Replies: 12 comments 5 replies
|
Hi @G0nz0uk, you are very close. Let me work through what I see in your logs. Important: misleading log line is a bug we just fixedLook at this line from your startup log: This is misleading - it is a bug in the security status display. The check only looked at the legacy I just pushed a fix on So your server is correctly requiring auth - the Your curl testYou hit the curl -s -H "Authorization: Bearer zmcp_8870blahblah123xxxxxxxxxxxxxa20c5d79 https://zabbix-mcp.mydomain.com:8080/health
^ no closing quoteThe shell sees the open curl -s -i -H "Authorization: Bearer zmcp_8870..." https://zabbix-mcp.mydomain.com:8080/mcp(Note: I added You should see:
If you get 405 with the correct token, the server side is fine and the issue is in how your AI client constructs the Authorization header. Debugging the AI clientIf the curl test with the correct token gives you 405 (good), but your AI client still gets 401, the AI client is not sending the header correctly. Common issues:
Temporarily disable auth to isolate the problemIf you want to confirm the rest of the integration works without auth in the way:
If the AI client connects in this state, the integration is fine and you just need to fix how the client sends the auth header. If the AI client still fails to connect, the problem is somewhere else (client config, network, TLS cert chain, etc.) and not auth-related at all. After confirming, uncomment the Your admin page is great btw!Thank you, glad to hear that. Let me know what curl with the correct token returns (401 / 405 / 200), and what your AI client lets you configure for the auth header. That will narrow it down to one of: server-side, network, header format, or client config. |
|
Just updated, seems to fail now on some health checks: However the service restarted successfully. Curl tests, re-run where I get a 406 What else can I try to debug this? I can paste me config.toml it you like. I tried again with our AI Client and it failed (uncomment the [tokens.copilot] too) , I'll see it the Dev team can see what is going on too. 
|
|
Good news hidden in your logs @G0nz0uk - the server is working. Let me decode the two things you saw, then I'd like to see one more log before guessing further. The
|
|
Updated to v1.20, but still no joy. If I run this with my details it returns nothing even if I change the api key or url, it just drops to the next line. I attempted to use out AI client again and it failed and the logs showed nothing, so I'm wondering if it's even reaching it, so I've asked the Dev team to look at any logs they have. logs I'm wondering what other free AI tool I can use you have mentioned as Claude Desktop does not like this format at all: 
I'll keep trying, let me know what else you need. Update: I tried using Postman too which works! Maybe you documentation could include. How can I use it to show the top issues that have bene triggered, or what host devices were are down today with a certain tag? 
It's not easy to use, but I can see my searches in the logs too. I imagine in an proper AI Client I can ask 'What devices have had problems in the last hour?' and things like this? |
|
Thanks for the follow-up @G0nz0uk - the logs you posted are actually the best possible outcome: your server side is fully working. Two things decoded, then an answer to the Claude Desktop / Postman / free-tool questions. "curl: (52) Empty reply from server" is a TLS vs HTTP mismatchYour So the MCP port is serving HTTPS, but the installer's health check + your local curl were hitting HTTP: TLS-enabled uvicorn sees the plain Two fixes inbound for v1.21 (already committed on
In the meantime you can test your server by hand with: curl -k https://127.0.0.1:8080/healthYou should see The Claude Desktop config in your screenshot is the wrong format for AnthropicThe snippet you pasted: {
"mcpServers": {
"zabbix": {
"type": "http",
"url": "https://zabbix-outdoor-mcp.domain.com:8080/mcp",
"headers": { "Authorization": "Bearer zmcp_..." }
}
}
}That The only way to reach a Bearer-authenticated MCP server from Claude Desktop today is through the {
"mcpServers": {
"zabbix": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://zabbix-outdoor-mcp.domain.com:8080/mcp",
"--header",
"Authorization: Bearer zmcp_..."
]
}
}
}You also need Node.js 18+ installed on the machine running Claude Desktop (the The v1.20 release notes list the wizard under "Client MCP Wizard (beta)" and walk through the OAuth-vs-Bearer gotcha if you want the background. Postman success means everything is in placeYour Postman screenshot showing Free AI tool options that will "just work" with this serverTop of my recommendations in order of friction:
Example prompts that work wellOnce you are connected, these are the sort of questions the LLM can answer using your Zabbix data. Paste them as-is into your chat:
The LLM picks the right Let me know once you have switched Claude Desktop over to the wizard-generated config (or tried one of the free alternatives), and I will keep this thread open until you have a green end-to-end flow. Tom |
|
Thanks Tom, I will test this all tomorrow and let you know how it goes. Once again thanks for your patience and hopefully some of my finds have helped too, I will no doubt have more questions once connected and searching. Once I have it all working one thing I want to look at is automating the certificate. I will create a new discussion on this. We use LetsEncypt and Digicert for our servers which run their agent and auto renew the certificate. The thing is they auto detect the software running (Apache, Nginx, IIS etc) and cert location and apply one of their post scripts to replace the certificate, they can't detect the MCP server. Your tool will need a custom post script, they have may examples on the digicert GitHub page for many vendors, anyway I will create a separate discussion on that. |
|
Hey @G0nz0uk, checking in - did the TLS vs HTTP scheme fix get you connected from your AI client? No rush, just did not want the thread to drop off the radar in case you got stuck on something else. On the LetsEncrypt / Digicert auto-renewal topic you mentioned: a separate discussion for that is a good idea. Worth noting that the installer already reads |
|
