Zabbix AI CLI MCP server

Zabbix AI CLI MCP — Zabbix MCP server and CLI for AI agents

zabbix-ai-cli-mcp is a Zabbix MCP server and command-line client in one Go binary. It gives Claude Code, Claude Desktop, Codex, Cursor and any other Model Context Protocol client task-shaped access to Zabbix — what is broken right now, why a host is silent, why an alert never arrived — with bounded output, a stable JSON contract, and no change to Zabbix without a person's approval.

It is for the people who get paged: SRE and DevOps teams running Zabbix who want an agent to triage an incident without handing it the whole API.

Requires Zabbix 6.4 or newer. Bearer-token authentication arrived in 6.4 and is the only scheme implemented; earlier versions expect the token in the request body instead.

It never contacts a language model. The AI decides, this program executes, Zabbix monitors.

zabbix-ai-cli-mcp login
zabbix-ai-cli-mcp problems list
zabbix-ai-cli-mcp host investigate server01
zabbix-ai-cli-mcp alert why 757474
zabbix-ai-cli-mcp mcp

Why not another Zabbix API wrapper

Wrapping host.get, problem.get and history.get hands the agent the API's sharp edges along with its power. On a current Zabbix 7.4 server:

a float item — silently, with no error.

• problem.get has no selectHosts, so a problem list arrives without hosts.
• history.get defaults to the numeric-unsigned table and returns nothing for

"0" for several major releases.

• item.lastvalue and item.lastclock still exist and have returned a constant

a name fragment into an exact match that quietly finds nothing.

• host.available was removed in 5.4; availability lives on the interface.
• event.acknowledge takes a bitmask whose own documentation contradicts itself.
• searchWildcardsEnabled: true disables implicit substring matching, turning

Every one of those produces a confident, wrong answer rather than an error. This tool absorbs them behind commands that describe the task instead of the endpoint.

What it does

Safety

Read operations always run immediately. Whether anything else does is one setting, allowwrite, and it is on by default**.

# ~/.config/zabbix-ai-cli-mcp/config.toml
allow_write = true            # the default; omit the key and you get this

[profiles.prod]
url = "https://zabbix.example.com"
allow_write = false           # this one profile is an exception

Shortened. The full README is on GitHub.