Skip to content

[OSPP] Implement a mcp server to run any scripts or commands securely #3547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 19 commits into
base: master
Choose a base branch
from

Conversation

yexuanyang
Copy link

What's changed?

Hello, everyone! Currently, we are looking at monitoring data or alarm data on hertzbeat platform, but we can't make the next step such as automatic recovery, automatic repair, etc. for alarm data or collected data. Now with AI's capabilities, we can automate monitoring and alerting with the help of AI, which generates and decides on its own the repair scripts or tasks for abnormal services on the other end based on the alert information, monitoring information, etc., and then calls the mcp server deployed on the other end to execute them. So I wrote a mcp server and put it under the mcp-servers folder, other mcp servers can be put into this same directory, so that it is easy to add new mcp servers to hertzbeat.

This mcp server currently accomplishes the following:

  • Execute scripts through the mcp server. Scripts are currently executed from unix-like os using the shibang #! ASCII text executable file in unix-like os using shibang #! in the header, windows bat format is not tested.
  • There are preset tools that combine a series of common commands to accomplish some information gathering tasks. For example, getting the current disk usage.
  • Record logs of command and script execution. There may be omissions in the logging of some operations, but this is only the first version.
  • Command blacklist and operator blacklist. Me. Commands and operators in the blacklist cannot be executed; the blacklist is now configured in config.yaml.

Some things that need to be done in the future:

  • Command whitelisting. Some commands may have dangerous operators and commands, but administrators still want to allow such commands to be executed, these commands are put into a whitelist, and the program prioritizes checking to see if the command matches one of the whitelisted items, and executes it directly if it matches, and only checks with the blacklist if it doesn't exist.
  • documentation. Current The documentation is incomplete in the current code, and needs to be filled in later.

Sorry, this pr might be a bit big, I'll try to work with reviewer to ease the pain of review.

Checklist

  • I have read the Contributing Guide
  • I have written the necessary doc or comment.
  • I have added the necessary unit tests and all cases have passed.

@github-actions github-actions bot added the doc Improvements or additions to documentation label Jul 4, 2025
@tomsun28 tomsun28 added the OSPP label Jul 4, 2025
@tomsun28 tomsun28 changed the title [feature] Implement a mcp server to run any scripts or commands securely [OSPP] Implement a mcp server to run any scripts or commands securely Jul 4, 2025
@tomsun28 tomsun28 requested a review from Aias00 July 5, 2025 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
doc Improvements or additions to documentation OSPP
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants