| The escape hatch, under the same rules |
Safety
Read operations always run immediately. Whether anything else does is one
setting, allow_write, and it is on by default.
# ~/.config/zabbix-ai-cli-mcp/config.toml
allow_write = true # the default; omit the key and you get this
[profiles.prod]
url = "https://zabbix.example.com"
allow_write = false # this one profile is an exceptionIf you are not sure, set allow_write = false. It costs one command per
change and it is the right default for an installation you cannot afford to
have an agent surprise you in. A profile override beats the file-wide setting,
and ZABBIX_AI_CLI_MCP_ALLOW_WRITE beats both — that is how a container is
told, without owning the config file.
Caller |
|
|
CLI, a person at a terminal |
| plan, then |
MCP, an agent |
| plan, then |
With writes off, no tool and no flag applies anything: a change is described,
and a person runs zabbix-ai-cli-mcp approve <plan-id> in their own terminal.
A confirmation an agent could send would be a confirmation prompt injection
could send, so none is offered — the approval lives outside the model's context.
With writes on, the agent applies the change itself and every change lands in
an audit log with the profile, the parameters, the objects touched and whether
a person or a model asked for it. zabbix-ai-cli-mcp mcp --read-only refuses
both paths regardless of the setting, and an HTTP endpoint that can write
refuses to start without a bearer token.
Everything else holds either way: a profile's scopes still bound what it may
touch, the risk registry still refuses methods that hand out credentials or run
code, and a plan is still re-checked against live Zabbix before it executes.
$ zabbix-ai-cli-mcp maintenance create "ms*" --for 2h
PLAN pl_cc89d2e87d15
Create maintenance "ms* (2h0m)" for 2h0m, 2026-08-21T05:39:00Z to 2026-08-21T07:39:00Z
Affects:
host ms1.8qw.ru
host ms10.8qw.ru
...
Risk: write
Expires: 2026-08-21T05:54:22Z
Nothing has changed yet.
To apply it: zabbix-ai-cli-mcp approve pl_cc89d2e87d15Media channel state and lost LLD resource policies also use this approval/audit path. Media state requests are idempotent for external cron use; LLD plans show host scope and lost-item counts and flag history deletion as destructive. See parameters and examples.
Before a plan runs, its parameters are re-hashed, its deadline checked and its preconditions re-read from Zabbix. A window that has been replaced since the plan was made is refused, not deleted. Every applied change is appended to an audit log.
This matters more than a refusal would. When the tool this replaces blocked a write, the work was done anyway with a token copied out of a container — losing the audit trail without preventing anything. A permitted path that is recorded beats a refusal that gets routed around.
Install
On Linux or macOS, paste this into a terminal. It fetches the latest release,
checks it against checksums.txt, puts the binary in ~/.local/bin and starts
the MCP server over stdio. Replace the two placeholders first:
VERSION=$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
https://github.com/stufently/zabbix-ai-cli-mcp/releases/latest | sed 's|.*/v||')
OS=$(uname -s | tr '[:upper:]' '[:lower:]') # linux | darwin
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') # amd64 | arm64
ARCHIVE=zabbix-ai-cli-mcp_${VERSION}_${OS}_${ARCH}.tar.gz
BASE=https://github.com/stufently/zabbix-ai-cli-mcp/releases/download/v${VERSION}
TMP=$(mktemp -d) && cd "$TMP"
curl -fsSLO "$BASE/$ARCHIVE" && curl -fsSLO "$BASE/checksums.txt"
grep " $ARCHIVE\$" checksums.txt | shasum -a 256 -c - # sha256sum -c - works too
tar -xzf "$ARCHIVE"
mkdir -p ~/.local/bin && install -m 0755 zabbix-ai-cli-mcp ~/.local/bin/
~/.local/bin/zabbix-ai-cli-mcp --version
ZABBIX_AI_CLI_MCP_URL=https://zabbix.example.com ZABBIX_AI_CLI_MCP_TOKEN=your-api-token ~/.local/bin/zabbix-ai-cli-mcp mcpThe last line is the command every client block below runs: zabbix-ai-cli-mcp
with arguments ["mcp"], the Zabbix URL and API token taken from the
environment. Stop it with Ctrl-C once it starts; the client launches it from
then on. ~/.local/bin has to be on PATH, because the client configurations
call the binary by name; otherwise give them the absolute path.
Prebuilt binary (no Go needed)
Each tagged release publishes archives for Linux, macOS and Windows on amd64
and arm64, plus checksums.txt. The block at the top of this section installs
one on Linux or macOS. The archive also carries docs/ and the agent skills.
On Windows (PowerShell), the archive is a zip:
$Version = (Invoke-RestMethod https://api.github.com/repos/stufently/zabbix-ai-cli-mcp/releases/latest).tag_name.TrimStart('v')
$Arch = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'amd64' }
$Zip = "zabbix-ai-cli-mcp_${Version}_windows_${Arch}.zip"
$Base = "https://github.com/stufently/zabbix-ai-cli-mcp/releases/download/v$Version"
Invoke-WebRequest "$Base/$Zip" -OutFile $Zip
Invoke-WebRequest "$Base/checksums.txt" -OutFile checksums.txt
$Want = ((Select-String -Path checksums.txt -Pattern " $Zip$").Line -split '\s+')[0]
if ((Get-FileHash $Zip -Algorithm SHA256).Hash -ne $Want) { throw "checksum mismatch" }
Expand-Archive $Zip -DestinationPath "$env:LOCALAPPDATA\zabbix-ai-cli-mcp" -Force
& "$env:LOCALAPPDATA\zabbix-ai-cli-mcp\zabbix-ai-cli-mcp.exe" --versionAdd %LOCALAPPDATA%\zabbix-ai-cli-mcp to PATH, or use the full path to
zabbix-ai-cli-mcp.exe in the client configuration.
