Ceph AIops MCP server

<!-- mcp-name: io.github.AIops-tools/ceph-aiops -->

Ceph AIops

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by the Ceph project or any storage vendor. Product and trademark names belong to their owners. MIT licensed.

Governed AI-ops for Ceph — talks to a vanilla ceph-mgr Dashboard REST API (HTTPS :8443, username + password exchanged for a short-lived JWT at POST /api/auth) with a built-in governance harness: unified audit log, token/runaway budget guard, undo-token recording, and descriptive risk tiers. Works against stock ceph-mgr — cephadm, hypervisor-bundled Ceph, or MicroCeph — with no croit and no Kubernetes dependency. Self-contained: no external skill-family dependency.

What it does

The flagship analysis, plus the guarded reads and writes around it:

raw check codes (PGDEGRADED, OSDNEARFULL, SLOWOPS, MONDOWN, LARGEOMAPOBJECTS, …), it turns each active check into plain language: what it means, the likely cause, and the suggested next action. This is the differentiator vs the hobby Ceph MCPs that just proxy ceph -s.

• clusterhealth — HEALTHWARN/ERR root-cause analysis. Instead of echoing

osdpurge, pooldelete, setpoolsize, rbdimagedelete — carry dry-run + double-confirm and a high risk tier; reversible tuning (osdreweight, throttlerecovery, clusterflagset, pool quota/pgnum/ autoscale) records an undo descriptor** capturing the prior state.

• Governed destructive ops. The operations operators actually fear —

What this tool does, and does not, decide

It delivers Ceph operations — reads and writes — accurately and efficiently, and records every one of them. It does not decide whether a write is allowed to happen. That is the agent's judgement, or the permission of the account you connect it with: give it a ceph-mgr Dashboard account with a read-only role and the writes fail at the mgr — the place that actually owns the permission.

So there is no read-only switch, no policy file, no approval gate to configure. The one thing the tool guarantees is that nothing is silent: every call, over MCP and over the CLI alike, lands an audit row in ~/.ceph-aiops/audit.db, and destructive writes still capture their before-state and record an inverse where one exists.

Each tool declares a risk_level, kept in agreement with its [READ]/[WRITE]

documentation tag by a test, and carried into the audit row as a descriptive

tier — so a reviewer can see at a glance that a row was a high-risk delete. It

is a label, not a gate.

What works

osd tree/df/reweight/out/purge, secret set/list/rm/migrate/rotate-password, doctor, mcp. osd out and osd purge require --dry-run + double confirm.

• CLI (ceph-aiops ...): init, overview, health detail/health status,

(17 read, 18 write, 2 undo), every one wrapped with the bundled @governed_tool harness. The CLI is a convenience subset; the MCP surface is the whole tool.

• MCP server (ceph-aiops mcp or ceph-aiops-mcp): the full 37 tools

~/.ceph-aiops/secrets.enc (Fernet + scrypt) — never plaintext on disk. Unlock with a master password from CEPHAIOPSMASTER_PASSWORD (MCP/CI) or an interactive prompt (CLI).

• Encrypted credentials: the Dashboard password lives in an encrypted store

inverse undo descriptor (e.g. osdreweight → prior weight, setpoolquota → prior quota, throttlerecovery → prior backfill/recovery settings).

• Reversibility: reversible writes capture the prior state and record an

setpoolsize, rbdimagedelete, rbdsnapshotdelete) are high risk with dry_run and CLI double confirmation.

• Safety: destructive ops (osdpurge, osdmarkout, pooldelete,

Capability matrix (37 MCP tools)

Shortened. The full README is on GitHub.