zabbix-mcp

zabbix-mcp is an MCP server that gives an AI assistant access to Zabbix monitoring. The morning after an outage at night, an administrator wants to know three things: what went down, on which machine, and what the metric looked like before and after the incident. In the Zabbix interface that means going through the problem list, opening the trigger, finding the item and opening its graph, and doing it all again for each further host. zabbix-mcp gives the same data to an AI assistant: through it, Claude Code or any other MCP client reads hosts, problems, triggers, events and metric history, and can acknowledge an event.

Why not a custom script against the API

Zabbix has a complete JSON-RPC API, but a script against it answers only the question someone wrote into it in advance. On top of that, the API changes details between versions, and scripts break on them. This server handles them: on Zabbix older than 6.4 it sends the API token in the request body, because those versions ignore the Authorization: Bearer header; for hosts it picks selectGroups or selectHostGroups depending on the server version; and for groups it does not ask for the internal field, which Zabbix 6.2 removed. The model then builds queries based on what is happening right now, and the administrator does not have to maintain a collection of scripts for each version.

What the administrator gets

An incident from the problem down to the metric

Eleven tools cover the whole path: host groups, hosts with interfaces, macros and inventory, current and recent problems, the event timeline, triggers with dependencies and tags, items with their last value and raw metric history. Problems can be filtered by time (since), severity and whether someone has already acknowledged them. The model answers "what broke today and what came before it" from data, not from a guess.

It changes only what it should

Ten of the eleven tools only read. The single write tool, zabbix_acknowledge_event, acknowledges an event, adds a message to it, suppresses it, closes it or changes its severity. The assistant can record a note about planned maintenance, but it cannot change the configuration of hosts or triggers. An API token with the matching permissions is enough for this.

Tested on four Zabbix versions

Version 0.4.1 has been tested against Zabbix 6.0.48, 7.0.29, 7.4.13 and 8.0.0rc1, all eleven tools including paging. It accepts the server address in three forms, with /api_jsonrpc.php, with the /zabbix path and without it, and converts it to the API URL itself.

Large results do not flood the model

A response longer than 25,000 characters is truncated and carries a note with the number of items returned and how to narrow the query. Paging is done on the MCP server side, because Zabbix has no offset parameter in its .get methods; for problems, events and history the model gets a cursor hint from the second page on. A request that does not respond within 30 seconds ends with an error; both HTTP errors and Zabbix errors reach the client with a code and a message.

How to set it up

{
  "mcpServers": {
    "zabbix": {
      "command": "npx",
      "args": ["-y", "@nks-hub/zabbix-mcp"],
      "env": {
        "ZABBIX_URL": "https://monitor.example.com",
        "ZABBIX_API_TOKEN": "your-api-token"
      }
    }
  }
}

Instead of a token you can use a user name and password (ZABBIX_USERNAME, ZABBIX_PASSWORD), which is handy for older installations or a quick test. By default the server runs as a child process of the client over standard input and output. Since version 0.4.1 the HTTP mode listens only on 127.0.0.1 and has DNS rebinding protection enabled; it holds the API token and has no authentication of its own, so otherwise a foreign web page open in the browser could control it. To expose it elsewhere, set MCP_HTTP_HOST, MCP_HTTP_ALLOWED_HOSTS and MCP_HTTP_ALLOWED_ORIGINS.

Typical uses

• Morning review: host groups, hosts, problems since last evening, then the trigger or host detail for each and the history of the metric that set off the problem.
• Planned maintenance: the assistant finds the related alerts and acknowledges them with a message explaining why they happened.
• A suspicious jump in a graph: it looks up the item, checks its value type and downloads the history from before and after the jump.
• Monitoring next to analytics: the same client can also have rybbit-mcp connected and compare a server outage with a drop in traffic.

Project status

The server started in March 2026; version 0.2.0 was released on 16 March. Version 0.4.1 from 19 August 2026 fixed paging, which ended with an error in four of the seven paged tools and returned the first page for every page in the other three. It also updated the MCP SDK to version 1.30. The repository contains scripts for manual verification against a live Zabbix with a token as well as with a user name and password; there are no automated tests in CI, which builds the project and publishes releases to npm.

Getting started

npx -y @nks-hub/zabbix-mcp
# or permanently
npm install -g @nks-hub/zabbix-mcp
# in Claude Code
claude mcp add zabbix -e ZABBIX_URL=https://monitor.example.com -e ZABBIX_API_TOKEN=your-token -- npx -y @nks-hub/zabbix-mcp

You need Node.js 18 or later and Zabbix with the API enabled. The token is created in the Zabbix user settings.

Source code

The code is on GitHub in the nks-hub/zabbix-mcp repository under the MIT licence, written in TypeScript. The package is on npm as @nks-hub/zabbix-mcp, latest version 0.4.1.