From source
For a host-native build, use Go 1.25 or newer:
go install github.com/stufently/zabbix-ai-cli-mcp/cmd/zabbix-ai-cli-mcp@latest
# Or build the current checkout.
mkdir -p bin
go build -trimpath -o bin/zabbix-ai-cli-mcp ./cmd/zabbix-ai-cli-mcpThe Make targets are container-first and do not require Go on the host:
make build # Linux binary in ./bin, built inside Docker
make docker # Linux container image for the MCP serverCheck where a release came from
checksums.txt proves a download is intact, not who built it: whoever could
replace an archive could replace the checksum file next to it. From the first
release cut after this section was added, the release workflow also signs build
provenance for every archive, every .mcpb bundle and the container image
(Sigstore, through GitHub artifact attestations). With the GitHub CLI:
verify() {
gh attestation verify "$1" --repo stufently/zabbix-ai-cli-mcp \
--source-ref "refs/tags/v$VERSION" \
--signer-workflow stufently/zabbix-ai-cli-mcp/.github/workflows/release.yml \
--deny-self-hosted-runners
}
verify "$ARCHIVE"
verify "zabbix-ai-cli-mcp-${VERSION}-linux-amd64.mcpb"
verify "oci://ghcr.io/stufently/zabbix-ai-cli-mcp:$VERSION"A pass means the file was built by this repository's release workflow, on a
GitHub-hosted runner, from the tag v$VERSION: an attested file from another
release, renamed, fails --source-ref. Releases up to and including 0.4.3
carry checksums only.
Configure
zabbix-ai-cli-mcp login --profile prodIt asks for the URL and the API token, verifies the token against the server, and stores it. The token is never accepted as a flag, because flag values are visible in shell history and in the process list; pipe it in instead:
printf %s "$TOKEN" | zabbix-ai-cli-mcp login --profile prod --url https://zabbix.example.com --token-stdinA profile that names no scopes may do anything the write setting allows. Naming any scope narrows it to exactly those:
zabbix-ai-cli-mcp profile scopes prod --add maintenance
zabbix-ai-cli-mcp profile show prod # what it may do, writes includedSee docs/authentication.md for the resolution order and the headless and container cases.
Add the Zabbix MCP server to your AI client
Each block below runs zabbix-ai-cli-mcp with arguments ["mcp"], the same
command as the install line above. The URL and the API token are placeholders
in env: replace them, and do not commit a real token. If you would rather
keep the token out of the client, run zabbix-ai-cli-mcp login and pass
--profile plus the profile name in args instead of those two variables.
Claude Code
Project file .mcp.json, at the root of the project:
{
"mcpServers": {
"zabbix": {
"command": "zabbix-ai-cli-mcp",
"args": ["mcp"],
"env": {
"ZABBIX_AI_CLI_MCP_URL": "https://zabbix.example.com",
"ZABBIX_AI_CLI_MCP_TOKEN": "your-api-token"
}
}
}
}The same server can be registered from a terminal. Set the two variables in
the environment that launches Claude Code, or rely on the .mcp.json above:
claude mcp add zabbix -- zabbix-ai-cli-mcp mcp
zabbix-ai-cli-mcp skills install claudeClaude Desktop
claude_desktop_config.json — macOS ~/Library/Application Support/Claude/claude_desktop_config.json,
Windows %APPDATA%\Claude\claude_desktop_config.json, Linux ~/.config/Claude/claude_desktop_config.json:
{
"mcpServers": {
"zabbix": {
"command": "zabbix-ai-cli-mcp",
"args": ["mcp"],
"env": {
"ZABBIX_AI_CLI_MCP_URL": "https://zabbix.example.com",
"ZABBIX_AI_CLI_MCP_TOKEN": "your-api-token"
}
}
}
}Claude Desktop can also install this server in one click. Download the .mcpb
for your operating system from
https://github.com/stufently/zabbix-ai-cli-mcp/releases/latest
and open it. Desktop asks for the Zabbix URL, the API token, and whether
writes are allowed (off by default in the Desktop extension). See docs/mcp.md.
The same release publishes checksums.txt with the SHA256 of every .mcpb.
Download that file into the same directory as the bundle and check it before
opening the bundle:
sha256sum -c --ignore-missing checksums.txt # run next to the downloaded .mcpbOn macOS, filter the bundle's line and check it with shasum -a 256 -c -.
Cursor
The button runs zabbix-ai-cli-mcp from your PATH (see Install); after installing, put your URL and token in place of the placeholders in ~/.cursor/mcp.json. Or add the block below by hand.
~/.cursor/mcp.json, or .cursor/mcp.json in the project:
{
"mcpServers": {
"zabbix": {
"command": "zabbix-ai-cli-mcp",
"args": ["mcp"],
"env": {
"ZABBIX_AI_CLI_MCP_URL": "https://zabbix.example.com",
"ZABBIX_AI_CLI_MCP_TOKEN": "your-api-token"
}
}
}
}Windsurf
mcp_config.json. On macOS and Linux that is ~/.config/devin/mcp_config.json
(or $XDG_CONFIG_HOME/devin/mcp_config.json). On Windows it is
%APPDATA%\devin\mcp_config.json. Older builds used
~/.codeium/windsurf/mcp_config.json.
{
"mcpServers": {
"zabbix": {
"command": "zabbix-ai-cli-mcp",
"args": ["mcp"],
"env": {
"ZABBIX_AI_CLI_MCP_URL": "https://zabbix.example.com",
"ZABBIX_AI_CLI_MCP_TOKEN": "your-api-token"
}
}
}
}Zed
Zed calls MCP servers context servers. The file is settings.json
(zed: open settings file):
{
"context_servers": {
"zabbix": {
"command": "zabbix-ai-cli-mcp",
"args": ["mcp"],
"env": {
"ZABBIX_AI_CLI_MCP_URL": "https://zabbix.example.com",
"ZABBIX_AI_CLI_MCP_TOKEN": "your-api-token"
}
}
}
}The same entry can be made from Settings → AI → MCP Servers → Add Server → Add Local Server; the indicator next to the server's name there shows whether it started.
