MCP.Market

LDAP Assistant MCP server

by droideck·io.github.droideck/ldap-assistant-mcp·v0.5.0·1 stars
No reviews yet

MCP server for 389 Directory Server health diagnostics, log analysis, and SOS-report investigation

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

1 stars21 downloads/wk

Reviews

Write one

Nobody has reviewed LDAP Assistant MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

LDAP Assistant MCP tools (44, 4 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_access_log

    Analyze access log statistics (operations, errors, slow queries). LOCAL/ARCHIVE.

  • analyze_archive

    Inventory available data in an offline instance or archive source, such as an SOS report or config extract.

  • analyze_audit_log

    Analyze audit log statistics (change types, actors). LOCAL/ARCHIVE.

  • analyze_error_log

    Analyze error log statistics (severity, components, patterns). LOCAL/ARCHIVE.

  • analyze_index_configuration

    Audit index configuration against best practices with remediation commands.

  • check_replication_lag

    Measure replication lag by comparing supplier and consumer CSNs. LIVE only.

  • compare_dse_configs

    Compare entire dse.ldif between two offline/archive servers entry-by-entry.

  • compare_server_configurations

    Compare cn=config attributes between two servers side-by-side.

  • describe_connection

    Show the stored connection settings (hostname, port, SSL, base DN, auth method) for a configured OpenLDAP server.

  • find_unindexed_searches

    Find unindexed searches (notes=U/A) in access logs with fix suggestions.

  • first_look

    Multi-server health overview — the first tool to call for any directory investigation.

  • get_agreement_status

    Get detailed status for one or all replication agreements. LIVE only.

  • get_backend_configuration

    Retrieve backend configuration, cache settings, and replication role.

  • get_cache_statistics

    Analyze database and entry cache efficiency. LIVE only.

  • get_connection_statistics

    Analyze connection patterns and file descriptor usage. LIVE only.

  • get_operation_statistics

    Get operation counts by type and bind method distribution. LIVE only.

  • get_performance_summary

    Combined performance overview — the first tool when the server is slow or for any performance question. LIVE only.

  • get_replication_status

    Get replication configuration, RUV, and agreement status for one server. LIVE only.

  • get_replication_topology

    Map the complete replication topology across all configured servers. LIVE only.

  • get_resource_utilization

    Get memory, CPU, and disk usage for the Directory Server process. LIVE only.

  • get_server_configuration

    Retrieve cn=config attributes from a live, offline, or archive server.

  • get_thread_statistics

    Analyze worker thread utilization and contention. LIVE only.

  • get_user_details

    Get full attributes plus computed lock/expiry status for one user, looked up by uid.

  • ldap_searchwrite action

    Run an arbitrary LDAP search (any base DN, scope, and filter) when no specialized tool fits.

  • list_active_users

    List only users whose computed account status is active (not locked or inactivity-expired).

  • list_all_groups

    List directory groups with their full attributes, including membership (member/uniqueMember).

  • list_all_users

    List all user accounts regardless of status, with computed lock/active status per user.

  • list_healthcheck_errors

    List all known DSLE error codes that ``run_healthcheck`` can return.

  • list_healthchecks

    List available health checks for a server in ``category:check`` format.

  • list_indexes

    List all configured indexes (attribute + VLV) per backend.

  • list_locked_users

    List users whose accounts are locked, whether directly or indirectly (account policy / inactivity).

  • list_plugins

    List server plugins with their enabled/disabled status.

  • list_replication_conflicts

    Find replication conflict and glue entries that need resolution. LIVE only.

  • list_servers

    List all configured servers with their connection modes.

  • parse_access_log

    Parse access log entries with full detail (requires expose_sensitive_data).

  • parse_audit_log

    Parse audit log entries with full detail (requires expose_sensitive_data).

  • parse_error_log

    Parse error log entries with full detail (requires expose_sensitive_data).

  • run_healthcheckwrite action

    Run targeted lint checks on a single server (like ``dsctl healthcheck``).

  • run_monitorwrite action

    Return raw cn=monitor attributes for a server or specific backend.

  • search_users_by_attribute

    Search users by any single attribute=value match (e.g. departmentNumber, title, mail domain).

  • search_users_by_name

    Search users by name substring or '*' wildcard across uid, cn, givenName, sn, displayName, and mail.

  • server_health

    Probe the MCP service itself (NOT directory server health — use ``first_look`` for that).

  • validate_configurationwrite action

    Run static configuration lint on dse.ldif (like ``run_healthcheck`` but offline).

  • whoami

    Verify credentials by binding to the OpenLDAP server and returning the authenticated identity (LDAP Who Am I).

