Experimental MCP Server Feature Coming to Checkmk

Announcements
1

Hello Community!

Today, we launch the Checkmk MCP Server, free for Pro, Ultimate/MT, and Cloud editions. Use your AI tool of choice (including local, self-hosted LLMs) to directly access your live site, and run natural language queries like “What needs my attention right now?” to get instant insight into your monitoring data.

A few practical details on how it handles security and data:

  • Disabled by default: turn it on under Setup → Global settings.

  • Strictly read-only: honors native RBAC and will not write changes to your site. Checkmk can not view or store your queries.

  • Air-gap friendly: pair it with a local model so zero telemetry leaves your firewall.

  • Editions: It’s free for Pro, Ultimate/MT, and Cloud editions.

As an experimental release, we want your feedback to shape the future of our AI capabilities.

Full setup instructions and test site results are in the announcement blog post.

Please note: If you update a site rather than installing from scratch, we recommend running the following command: sudo omd update-apache-config <site>

We’re also hosting a Community Call with a demo and engineering Q&A on September 23 at 3 PM CEST on Zoom. You can get the ics file here (1.0 KB).

Subscribe to receive a reminder about the call 1 day and 1 hour before the event: Checkmk Community Event Reminder

Looking forward to seeing you there!

2 Likes
2

Tested on 2.5.0p13.pro via Claude Code.

First, credit where it is due: connecting took two minutes, and thanks to dynamic client registration there was no user and no secret to create anywhere. The tool descriptions are unusually careful - they document the traps, not just the parameters - and the thing genuinely saves time: questions that used to mean clicking through several views are now one call. Which is why I would like to see one detail addressed before this goes wider.

MCP server: credentials in cleartext - and what does the usage-data switch send?

I called read_setup_configuration for one host because I wanted its IP address. The response included:

"snmp_community": {
  "auth_protocol": "MD5-96",
  "auth_password": "<cleartext>",
  "privacy_protocol": "CBC-DES",
  "privacy_password": "<cleartext>"
}

This matches the REST API’s long-standing behaviour, so it is not a regression. But the consumer is new: “strictly read-only” protects against modification, not against disclosure, and this client forwards what it reads into the context window of an external language model. An agent also enumerates, where a human looks up one host and stops.

Suggestion: mask secret-bearing fields in the MCP layer by default (snmp_community, management_ipmi_credentials, special agent credentials). Junos does this well — a login class without the secret permission sees /* SECRET-DATA */ and everything else still works. Failing that, document it before the consent screen: a monitoring-only role never reaches this tool, but I only learned that after seeing the passwords.

And one question: what exactly does Send MCP usage data to Checkmk transmit? I found nothing in the werk, the blog post, the docs or the inline help. Above all — are tool results included? The result of read_setup_configuration contains those passwords, so with that box ticked the same call would disclose them twice: to the model and to you. Most likely the answer is “counters only”, and one sentence in the inline help would settle it.

the documented settings path does not match the GUI

Both Werk #22263 and the announcement blog post say:

Global settings > Site management > Enable MCP server

In 2.5.0p13 the settings actually live in their own section:

AI features
  Enable MCP server
  Send MCP usage data to Checkmk

Anyone following the instructions looks in the wrong place first. Worth a one-line fix in the werk, the blog post and the docs — it is the very first step a new user takes.

2 Likes
3

Hello,

thank you so much for your feedback and trying out the MCP server, it’s really nice to hear that you found it useful so far.

Thank you also for your suggestion about password handling, we are taking up your suggestion and will implement it as soon as possible. I will update here to let you know when the fix is available.

Regarding the usage data:

We have a section in the Knowledge Base article available where we describe in more detail what an opt-in would entail. If you choose to opt in we collect the following:

  • Tool and resource calls (this only means the name of the tool, we aren’t collecting the actual prompt or the responses you receive).
  • Call latency
  • Response size
  • AI client
  • Session ID
  • Protocol version

Let us know if you have any other concerns or questions and once more, thank you so much for your feedback!

Annika

2 Likes
4

And … done:

1 Like
5

Thank you to everyone who joined the call!

Here is the presentation, in case you were not able to join us today, or would like to review the content:
The Checkmk MCP Server Community Call.pdf (750.1 KB)

1 Like