Codex
# ~/.codex/config.toml
[mcp_servers.zabbix]
command = "zabbix-ai-cli-mcp"
args = ["mcp", "--profile", "prod"]zabbix-ai-cli-mcp skills install codexVS Code
Any other stdio client takes the same command zabbix-ai-cli-mcp and arguments
["mcp"], plus the URL and token in the environment. For a client that wants
HTTP instead:
zabbix-ai-cli-mcp mcp --http 127.0.0.1:8000 --bearer-token "$MCP_TOKEN"A server that can write refuses to start on HTTP without a bearer token, even on
loopback: without one, every process on the machine could change Zabbix through
it. It refuses a routable address unless you pass --allow-remote together with a
bearer token, because an unauthenticated MCP endpoint is an unauthenticated
route into Zabbix. See docs/mcp.md.
Docker
docker run --rm -i \
-e ZABBIX_AI_CLI_MCP_URL=https://zabbix.example.com \
-e ZABBIX_AI_CLI_MCP_TOKEN_FILE=/run/secrets/zabbix \
-v /path/to/token:/run/secrets/zabbix:ro \
ghcr.io/stufently/zabbix-ai-cli-mcp:latest mcpMCP tools
Fifteen tools, not two hundred. A large tool surface costs an agent context before it has done anything, and most of it is never called.
zabbix_problems zabbix_metrics_latest zabbix_unreachable
zabbix_problem zabbix_metrics_history zabbix_maintenance_list
zabbix_hosts zabbix_alert_why zabbix_api_call
zabbix_host_status zabbix_resolve zabbix_plan_create
zabbix_host_investigate zabbix_plan_status
zabbix_writeWrite operations do not get one tool each. zabbix_write and
zabbix_plan_create take an operation enum generated from the same registry
the CLI is built from, so the tool surface does not grow as operations are
added. zabbix_write is offered only where allow_write permits it.
Example prompts
Why did the disk alert on web01 never arrive?
What is broken in Zabbix right now?
Which monitored hosts has Zabbix been unable to poll?
How did CPU on db01 look over the last day?
JSON contract
{
"ok": true,
"data": {},
"warnings": [],
"meta": {
"returned": 50,
"total": 381,
"truncated": true,
"truncated_reason": "row_limit",
"partial": false,
"zabbix_version": "7.4.10"
}
}Errors carry a stable code, whether retrying is worthwhile, and what to do next:
{
"ok": false,
"error": {
"code": "AUTHENTICATION_FAILED",
"message": "Zabbix rejected the configured API token",
"retryable": false,
"suggestion": "run 'zabbix-ai-cli-mcp login' to configure a new token"
}
}zabbix-ai-cli-mcp schema prints every operation, its parameters and its JSON Schema,
so an agent can learn the tool programmatically instead of guessing at flags.
Full details in docs/json-output.md.
Documentation
FAQ
What is a Zabbix MCP server?
An MCP server is a small program that exposes a system to an AI client over the
Model Context Protocol. A Zabbix MCP server lets Claude, Codex, Cursor and
similar clients query Zabbix — problems, hosts, items, events, maintenance — as
tools, instead of the model guessing at curl calls against the JSON-RPC API.
Can an AI agent change my Zabbix through this?
That is yours to decide, and the setting is allow_write. Left alone it is on,
and an agent can open a maintenance window or acknowledge an event itself —
every change audited, and bounded by the profile's scopes and the risk
registry.
Set allow_write = false and it cannot. A write then produces a plan and
stops; applying it is a command you run in your own terminal,
zabbix-ai-cli-mcp approve <plan-id>. No MCP parameter applies anything in
that mode, and a test fails the build if one is ever added.
Does it send my monitoring data to an AI provider?
No. This program never contacts a language model. It talks to Zabbix and prints JSON. Whatever your MCP client does with that output is between you and your client.
Which Zabbix versions are supported?
Zabbix 6.4 and newer, because bearer-token authentication arrived in 6.4. Developed and tested against Zabbix 7.4.
Do I need Go installed?
No. make build compiles inside Docker and needs nothing on the host but
Docker itself. go install is there for a host-native binary, and each tagged
release publishes archives for Linux, macOS and Windows with checksums, along with a
container image on ghcr.io.
How is this different from an MCP server that wraps the Zabbix API?
A thin wrapper hands the agent the API's sharp edges: problem.get without
hosts, history.get silently returning nothing for float items, lastvalue
frozen at "0". Those produce confident wrong answers rather than errors. This
tool answers questions — "what is broken", "why did this alert not arrive" — and
absorbs the traps behind them. It also ships fifteen tools rather than two
hundred, because a large tool surface spends an agent's context before it does
any work.
Can I still call the raw Zabbix API?
Yes, through api call, under the same rules as everything else. Methods that hand out
credentials or execute code are refused outright — including the long way round,
such as creating a script and having an action run it.
Does it work without an AI client at all?
Yes. It is a normal CLI with human-readable tables, JSON output and documented exit codes, so it is equally usable from a shell or a CI job.
Tested clients and platforms
Only what has actually been run is listed. The client blocks above for Claude Desktop, Cursor, Windsurf, Zed and VS Code follow each client's documented MCP configuration and have not been exercised by the maintainer; reports are welcome.
Client | OS | How the server runs | Checked |
Claude Code 2.1 | Ubuntu 26.04, x86_64 |
| In daily use since 0.1.0 against Zabbix 7.4.10; |
Codex CLI 0.162 | Ubuntu 26.04, x86_64 | binary built with | In daily use since 0.3.0 against the same Zabbix; |
none (CI) | Ubuntu (GitHub-hosted), x86_64 | unit and race tests, container image start-up | Every pull request |
none (CI) | macOS amd64 and arm64, Windows amd64, Linux arm64 | cross-compiled only, never executed | Every pull request |
Compatibility
Zabbix 6.4 and newer. Bearer-token authentication arrived in 6.4 and is the only scheme implemented. Version-dependent behaviour is asserted explicitly, so an incompatibility is reported rather than returning an empty result.
