Systemd Monitoring MCP

systemd监控mcp

MCP服务器，用于通过JSON-RPC监控Linux服务器。

功能（MVP）

• GET /health 公共卫生终点。
• GET /.well-known/mcp 公共MCP发现端点。
• POST /mcp MCP JSON-RPC端点（受承载令牌保护）。
• initialize 接受现代协议版本（包括 2025-03-26)并优雅地进行谈判。
• MCP工具： list_services, list_timers, list_logs.
• MCP资源： resource://services/snapshot, resource://services/failed, resource://logs/recent.
• 使用承载令牌进行身份验证 MCP_API_TOKEN.

MCP工具功能

• list_services：列表 *.service 可选单元 scope, state, name_contains, limit，以及 summary.
• list_timers：列表 *.timer 可选单元 scope, name_contains, state, limit, sort, order, overdue_only, include_persistent，以及 summary.
• list_logs：列出带有必填项的日志 start_utc/end_utc 可选 scope, priority, unit, exclude_units, grep, order, limit, allow_large_window，以及 summary.

scope 支持 system|user|both 默认为 system 对于所有三个列表工具。

配置

注： 强烈建议在反向代理（例如Nginx、HAProxy、Envoy）后面运行此服务 它负责TLS终止并限制网络访问。

不要把这个暴露在互联网上！

跑

export MCP_API_TOKEN="a-secure-token-at-least-16-chars"
# optional:
# export BIND_ADDR="127.0.0.1"
# export BIND_PORT="8080"

cargo run

API示例

健康

curl -s http://127.0.0.1:8080/health

MCP初始化

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","clientInfo":{"name":"example-client","version":"1.0.0"},"capabilities":{}}}' \
	http://127.0.0.1:8080/mcp

MCP工具/清单

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' \
	http://127.0.0.1:8080/mcp

MCP工具/呼叫列表_服务

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"list_services","arguments":{"state":"failed","name_contains":"sshd","limit":200}}}' \
	http://127.0.0.1:8080/mcp

MCP工具/调用列表计时器

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":8,"method":"tools/call","params":{"name":"list_timers","arguments":{"scope":"both","sort":"next","order":"asc","limit":200}}}' \
	http://127.0.0.1:8080/mcp

MCP工具/调用列表_logs

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"list_logs","arguments":{"scope":"both","priority":"err","unit":"sshd_service","exclude_units":["cron.service"],"grep":"/timeout|failed/","order":"desc","start_utc":"2026-02-27T00:00:00Z","end_utc":"2026-02-27T01:00:00Z","limit":200}}}' \
	http://127.0.0.1:8080/mcp

MCP工具/呼叫摘要模式

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":6,"method":"tools/call","params":{"name":"list_services","arguments":{"summary":true}}}' \
	http://127.0.0.1:8080/mcp

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":7,"method":"tools/call","params":{"name":"list_timers","arguments":{"scope":"both","summary":true}}}' \
	http://127.0.0.1:8080/mcp

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":9,"method":"tools/call","params":{"name":"list_logs","arguments":{"scope":"both","start_utc":"2026-02-27T00:00:00Z","end_utc":"2026-02-27T01:00:00Z","summary":true}}}' \
	http://127.0.0.1:8080/mcp

MCP工具/调用无效作用域（验证示例）

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":10,"method":"tools/call","params":{"name":"list_services","arguments":{"scope":"global"}}}' \
	http://127.0.0.1:8080/mcp

预期：JSON-RPC错误 -32602 具有稳定的数据代码 invalid_scope.

MCP资源/读取失败服务快照

curl -s \
	-H "Content-Type: application/json" \
	-H "Authorization: Bearer $MCP_API_TOKEN" \
	-d '{"jsonrpc":"2.0","id":5,"method":"resources/read","params":{"uri":"resource://services/failed"}}' \
	http://127.0.0.1:8080/mcp

验证

在切换或释放之前使用此序列：

cargo fmt --check
cargo clippy --all-targets -- -D warnings
cargo test

备注

• list_logs 需要UTC RFC3339时间戳 Z 后缀为 start_utc 和 end_utc.
• 时间窗口超过7天需要 allow_large_window=true.
• 定时器和服务工具是只读的，不会改变systemd状态。