Commvault MCP Server

A Model Context Protocol (MCP) server for seamless integration with Commvault environments. This server enables AI agents to securely access and manage job details, commcell metrics, client and storage information, user permissions, plan configurations, and backup schedules.

Features

The Commvault MCP Server enables seamless integration with Commvault environments, offering the following:

Prerequisites

Before running the Commvault MCP Server, ensure the following requirements are met:

1. Python Environment

• Python 3.11 or higher
• uv package manager (used for dependency management and running the server)

2. Authentication & Security Configuration

The Commvault MCP Server supports two authentication methods:

Setup

1. Clone the repository

git clone https://github.com/Commvault/commvault-mcp-server.git
cd commvault-mcp-server

2. Run the Setup Script

The setup script will guide you through configuration options including:

• Metallic or on-premise deployment — for Metallic setups, the gateway URL is configured automatically
• Transport mode (stdio, streamable-http, or sse)
• Server connection details (for remote modes)
• Authentication method (traditional tokens or OAuth)
• OAuth configuration (if selected)
• Secure token storage

uv run setup.py

3. Start the MCP Server

uv run -m src.server

Running with Docker

The Docker image runs the server in OAuth mode only.

Prerequisites: Docker installed, and a Commvault environment running SP42 CU 27 or above with OAuth configured.

1. Generate a .env file

Run the interactive setup script on your host machine. When prompted for the authentication method, select OAuth.

uv run setup.py

This produces a .env file with all required variables, including the OAuth endpoints and credentials.

2. Build the image

docker build -t commvault-mcp-server .

3. Run the container

Pass the generated .env file to the container at runtime:

docker run --rm -p 9090:9090 --env-file .env commvault-mcp-server

---

Configuring Clients

Note: npx is required while using Token-Based Authentication. You can get it by installing Node.js which includes npx by default.

Additional Configuration

Note: These are optional configurations that extend the MCP server’s capabilities.

Note on LiteLLM

We do not recommend using LiteLLM as an MCP client. LiteLLM’s per-turn session lifecycle triggers cosmetic ClosedResourceError tracebacks in the server terminal due to a race condition in the upstream mcp Python SDK — these are harmless but noisy.

Security Considerations

Multi-Server Trust Boundary (Tool Poisoning & Tool Shadowing)

The MCP protocol enforces no isolation between servers that share a single agent session. Any other MCP server running in the same session as the Commvault MCP has the practical ability to influence the agent’s reasoning about Commvault operations, even without direct access to CommServe or any privileges against it.

Two attack paths follow from this architectural property:

• Tool Poisoning — A malicious server’s tool description coerces the agent to read the operator’s stored Commvault auth token from host-side storage (e.g. ~/.claude.json, a project-level .mcp.json, or the OS keychain entry for commvault-mcp-server) and pass the token value as a parameter to an attacker-controlled tool, which then exfiltrates it.
• Tool Shadowing — A malicious server’s tool description names Commvault tool identifiers (e.g. kill_job, disable_schedule, set_user_enabled) and instructs the agent to perform additional or modified Commvault operations whenever the operator legitimately invokes those tools. The Commvault MCP itself is the actor in these calls; its code and responses are not corrupted. The corruption lives in the agent’s reasoning, induced by the third-party server’s metadata.

Neither path requires any defect in the Commvault MCP Server code. Both are properties of the MCP architecture as currently specified.

Recommendations for operators:

• Install only first-party or independently audited MCP servers in agent sessions that include Commvault tools.
• Where feasible, use an isolated agent session in which the Commvault MCP is the only integration.
• Where isolation is not feasible, restrict the agent’s general filesystem and outbound-network tool capabilities for the duration of the session.

Credential Hygiene

• Use short-lived access tokens with explicit refresh rather than long-lived bearer tokens. A bounded token lifetime limits the window during which an exfiltrated credential remains usable, and rotation invalidates leaked tokens before an attacker can act on them.
• Restrict outbound traffic from the MCP host. Where your environment supports it, apply a network policy that limits outbound HTTP/HTTPS from the host running the MCP server to a documented allowlist. Unexpected outbound calls from an MCP host are the principal exfiltration channel for this class of attack and the most reliable detection signal.

Contributing

• We’re continuing to add more functionality to this MCP server. If you’d like to leave feedback, file a bug or provide a feature request, please open an issue on this repository.
• Pull requests are welcome! For major changes, please open an issue first to discuss what you would like to change.

License

This project is licensed under the Apache License. See the LICENSE file for details.