Developed and tested against Zabbix 7.4.
License
Apache-2.0. See LICENSE.
Zabbix is a trademark of Zabbix LLC. This project is an independent open-source project and is not affiliated with or endorsed by Zabbix LLC.
Available Tools
15 toolszabbix_alert_whyARead-onlyIdempotent
Explain whether an event produced a notification, and what stood in the way.
Walks the whole chain: suppression, delivery attempts and their errors, trigger actions, media types, and each recipient's media severity filter and active period. Any one of those links can drop a notification without recording an error anywhere.
Use when the user asks why an alert did or did not arrive, or why a notification was missing. For the problem itself call zabbix_problem; to turn a pasted notification into identifiers call zabbix_resolve first.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | event identifier |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is covered. The description adds real context beyond that: it explains this is a diagnostic walk of the full notification chain and warns that any single link can silently drop a notification without recording an error, which sets expectations about why the answer may be inconclusive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with a one-line purpose, then the investigative scope, then routing guidance. Every sentence carries distinct information — none of it restates the name or the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description has to carry some of that burden, and it does by listing the chain elements it inspects, which implies the structure of the answer. It stops short of describing the response shape or what an inconclusive result looks like, leaving a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, 'event', with 100% schema description coverage including an example value. The description adds no syntax, format, or identifier-source detail beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — explaining whether an event produced a notification and what blocked it — and then enumerates the exact chain it walks (suppression, delivery attempts, trigger actions, media types, per-recipient filters). It explicitly differentiates itself from siblings by naming zabbix_problem for the underlying issue and zabbix_resolve for identifier extraction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger condition: 'Use when the user asks why an alert did or did not arrive, or why a notification was missing.' It also states when NOT to use it, routing to zabbix_problem for the problem itself and zabbix_resolve to convert a pasted notification into identifiers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_api_callARead-onlyIdempotent
Call a Zabbix API method directly.
Read methods run immediately. Write methods produce a plan and go through approval like every other change. A method that is not in the risk registry is refused rather than guessed at. Over MCP this tool is read-only.
Use when no high-level tool covers the question and a read method such as host.get is required. For problems, hosts, metrics or alert delivery call the matching zabbix tool instead. A write through this tool is refused; to make one, call zabbix_write, or zabbix_plan_create to show the operator the change first.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | API method, for example host.get | |
| params | No | method parameters as JSON |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/destructiveHint, so the safety profile is covered; the description still adds real value by disclosing the risk-registry refusal for unknown methods, the approval flow for writes, and the MCP read-only surface. Minor ambiguity remains between 'write methods produce a plan' and 'a write through this tool is refused', and it never says what the raw response looks like or whether it is paginated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded and logically ordered: what it does, how reads vs writes behave, then routing. Slight redundancy — the write refusal is stated twice ('go through approval', 'Over MCP this tool is read-only', 'A write through this tool is refused') — but each restatement disambiguates a genuinely confusing surface.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should ideally describe the return shape (raw Zabbix JSON), which it omits. It is otherwise complete for the routing decision an agent must make, covering read immediacy, write refusal, unknown-method refusal, and sibling alternatives.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with only 2 params, so the schema already documents 'method' and 'params as JSON'. The description contributes only an inline example (host.get) and no format, pagination, or limits guidance beyond the schema — baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Call a Zabbix API method directly') and positions itself precisely as the raw escape hatch against a list of high-level siblings. An agent can distinguish it from zabbix_problems, zabbix_metrics_latest, etc. without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: 'Use when no high-level tool covers the question and a read method such as host.get is required', with a named fallback for problems/hosts/metrics/alert delivery and a redirect to zabbix_write or zabbix_plan_create for writes. When-to-use, when-not-to-use, and alternatives are all stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_host_investigateARead-onlyIdempotent
Collect a diagnostic snapshot of one host in a single call.
Gathers host state, active problems, recent events, silent and unsupported items and maintenance windows. It reports facts and draws no conclusions; interpreting them is the caller's job.
Use when the user asks what is wrong with a named host or wants one diagnostic pass instead of several queries. For a short status line call zabbix_host_status; for hosts Zabbix cannot poll at all call zabbix_unreachable.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | host name, fragment or identifier |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, openWorld and non-destructive, so safety is covered. The description adds real behavioral context beyond that: the exact scope of collected data and the explicit contract that it 'reports facts and draws no conclusions; interpreting them is the caller's job,' which sets output expectations. It does not, however, mention result size, timeouts, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the core purpose, then scope, then routing. The 'draws no conclusions' clause is not filler — it changes how the caller should treat the response.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of describing return content, and it does so by enumerating the five data categories the snapshot includes. Combined with the explicit routing guidance and annotations covering the safety profile, an agent has everything needed to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is only one parameter, so the schema fully documents 'host' (name, fragment or identifier). The description never elaborates on the parameter or on how a fragment matches multiple hosts, so it adds nothing beyond the schema — baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Collect') and resource ('diagnostic snapshot of one host'), then enumerates exactly what is gathered: host state, active problems, recent events, silent/unsupported items, maintenance windows. This is clearly distinguishable from siblings like zabbix_host_status and zabbix_unreachable, which it names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('what is wrong with a named host' or 'one diagnostic pass instead of several queries') and names two alternatives with the conditions that select them: zabbix_host_status for a short status line, zabbix_unreachable for hosts Zabbix cannot poll. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_hostsARead-onlyIdempotent
Find hosts by name fragment, pattern or group.
Matching is a case-insensitive substring over both the technical and the visible name, and exact matches are listed first. Guessing exact names is the most common way a query comes back empty.
