Veeam MCP

Query Veeam Backup & Replication and Veeam ONE via MCP server running in Docker. Provides intelligent backup monitoring, job analysis, capacity planning, and infrastructure health checks.

Security Scan

The skill's behavior mostly matches its stated purpose, but there are several mismatches and missing declarations (Docker/jq/credentials file requirements, unknown image source, and security claims about credential exposure) that warrant caution before installing.

Purpose & Capability

The skill claims to be an instruction-only wrapper around a locally-run Veeam MCP Docker server, which is consistent with the files. However the registry metadata declares no required config paths or binaries, while the SKILL.md and scripts clearly require Docker, jq, and a credentials file at ~/.veeam-mcp-creds.json. The metadata omission is an incoherence that could mislead users about what the skill needs.

Instruction Scope

Runtime instructions and scripts operate within the stated scope: they read a local credentials file, build/run a Docker MCP server, and send JSON-RPC requests to Veeam. They do pass admin credentials into the Docker container via environment variables and instruct users to cat or jq the credentials file for troubleshooting; the SKILL.md also asserts 'No credentials exposed in logs or command history' which depends on how the user runs commands and on the image behavior. There are no obvious instructions to exfiltrate data to third-party endpoints, but the runtime depends on the MCP Docker image — its behavior must be trusted/verified.

Install Mechanism

There is no automated install spec in the skill bundle (instruction-only plus helper scripts), so nothing arbitrary is downloaded or extracted by the skill itself. The higher-risk element is that the skill requires a separate MCP Docker image (user-obtained or built from a package). The skill does not provide or fetch that image, so install risk is limited to user decisions about the image source.

Credentials

The skill does not request unrelated credentials, but it requires privileged admin credentials for Veeam B&R and/or Veeam ONE (stored in a local JSON file). That is proportionate to the stated functionality, but these are high-privilege secrets and the skill's metadata does not declare that a config path is required. Also the scripts assume jq and Docker are available but these binaries are not listed in the registry metadata.

Persistence & Privilege

The skill is not marked always:true and does not request elevated platform privileges. It instructs users to create a credentials file in the user's home directory and run short-lived Docker containers (with --rm). This level of persistence and privilege is typical for CLI wrapper skills and is proportionate to the purpose.

What to consider before installing

Before installing or running this skill: - Be aware the registry metadata is incomplete: the scripts require Docker and jq and a credentials file at ~/.veeam-mcp-creds.json (create from the provided template). The skill will not work until those are present. - The skill relies on a Veeam MCP Docker image you must obtain/build. Only use an image/package from Veeam or another trusted vendor; verify release sources and checksums before building/running the container. - The skill needs admin credentials for your Veeam servers. Prefer a least-privilege service account where possible; protect ~/.veeam-mcp-creds.json (chmod 600) and avoid storing long-lived full-admin credentials unless necessary. - Passing credentials into docker via -e exposes them to the container environment (and to docker inspect while the container runs). Consider running containers in a restricted network, inspect the image contents before use, and avoid running on hosts where untrusted users can inspect Docker state. - The SKILL.md asserts 'no credentials exposed in logs or command history' — that depends on how you run commands (avoid echoing sensitive files/commands into shells that are logged). - Because the skill's source/homepage are not provided in the registry metadata, verify the repository or package origin (GitHub repo, vendor page, or direct Veeam distribution) before trusting the MCP image. If you need, I can list the exact places the metadata and SKILL.md diverge and suggest minimal metadata updates (required binaries and config path) or produce a checklist to safely validate the MCP Docker image before use.

Veeam Intelligence MCP Skill

Interact with Veeam Backup & Replication (VBR) and Veeam ONE through an MCP (Model Context Protocol) server running in Docker.

Natural Language Commands

When the user asks things like:

• "What backup jobs failed last night?"
• "Show me backup status for all VMs"
• "What's my backup repository capacity?"
• "Which VMs haven't been backed up recently?"
• "Check Veeam ONE alerts"
• "Analyze backup performance trends"

What This Does

This skill wraps the Veeam Intelligence MCP server (running in Docker) and provides natural language access to:

Veeam Backup & Replication (VBR):

• Backup job status and history
• Repository capacity and health
• VM backup status
• Job configuration details
• Failed job analysis

Veeam ONE:

• Infrastructure monitoring
• Performance analysis
• Alert management
• Capacity planning
• Trend analysis

Prerequisites

• Docker installed and running
• Veeam Backup & Replication and/or Veeam ONE with active licenses (not Community Edition)
• Veeam Intelligence enabled on your Veeam servers (required for Advanced Mode)
• Admin credentials for Veeam servers

Installation

1. Obtain Veeam Intelligence MCP Server

The Veeam Intelligence MCP server is currently in beta.