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan37 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How LDAP Assistant MCP compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
44
the typical server has 7
Tools that change things
9%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 65% of 28,688 servers
Downloads a week
21
more than 8% of 12,191 servers with a package

What its tools let an agent do: 40 read · 2 change · 2 run or deploy

Install LDAP Assistant MCP in Claude Code, Cursor or VS Code

claude mcp add ldap-assistant-mcp -- uvx ldap-assistant-mcp
Add to Cursor

What the publisher says

From the LDAP Assistant MCP repository's README, as published. We do not edit it. Read it on GitHub

LDAP Assistant MCP

<!-- mcp-name: io.github.droideck/ldap-assistant-mcp -->

Beta — read-only 389 Directory Server diagnostics, suitable for evaluation and internal troubleshooting. Tool schemas, output formats, and configuration fields may still change before 1.0.0.

LDAP Assistant MCP turns your AI assistant into a 389 Directory Server support engineer. Point it at live servers, stopped instances, or an SOS report from a customer case, and ask:

  • "What's wrong with my directory servers?"
  • "Summarize this SOS report before I open the case."
  • "Replication looks broken between these servers — why?"

It answers with prioritized findings (severity, impact, remediation) from 42 read-only diagnostic tools built on lib389, the official 389 DS administration library. Privacy mode is on by default: DNs, hostnames, and IPs are redacted before anything reaches the LLM.

Supported provider: 389 Directory Server. (OpenLDAP provider code exists experimentally behind an opt-in flag, with no privacy guarantees, and is not part of the support contract — see Environment Variables.)

Install

Prerequisites

  • Linux (primary) or macOS. Windows is not supported natively (python-ldap has no official Windows wheels) — use WSL2 (see the install playbook)
  • Python 3.11+ (3.13 is what CI tests against)
  • uv package manager
  • MCP client (Claude Desktop, Claude Code, Cursor, Gemini CLI, etc.)
  • System development libraries (needed to build python-ldap):

Fedora / RHEL / CentOS:

sudo dnf install python3-devel openldap-devel cyrus-sasl-devel openssl-devel gcc

Ubuntu / Debian:

sudo apt install python3-dev libldap2-dev libsasl2-dev libssl-dev gcc

macOS (Homebrew):

brew install openldap
  export LDFLAGS="-L$(brew --prefix openldap)/lib"
  export CPPFLAGS="-I$(brew --prefix openldap)/include"

Anything failing during install? → Installation troubleshooting playbook

From PyPI (recommended)

No clone needed — your MCP client runs the published package via uvx. Skip ahead to Configure your servers, then use this client configuration (Claude Desktop: ~/Library/Application Support/Claude/claudedesktopconfig.json on macOS):

{
  "mcpServers": {
    "ldap-assistant-mcp": {
      "command": "uvx",
      "args": ["ldap-assistant-mcp"],
      "env": {
        "LDAP_SERVERS_CONFIG": "/absolute/path/to/servers.json"
      }
    }
  }
}

Use an absolute path for LDAPSERVERSCONFIG — relative paths resolve against the MCP client's working directory, which is usually not where you think.

From source (development)

git clone https://github.com/droideck/ldap-assistant-mcp.git
cd ldap-assistant-mcp
uv venv && source .venv/bin/activate
uv pip install -e .[dev]

# Register with your MCP client via FastMCP:
fastmcp install claude-desktop fastmcp.json   # or: fastmcp install claude-code fastmcp.json

Then set LDAPSERVERSCONFIG in the generated client entry as above. See the Development Guide for test containers and architecture.

Configure your servers

Create a servers.json with your LDAP server(s). Note: the name field is never redacted in privacy mode — it is passed as-is to AI agents so they can reference servers across tool calls. Do not put hostnames, IPs, or other private information in server names.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

LDAP Assistant MCP: common questions

Is LDAP Assistant MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the LDAP Assistant MCP safety report
How do I install LDAP Assistant MCP?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does LDAP Assistant MCP need an API key?
No secret keys are declared. It reads 1 setting from the environment.
Is LDAP Assistant MCP maintained?
The last commit was 40 days ago (2026-09-25). The latest release is v0.5.0.
What can I use instead of LDAP Assistant MCP?
Servers from other publishers that do the same job: pyscn MCP server.
How does LDAP Assistant MCP compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 44 (the typical server has 7); tools that change things 9% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to LDAP Assistant MCP

Same job from other publishers: the closest match first, then the best rated.

  • pyscn
    Python code analysis for AI agents: complexity, dead code, clones, coupling, and a health score.
    A