Use when the user is looking for a host and does not have its exact name, or wants the hosts in a group. For a short health check of one host call zabbix_host_status; for a full diagnostic snapshot call zabbix_host_investigate.
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | limit to a host group | |
| limit | No | maximum rows to return, 1 to 500 (default 50); the result reports whether it was truncated | |
| search | No | name fragment; * is allowed | |
| monitored | No | exclude hosts whose monitoring is disabled |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), so the bar is lower. The description adds real behavioral context the annotations cannot: matching is a case-insensitive substring over both technical and visible name, exact matches rank first, and name-guessing is the common cause of empty results. It does not cover truncation/pagination behavior itself, leaving that to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short paragraphs, zero filler, with the core purpose front-loaded, matching semantics second, and routing last. Each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description covers purpose, usage boundaries, alternatives, and match semantics, and the truncation-reporting behavior is carried by the limit parameter's schema text. For a 4-param read tool this is nearly complete; only an explicit note on return shape or default result ordering when no search is given is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: how the search string is interpreted (case-insensitive substring across both name fields) and result ordering. It adds no detail on group, limit, or monitored beyond the schema, so it is a modest improvement over baseline rather than a full one.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb (Find) and resource (hosts) plus the matching modes (name fragment, pattern, group). It is immediately distinguishable from siblings like zabbix_host_status and zabbix_host_investigate, which the description explicitly routes to.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states exactly when to use the tool ('the user is looking for a host and does not have its exact name, or wants the hosts in a group') and names two alternatives with their selecting conditions: zabbix_host_status for a short health check of one host, zabbix_host_investigate for a full diagnostic snapshot.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_host_statusARead-onlyIdempotent
Summarise one host: availability, active problems, data freshness, maintenance.
An aggregate over several API calls, returned as a handful of fields rather than several thousand characters of configuration.
Use when the user wants a short health check of one named host: whether it is up, whether it has problems, whether data is fresh. For the full diagnostic bundle call zabbix_host_investigate; to search by a name fragment call zabbix_hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | host name, fragment or identifier |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds genuinely useful non-structured context: it is an aggregate over several API calls and deliberately returns a handful of fields rather than thousands of characters of configuration, which tells the agent to expect a compact, possibly lossy response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the purpose and scope, then the aggregation behavior, then the routing guidance. Every sentence earns its place with zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the description covers what is returned (the four summary areas), how it is produced (aggregated over several calls), and when to choose a sibling instead. Nothing an agent needs in order to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is only one parameter ('host', documented as name/fragment/identifier). The description reinforces the single-named-host scope but adds no format or syntax detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Summarise one host') and enumerates the exact scope of the summary: availability, active problems, data freshness, maintenance. It explicitly distinguishes itself from zabbix_host_investigate and zabbix_hosts, so an agent can pick it without opening sibling schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete selection condition ('when the user wants a short health check of one named host') and names both alternatives with the condition that selects each: zabbix_host_investigate for the full diagnostic bundle, zabbix_hosts for name-fragment search. No inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_maintenance_listARead-onlyIdempotent
List maintenance windows, including expired ones.
Expired windows are shown by default: removing one that has already lapsed is a routine follow-up, and it cannot be done if the window is invisible.
Use when the user asks which maintenance windows exist, which hosts are silenced, or whether a window has expired. To open, extend, end or remove a window, call zabbix_write, or zabbix_plan_create to show the operator the change first.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | only windows covering this host | |
| limit | No | maximum rows to return, 1 to 500 (default 50); the result reports whether it was truncated | |
| active | No | hide windows whose period has passed | |
| search | No | name fragment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, so the safety profile is covered. The description adds genuinely new behavioral context the annotations do not: expired windows are returned by default and the rationale for that default, which explains why the result set may be larger than expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first sentence, with the default-behavior justification and routing guidance following in a logical order. The explanation of why expired windows are visible is slightly more verbose than needed, but it earns its place by pre-empting a likely agent surprise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covered: purpose, filter semantics, default behavior, and sibling routing, which is sufficient for a read-only list tool with no output schema. It does not describe the truncated-result indicator mentioned in the `limit` schema, a minor omission rather than a blocker.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all four parameters are already documented in the schema, which sets the baseline at 3. The description's note that expired windows are shown by default complements the `active` parameter's semantics but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource ('List maintenance windows') plus a scope qualifier ('including expired ones'). It is immediately distinguishable from mutating siblings like zabbix_write and zabbix_resolve.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit trigger conditions ('which maintenance windows exist, which hosts are silenced, or whether a window has expired') and explicitly routes mutations to zabbix_write or zabbix_plan_create. Both the when-to-use and when-not-to-use cases are covered with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_metrics_historyARead-onlyIdempotent
Read an item's values over a time window, with min, max and average.
Windows are written the way operators write them: 30m, 2h, 24h, 7d.
Use when the user asks how a metric behaved over a period, or wants its minimum, average and maximum. For only the newest value call zabbix_metrics_latest; for whether the host itself is unreachable call zabbix_unreachable.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | host name or fragment | |
| last | No | how far back to read | 1h |
| items | No | maximum distinct items to read, 1 to 10 | |
| limit | No | maximum rows to return, 1 to 500 (default 200); the result reports whether it was truncated | |
| search | No | item name or key fragment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds value the annotations don't: the window-syntax convention operators use and the aggregation semantics (min/max/average) of the returned data. It omits mention of truncation, though the schema's limit description covers that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then syntax convention, then usage routing. No filler and nothing that fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of describing returns, and it does: min, max and average over the window. Combined with annotations covering safety and the schema covering all params, nothing an agent needs to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, and every parameter including defaults, bounds and examples is already documented. The description goes slightly beyond by framing the 'last' window in operator-friendly terms (30m, 2h, 24h, 7d), reinforcing how to write the value rather than just the regex.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read an item's values over a time window') plus the aggregation produced (min, max, average). It explicitly differentiates from the two nearest siblings, so an agent can distinguish it without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-to-use condition ('user asks how a metric behaved over a period, or wants min/avg/max') and names both alternatives with their selecting conditions: zabbix_metrics_latest for the newest value only, zabbix_unreachable for host reachability. Routing is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_metrics_latestARead-onlyIdempotent
Show the newest value of a host's items.