To obtain access:

• Contact Veeam directly or your Veeam account representative
• Visit the official Veeam community forums
• Check Veeam's official channels for beta program announcements

Once you have the MCP server package, build the Docker image:

cd /path/to/veeam-mcp-server
docker build -t veeam-intelligence-mcp-server .

2. Install This Skill

clawhub install veeam-mcp

Configuration

Create Credentials File

Create ~/.veeam-mcp-creds.json:

{
  "vbr": {
    "url": "https://veeam-server.yourdomain.com:443/",
    "username": ".\\administrator",
    "password": "your_secure_password"
  },
  "vone": {
    "url": "https://veeam-one.yourdomain.com:1239/",
    "username": ".\\administrator",
    "password": "your_secure_password"
  }
}

Important: Lock down the credentials file:

chmod 600 ~/.veeam-mcp-creds.json

Username Format

• Local accounts: Use ".\\username" format
• Domain accounts: Use "DOMAIN\\username" or "[e-mail]"
• Escape backslashes: Single backslash in JSON: ".\\" not ".\\\\"

Enable Veeam Intelligence

For live data queries (Advanced Mode), enable Veeam Intelligence on your Veeam servers:

Veeam Backup & Replication:

1. Open Veeam B&R console
2. Go to Options → Veeam Intelligence Settings
3. Enable the AI assistant

Veeam ONE:

1. Open Veeam ONE console
2. Find Veeam Intelligence settings
3. Enable the feature

Without this, queries will only return documentation (Basic Mode).

Usage

Natural Language (OpenClaw)

Just ask naturally:

"What Veeam backup jobs failed yesterday?"
"Show me backup repository capacity"
"Check Veeam ONE alerts"
"Which VMs haven't been backed up this week?"

Command Line Scripts

# Query VBR
./scripts/query-veeam.sh vbr "What backup jobs ran in the last 24 hours?"

# Query Veeam ONE
./scripts/query-veeam.sh vone "Show current alerts"

# Test connections
./scripts/test-connection.sh vbr
./scripts/test-connection.sh vone

# List available MCP tools
./scripts/list-tools.sh vbr

How It Works

User Question → OpenClaw Skill → Docker MCP Server → Veeam API
                                        ↓
                               Veeam Intelligence
                                        ↓
                                 JSON Response

1. Docker Container: MCP server runs in isolated container
2. STDIO Transport: Communicates via standard input/output
3. Credential Injection: Env vars passed securely from credentials file
4. Natural Language: Veeam Intelligence processes queries with AI

Troubleshooting

Connection Test Fails

# Check credentials file
cat ~/.veeam-mcp-creds.json | jq .

# Test Docker image
docker run -i --rm veeam-intelligence-mcp-server

# Manual connection test
echo '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}},"id":1}' | \
  docker run -i --rm \
    -e PRODUCT_NAME=vbr \
    -e WEB_URL=https://your-server:443/ \
    -e ADMIN_USERNAME='.\administrator' \
    -e ADMIN_PASSWORD='yourpassword' \
    -e ACCEPT_SELF_SIGNED_CERT=true \
    veeam-intelligence-mcp-server

Basic Mode (Documentation Only)

If responses say "Basic mode is active", enable Veeam Intelligence on your servers.

Username Format Issues

• Try .\\username (local account)
• Try DOMAIN\\username (domain account)
• Ensure single backslash in JSON

Security Notes

• Credentials stored locally in ~/.veeam-mcp-creds.json (chmod 600)
• Docker container runs with non-root user
• HTTPS connections with self-signed cert acceptance
• No credentials exposed in logs or command history
• MCP server communicates via stdin/stdout only

References

• Veeam Intelligence MCP Server: Contact Veeam for beta access
• Model Context Protocol
• Veeam Intelligence Documentation

License

This skill is provided as-is. Veeam Intelligence MCP server is licensed separately.

---

Need Help? Open an issue on GitHub or ask in the OpenClaw Discord.