openITCOCKPIT MCP server

openITCOCKPIT MCP Server

An MCP server that puts an openITCOCKPIT monitoring instance in front of an LLM client: what is broken and why, what someone already handles, what changed - and, off by default, the tools that act on it.

[!CAUTION]

Use at your own risk. This server lets a language model read and - with write

tools enabled - change your monitoring configuration. A model can misunderstand a

request or pick the wrong call. Review what it proposes before you approve it, and

start with read-only access. The software is provided "as is", without warranty

or liability of any kind; see the MIT License.

the server resolves them.

• Requires openITCOCKPIT 5.6 or newer (compatibility).
• 42 tools, 20 read-only and 22 that change something.
• Write tools are off by default and are not registered until you enable them.
• Names, never IDs. Tools take hostnames, template names and container paths;

before anything is sent, which openITCOCKPIT's own API does not do.

• Scope-checked writes. References are validated against the target container

Quickstart

cp .env.example .env          # fill in the two secrets, see Configuration
docker compose up --build

Point your client at http://localhost:8000/mcp with the bearer token from your .env. Compose reads that same file for the published port, so setting OITC_PORT there moves both sides at once.

Three settings matter to start: MCPAUTHTOKEN (what clients present to this server), OITCBASEURL and OITCAPIKEY (what this server presents to openITCOCKPIT). Everything else has a default - all of it.

What you can ask it

Every tool by name, with its parameters and what it costs in context: docs/tools.md, generated from the code. What a result looks like and what happens when you write: docs/using-the-tools.md.

Limiting an instance

Running a monitoring instance is not one job, so a surface small enough to be easy would be too small to be useful. Instead the server keeps every tool the work needs and a toolset hands one agent its share: around ten tools, complete for that job and nothing beyond it. A tool that was never registered cannot be called at all.

OITC_TOOLSETS=health          # find things and see how they are doing
OITC_TOOLSETS=operations      # acknowledge, maintenance windows, check now
OITC_TOOLSETS=lifecycle       # take things out of the monitoring, or delete them

The shipped sets are health, operations, lifecycle, patch, reporting, catalog, onboarding, config and provisioning. Sets are defined in a file you can replace: docs/toolsets.md.

Measuring a model

oitc-mcp-eval asks operator questions against your instance and checks whether a model answers them from the tools instead of inventing. It keeps every run in SQLite, so models and changes stay comparable.

oitc-mcp-eval --model your-model --samples 3     # against the configured instance
oitc-mcp-eval --compare                          # newest run of every model
./scripts/eval-throwaway.sh --model your-model   # instance created and removed for you

docs/evals.md.

Documentation

Shortened. The full README is on GitHub.