Values come from history, because item.lastvalue has returned a constant zero for several releases. The history type is derived from each item automatically; querying it wrongly returns nothing rather than an error.
Use when the user wants the current value of an item, such as CPU, disk or a custom metric, on one host. For values across a time window call zabbix_metrics_history; for a host whose items stopped sending data call zabbix_host_investigate.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | host name or fragment | |
| limit | No | maximum rows to return, 1 to 500 (default 25); the result reports whether it was truncated | |
| search | No | item name or key fragment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only, idempotent, non-destructive profile, so the bar is lower, yet the description still adds high-value behavior: values are read from history because item.lastvalue returns a constant zero, the history type is derived automatically, and a wrong query silently returns nothing rather than an error. That silent-failure warning is exactly the kind of trait an agent cannot get from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, then the critical history caveat, then routing. Three short paragraphs with no filler, though the middle paragraph is dense enough that it could be trimmed slightly for a tool with only three parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only metrics lookup with complete schema coverage and full safety annotations, the description covers purpose, caveats and routing alternatives. With no output schema, return details are rightly left to the schema's truncation note, so nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so host, limit and search are already fully documented including the 1-500 range, default of 25, and truncation reporting. The description adds only the general notion of a host-and-item lookup, which does not extend the schema, so baseline 3 is right.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Show the newest value of a host's items') and immediately scopes it to one host and one item set, which separates it from the history and investigate siblings. An agent can route correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the exact use case ('current value of an item, such as CPU, disk or a custom metric, on one host') and then gives two explicit alternatives with their selecting conditions: zabbix_metrics_history for a time window, zabbix_host_investigate for a host that stopped sending data. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_plan_createARead-only
Describe a change to Zabbix without making it. Use when the user wants to see what a change would do before anything is written. Call zabbix_write instead when the user wants the change applied now; call zabbix_plan_status to check a plan that already exists.
Returns a plan identifier and the exact command the operator must run to apply it. Nothing changes until it is applied. Use this to show the operator what a change would do; call zabbix_write to make one, or relay the approve command so the operator applies this exact plan.
Available operations: api.call — Call a Zabbix API method directly. events.acknowledge — Acknowledge an event, comment on it, close it or change its severity. maintenance.create — Open a maintenance window over hosts or host groups. maintenance.delete — Remove a maintenance window permanently. maintenance.expire — End a maintenance window now, keeping its record. maintenance.extend — Push a maintenance window's end further out. triggers.disable — Disable a trigger so it stops raising problems. triggers.enable — Re-enable a disabled trigger.
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | parameters for the operation; call zabbix_plan_create with an unknown parameter to be told the accepted ones | |
| operation | Yes | the change to describe |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description is consistent with them by stating 'Nothing changes until it is applied.' It adds value beyond the annotations by disclosing the return shape ('a plan identifier and the exact command the operator must run to apply it') and the apply workflow. It stops short of describing rate limits or failure modes, so not a full 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and the key alternative, and the operation list earns its place. The second sentence re-states the zabbix_write routing already given in the first, which is mild redundancy but not bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly carries the return contract (plan identifier plus apply command) and the when/when-not guidance. Combined with 100% schema coverage and clear annotations, an agent has what it needs to call this correctly; only minor operational detail (error handling, plan expiry) is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented, and the operation list in the description mirrors the schema enum rather than adding new meaning. The schema itself notes an unusual discovery affordance (passing an unknown param to learn accepted ones), leaving the description little to contribute. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Describe a change to Zabbix without making it') and immediately differentiates from the two relevant siblings, zabbix_write and zabbix_plan_status. The operation enumeration further pins down scope, so an agent can identify this tool without opening its schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ('before anything is written'), when-to-use-something-else ('call zabbix_write instead when the user wants the change applied now'), and how to check an existing plan ('call zabbix_plan_status'). Routing to alternatives is spelled out rather than inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_plan_statusARead-onlyIdempotent
Check whether a stored plan is still waiting, was applied, or has expired. Use when the user asks what happened to a change they were asked to approve, or after zabbix_plan_create while you wait. Call zabbix_plan_create to describe a new change, and call zabbix_write when the user wants that change made now.
| Name | Required | Description | Default |
|---|---|---|---|
| plan_id | Yes | identifier returned by zabbix_plan_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so safety is covered. The description adds value beyond them by naming the possible result states (waiting/applied/expired), which tells the agent this is a non-blocking, pollable status check. It stops short of noting polling cadence or expiry semantics, keeping it at a 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the purpose and state enumeration before the routing advice. Every sentence carries routing or outcome information; only minor tightening is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully enumerates the domain of return values (waiting, applied, expired), which is the key missing piece an agent would otherwise have to guess. For a single-parameter read tool with strong annotations, this is essentially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single plan_id parameter is documented as the identifier returned by zabbix_plan_create. The description adds no format or syntax detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check) and resource (stored plan) and enumerates the three outcomes it distinguishes: waiting, applied, expired. It also names the sibling tools it must not be confused with (zabbix_plan_create, zabbix_write), so an agent can route correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use conditions: when the user asks what happened to a change they were asked to approve, or after zabbix_plan_create while waiting. It also contrasts the two alternatives by purpose (describe a change vs. make it now), which is exactly the routing information an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_problemARead-onlyIdempotent
Show one active problem by event identifier.
