Veeam AIops MCP server

<!-- mcp-name: io.github.AIops-tools/veeam-aiops -->

Veeam AIops

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by Veeam Software. "Veeam" is a trademark of its owner. MIT licensed.

AI-powered Veeam Backup & Replication operations with a built-in governance harness — unified audit log, policy engine, token/runaway budget guard, undo-token recording, and descriptive risk tiers. Self-contained: no external dependencies beyond httpx and the MCP SDK. Coverage is not yet full coverage of every Veeam operation.

Verification status: the test suite is mock-based; this package has not yet been

validated against a live Veeam B&R server. See docs/VERIFICATION.md.

What works

• CLI (veeam-aiops ...): init, overview, job list/get/start/stop/retry/enable/disable, restore list-points/start, repository list/get/state, session list/get/log/stop, backup list/objects/usage/ranking, diagnose job-failures/repo-capacity, infra servers/proxies, secret set/list/rm/migrate/rotate-password, doctor, mcp.
• MCP server (veeam-aiops mcp or veeam-aiops-mcp): 27 tools (19 read, 8 write), every one wrapped with the bundled @governed_tool harness.
• Diagnostics / RCA (read-only): diagnose job-failures triages recent job sessions — flags every Failed/Warning run and categorizes the likely cause (repository full, source/guest unreachable, credential/VSS failure, retry exhaustion), citing the session result + matched error substring; diagnose repo-capacity flags repositories under the free-space thresholds (<15% warn, <10% critical). Both cite the measured number that tripped each finding, worst-first.
• Encrypted credentials: passwords live in an encrypted store ~/.veeam-aiops/secrets.enc (Fernet + scrypt) — never plaintext on disk. Unlock with a master password from VEEAMAIOPSMASTER_PASSWORD (MCP/CI) or an interactive prompt (CLI).
• Reversibility: write ops with a clean inverse (job start/stop/retry, enable/disable) record an inverse undo descriptor; the irreversible VM restore declares none and is tagged high risk.
• Async sessions: Veeam jobs and restores run as sessions — poll progress with session list / session get / session log (the runaway budget guard prevents poll loops from running away).

What this tool does, and does not, decide

It delivers Veeam Backup & Replication operations — reads and writes — accurately and efficiently, and records every one of them. It does not decide whether a write is allowed to happen. That is the agent's judgement, or the permission of the Veeam account you connect it with: give that account a read-only or restricted role on the VBR server and the writes fail at the server — the place that actually owns the permission.

So there is no read-only switch, no policy file, no approval gate to configure. The one thing the tool guarantees is that nothing is silent: every call, over MCP and over the CLI alike, lands an audit row in ~/.veeam-aiops/audit.db, and reversible writes still capture their before-state and record an inverse.

Each tool declares a risk_level, kept in agreement with its [READ]/[WRITE]

documentation tag by a test, and carried into the audit row as a descriptive

tier — so a reviewer can see at a glance that a row was a high-risk restore. It

is a label, not a gate.

Running a smaller / local model? See agent-guardrails.md — it lists the guardrails this tool now enforces for you (so you don't spend prompt budget restating them) and gives a ready-made system prompt for what's left.

Quick start

As a Claude Code plugin

One install gives an agent both the skill and the MCP server:

/plugin marketplace add AIops-tools/marketplace
/plugin install veeam-aiops@aiops-tools

Shortened. The full README is on GitHub.