Hey Tom, I certainly haven't forgotten this. In fact I chased the team who look after our companies AI client which is hosted in AWS/Azure. They need to add firewall rules and rules to get to my Zabbix MCP server. I got Postman connected locally but ofc it has no LLM and is essentially dump. Good to prove it connects and can see all the API calls. I could never get Claude Desktop working, I could try again with fresh errors if you are interested. With regards to Digicert automation then yes I'd love some help. They have example post scripts that we could use as examples for systems like Apache and Nginx - https://github.com/digicert/product-solutions Maybe one can be generated for your MCP? |
|
Why I sort the corporate AI client out with the other team, I'm back trying claude desktop. I’m running zabbix-mcp-server with HTTP transport and bearer auth, exposed at: https://zabbix-outdoor-mcp.domain.com:8080/mcp Server config includes: [server] A remote MCP client can reach the server, but during auth discovery the server advertises: The client then fails with: This appears to be because the server is using the bind host ( Expected behaviour: https://zabbix-outdoor-mcp.domain.com:8080/ Is there a supported setting for public/base/external URL or issuer, or is this a bug? claude log: In my config.toml |
|
Hi @G0nz0uk - the connectivity bug you and Dmitry hit is shipped in v1.24, just released: https://github.com/initMAX/zabbix-mcp-server/releases/tag/v1.24 The root cause was OAuth discovery advertising the literal bind address ( [server]
host = "0.0.0.0"
port = 8080
public_url = "https://mcp.your-company.com:8080"Configure it from Plus a few things that fall out of the same observation:
Upgrade: sudo install.sh upgrade # bare metal
docker compose pull && docker compose up -d # dockerLet me know if discovery still trips up on your AI client setup with the new field configured - happy to dig in. |
|
Now on v.1.24 and added the public URL and restarted: Opened Claude Dekstop. Claude_desktop_config.json It would be interesting if you can get your local MCP server working with a local Claude Desktop install and see if you get the same errors. I use the non docker install and 0.0.0.0 to listen to all interfaces. Should I be using the actual IP of the server or is 0.0.0.0 correct? Maybe my Claude_desktop_config.json is wrong. Claude Desktop is on a Windows machine if I try the URL from the browser it gets there: https://zabbix-outdoor-mcp.domain.com:8080/mcp https://zabbix-outdoor-mcp.domain.com:8080/health I'll keep trying tomorrow. The ticket to use our corporate Client AI tool is still open, so I'll chase them too. |
|
Hi @G0nz0uk - upfront: the server does not implement OAuth 2.0. Bearer-token-only. What v1.24 ships is the OAuth discovery metadata ( Two practical paths forward: A) Use a client that speaks bearer-token directly, not OAuth-flow-via-mcp-remote. What is your AI client side? If you can list the options you have available, I can tell you which work today:
If your destination is one of the bearer-friendly clients, switch and you are done. B) If you genuinely need Claude Desktop + mcp-remote (or a corporate client that requires real OAuth), I can ship OAuth as a v1.26 feature - but I will need your help to debug it. I do not have the same Windows + corporate client setup, so I cannot reproduce mcp-remote's exact failure path. What I would need:
I would rather not build a half-working OAuth surface that breaks five months from now because some real-world client expects an endpoint we did not test against. Easier and faster if we close the loop with an actual client in the loop. So - what does the corporate AI client look like, and which clients have you got available locally? Once I know what we are aiming at, the answer is "switch to client X" or "OAuth lands in v1.26, here is the beta". (v1.25 dropped a few hours ago - https://github.com/initMAX/zabbix-mcp-server/releases/tag/v1.25 - mostly UX polish, does not change the OAuth picture so your 404 will still reproduce. Worth upgrading regardless.) |
|
Ran that debug error, I guess this is the issue? |
|
I used Claude Code (paid for 1 month) and it works! it's amazing, I also build the Netbox MCP server as we sync data from Netbox to Zabbix and now both work. It's all in Dev at the moment but a powerful combo. I'm just using readonly tokens and use AI for informational purposes only and not to create anything. I'll be testing this much more. Thanks |
|
Hey @G0nz0uk - small update to the "OAuth is not implemented" answer I left here back in v1.24: v1.28 ships a full embedded OAuth 2.1 authorization server, and v1.29 adds polish on top. ChatGPT custom apps, Claude Desktop remote connectors, MCP Inspector, and any MCP 2025-11-25 compliant client now negotiate auth with this server without an external IdP, without a hardcoded bearer, and without operators learning OAuth library internals. Highlights:
Setup walkthrough including Apache / Nginx / Caddy reverse-proxy snippets:
Bearer-token mode (the path you successfully used with Claude Code) keeps working alongside OAuth - you do not have to migrate your existing |
|
Closing this thread - the connectivity gap that triggered it was the OAuth-discovery 404 from |
|
I'll keep testing Tom, I love it. I'm using it with a Netbox MCP too so we get issues and information from Zabbix and on top Netbox info for that same device. My next step is to add the GCX Grafana MCP for my Loki logs. These MCPs are all pointing to my Dev versions of Zabbix, Netbox so at some point I'll need to re do it all and point to my Prod environment. I'm using Claude Pro at them moment, but will need to eventually use our corporates own AI client. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I'm trying to connect to the MCP server (none Docker version v1.18) via our company AI client
If I go to the URL /mcp I get:
{"error": "invalid_token", "error_description": "Authentication required"}/health
{"status":"ok"}
I'm not sure if there is a way to test the token via the URL or what could be wrong here. Any help would be great as I think I'm very close at testing this.
Restarted the service:
I can't tell if it's an API issue or AI client issue. Can I temporarily remove the API token somehow to see if it connects with no authentication?
Your admin page is great btw!
Curl test
Odd it goes to 'dquote>'
Thanks
All reactions