Use when the user gives one event identifier and wants that problem's host, severity and state. For the list of what is broken now call zabbix_problems; to learn why its notification did or did not arrive call zabbix_alert_why.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | event identifier |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, openWorld and non-destructive, so safety behavior is covered. The description adds value beyond them by disclosing which fields are returned (host, severity, state) and by scoping results to *active* problems, implying resolved events are not returned. It does not say what happens when the event id is unknown or refers to a non-problem event.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The core operation is front-loaded in the first line and the routing guidance follows immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by naming the returned fields, which is what an agent needs to decide whether to call it. It leaves the not-found / non-problem-event behavior unspecified, a minor gap for a single-param read tool whose annotations already carry the safety profile.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'event' parameter, so the schema already documents it with a type and an example. The description only restates it as 'event identifier' and adds no format, encoding, or lookup constraints beyond that. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Show), resource (one active problem) and scope (by event identifier), and explicitly contrasts with the sibling zabbix_problems which returns the list. An agent can distinguish it from every sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger condition ('the user gives one event identifier and wants that problem's host, severity and state') and names two alternatives with the condition that selects each: zabbix_problems for what is broken now, zabbix_alert_why for notification delivery questions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_problemsARead-onlyIdempotent
List active Zabbix problems, newest first.
Suppressed problems are included by default and say which maintenance window hides them. Hiding them silently is how an outage goes unnoticed for weeks.
Use when the user asks what is broken right now, which problems are firing, or whether anything is in alarm. For one event identifier call zabbix_problem; to learn why a notification never arrived call zabbix_alert_why.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | limit to one host; matching is fuzzy | |
| group | No | limit to a host group | |
| limit | No | maximum rows to return, 1 to 500 (default 50); the result reports whether it was truncated | |
| since | No | only problems that started within this window | |
| severity | No | minimum severity, as a name or 0-5 | |
| unacknowledged | No | only problems nobody has acknowledged | |
| exclude_suppressed | No | hide problems inside a maintenance window (they are shown by default) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so safety is covered. The description adds genuine behavioral context beyond that: suppressed problems are returned by default and annotate which maintenance window hides them, and truncation is reported. It stops short of describing return fields or pagination, but the default-suppression disclosure is exactly the kind of non-obvious behavior an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and ordering, then behavior, then routing. The rationale sentence ('Hiding them silently is how an outage goes unnoticed for weeks') is editorial but earns its place by justifying the default-include behavior; the only minor cost is a slightly chatty tone.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Seven parameters at full schema coverage, no output schema, and the description still covers the surprising default (suppressed included) and correct sibling routing. It omits any hint of what a returned problem record looks like and nothing about pagination beyond the schema's truncation note, but for a read-only list tool that is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all seven parameters already carry their own meaning. The description adds only an implicit tie to exclude_suppressed via the 'included by default' statement; it offers no extra format, matching, or severity-scale detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List active Zabbix problems') plus an ordering guarantee ('newest first') that no sibling provides. It also explicitly distinguishes itself from zabbix_problem (single event identifier) and zabbix_alert_why (missing notification), so an agent can route without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete invocation triggers ('what is broken right now', 'which problems are firing', 'whether anything is in alarm') and names two alternative tools with the conditions that select them. Both the when-to-use and the when-to-use-something-else cases are covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_resolveARead-onlyIdempotent
Turn the text of a notification into event, host and trigger identifiers.
Accepts a notification pasted out of a chat client. Without it, an instruction such as "acknowledge that one" cannot be acted on, because the identifiers only exist inside the message text.
Use when the user pastes a notification from chat and the event, host or trigger identifier is buried in that text. Once you have the event identifier, call zabbix_problem for the problem or zabbix_alert_why for the delivery chain.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | the pasted notification, or a bare event identifier |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so safety is covered. The description adds non-obvious context the annotations cannot: why the tool exists (identifiers only exist inside the message text, so 'acknowledge that one' is unactionable without it). It does not describe behavior on unparseable input or the shape of the extracted identifiers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short paragraphs: definition first, then the rationale for the tool's existence, then the usage condition and next steps. Front-loaded and every sentence carries distinct information; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only parser with no output schema, the description conveys the input contract, the reason for the tool, and the follow-on routing. The main remaining gap is that it never states what comes back when the text contains no identifiers, which matters since there is no output schema to consult.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the property description already covers the single parameter, so the baseline is 3. The description adds meaning by clarifying the tolerated input forms — a notification pasted out of a chat client, or a bare event identifier — which broadens the accepted value beyond a strict notification blob.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: turning notification text into event, host, and trigger identifiers. It also explains the distinguishing role versus siblings by naming zabbix_problem and zabbix_alert_why as the follow-on tools, so an agent can tell this is a parsing/normalization step, not a query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it (user pastes a notification from chat and the identifier is buried in the text) and names the downstream tools to call once the event identifier is extracted. No when-not guidance for malformed or non-notification input, which keeps it just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_unreachableARead-onlyIdempotent
List monitored hosts Zabbix currently cannot poll.
Availability lives on the interface: host.available was removed in 5.4, and code still reading it sees nothing at all.
Use when the user asks which hosts Zabbix cannot poll, or which agent, SNMP, IPMI or JMX interfaces are down. A host whose interface is up but whose items went silent is not listed here: call zabbix_host_investigate for that, and zabbix_metrics_latest for the newest values.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum rows to return, 1 to 500 (default 50); the result reports whether it was truncated |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive, open-world behavior, so the safety profile is covered. The description adds real value beyond that: availability is derived from the interface rather than host.available (removed in 5.4), and results exclude hosts with silent items. It does not describe the result shape or ordering, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose in one line, then usage, then exclusions. Each sentence is doing work, though the 'code still reading it sees nothing at all' remark is aimed more at maintainers than at the calling agent and is slightly surplus.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-filter list tool with no output schema, the description covers purpose, scope, the availability semantics, and sibling routing. It stops short of describing what each returned row contains (host, interface type, error), a minor gap given no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one optional parameter (limit) and schema description coverage is 100%, including the truncation-reporting behavior, so the schema carries the full burden. The description adds no parameter-level detail, which is the expected baseline here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a precise verb and resource ('List monitored hosts Zabbix currently cannot poll') and the scope is unambiguous. The third paragraph further distinguishes it from zabbix_host_investigate and zabbix_metrics_latest by naming the condition under which those siblings apply instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('which hosts Zabbix cannot poll, or which agent, SNMP, IPMI or JMX interfaces are down') and, critically, when not to ('a host whose interface is up but whose items went silent is not listed here'), routing that case to zabbix_host_investigate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
zabbix_writeADestructive
Change Zabbix in one call and record it in the audit log. Use when the user wants a permitted change applied now rather than only described. To show the operator the change before anything is written, call zabbix_plan_create instead; to check a plan that already exists, call zabbix_plan_status.
Prefer the narrowest operation that does the job and say plainly what you did. Operations marked destructive remove something Zabbix cannot restore on its own.
Available operations: api.call — Call a Zabbix API method directly. events.acknowledge — Acknowledge an event, comment on it, close it or change its severity. maintenance.create — Open a maintenance window over hosts or host groups. maintenance.delete — Remove a maintenance window permanently. (destructive) maintenance.expire — End a maintenance window now, keeping its record. maintenance.extend — Push a maintenance window's end further out. triggers.disable — Disable a trigger so it stops raising problems. (destructive) triggers.enable — Re-enable a disabled trigger.
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | parameters for the operation; call zabbix_write with an unknown parameter to be told the accepted ones | |
| operation | Yes | the change to make |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, openWorldHint=true and idempotentHint=false, so the safety envelope is partly covered; the description still adds real value by stating destructive operations remove something 'Zabbix cannot restore on its own', flagging which individual operations are destructive, and disclosing the audit-log side effect. It does not discuss idempotency/retry behavior, which is the remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded routing sentence, then the operation list where every line carries distinct information and destructive markers. It is long, but the length is justified by eight operations; only minor trimming (e.g. the closing 'say plainly what you did' aside) would be possible without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-operation write tool with no output schema, the description covers selection, alternatives, destructive semantics, and audit behavior. It does not describe what a successful call returns or how failures are reported, a minor omission given there is no output schema to fall back on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), but the description goes further by enumerating all eight operations with one-line semantics, so the agent knows what each enum value actually does. It also explains the freeform 'params' escape hatch from the schema description. Marginal but genuine value beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Change Zabbix in one call and record it in the audit log') and immediately separates itself from sibling tools by name (zabbix_plan_create, zabbix_plan_status). An agent can tell this is the write/execute path versus the plan/dry-run path without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('user wants a permitted change applied now rather than only described'), names the two alternatives with their own triggering conditions, and adds the routing heuristic 'prefer the narrowest operation that does the job'. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
15 tool updates
v0.4.5- First observed
zabbix_alert_why - First observed
zabbix_api_call - First observed
zabbix_host_investigate - First observed
zabbix_host_status - First observed
zabbix_hosts - First observed
zabbix_maintenance_list - First observed
zabbix_metrics_history - First observed
zabbix_metrics_latest - First observed
zabbix_plan_create - First observed
zabbix_plan_status - First observed
zabbix_problem - First observed
zabbix_problems - First observed
zabbix_resolve - First observed
zabbix_unreachable - First observed
zabbix_write
TDQS
Scored across 15 tools
Each tool targets a distinct resource/action, and descriptions explicitly cross-reference the alternatives (e.g. problem vs problems, host_status vs host_investigate, write vs plan_create vs api_call). The singular/plural and short/full-diagnostic distinctions are spelled out, leaving little room for misselection.
All tools consistently use a zabbix_ prefix with snake_case, which is predictable. However the internal ordering is mixed: some are bare nouns (problem, hosts, unreachable), some noun_noun (host_status, metrics_latest), and some verb or noun_verb (resolve, plan_create). Still readable and mostly uniform.
15 tools sits squarely in the well-scoped range, and each one covers a distinct slice of the monitoring domain (problems, hosts, metrics, maintenance, alerting, change planning). No obvious redundant or filler tools.
The read surface is comprehensive (problems, hosts, metrics history/latest, maintenance, unreachable, alert chain) and writes/plans are covered via zabbix_write and zabbix_plan_*, with zabbix_api_call as an escape hatch. Minor gaps like dedicated host configuration or user/dashboard management exist but are reachable through the raw API tool.
Maintenance
Related MCP Connectors
Context and control for any AI. Agent identity, scoped access, and proof across tools.
See, price, and control every tool call your AI agents make: policy checks, cost, and audit tools.
Connect, monitor, and control AI agents — tasks, approvals, schedules, and governance.
Persistent memory and knowledge management for AI agents with semantic search and 50+ tools.
Related MCP Servers
- AlicenseAqualityCmaintenance🔌 Complete MCP server for Zabbix integration - Connect AI assistants to Zabbix monitoring with 40+ tools for hosts, items, triggers, templates, problems, and more. Features read-only mode and comprehensive API coverage.3261GPL 3.0
- FlicenseNot gradedqualityDmaintenanceEnables users to monitor and query Zabbix infrastructure through natural language by providing access to current problems, active triggers, and system health status via the Zabbix API.-
- AlicenseBqualityAmaintenanceOfficial initMAX MCP server exposing the Zabbix API to AI assistants for monitoring and managing hosts, problems, templates, dashboards, and multiple Zabbix instances. Includes correlated monitoring views, graphs, anomaly detection, capacity forecasts, and PDF reports, with scoped tokens, read-only modes, OAuth 2.1, and an admin portal. Supports Streamable HTTP, SSE, and stdio.86245AGPL 3.0
- FlicenseNot gradedqualityCmaintenanceExposes Zabbix monitoring capabilities as callable tools for AI agents and MCP-compatible clients.-