Minio Aiops
Governed MinIO ops: capacity RCA, exposure audit, ILM, WORM retention, IAM, healing, 48 tools.
- Transport
- Not stated
- Package
- —
- Registry id
- io.github.AIops-tools/minio-aiops
No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.
Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by MinIO, Inc. or any storage vendor. Product and trademark names belong to their owners. MIT licensed.
Governed AI-ops for MinIO object storage — for the homelab and small/medium
self-hosted deployments where MinIO actually lives. Talks to the S3 API
(official minio SDK, SigV4), the admin API (bucket quota, server info),
the unauthenticated health endpoints (/minio/health/live|ready|cluster),
and the cluster metrics endpoint (/minio/v2/metrics/cluster, bearer-token
or public auth) — with a built-in governance harness: a unified audit log,
a token/runaway budget guard, undo-token recording, and a descriptive risk
tier on every audit row. Self-contained: no external skill-family dependency.
What it does
Four flagship analyses, plus the guarded reads and writes around them:
capacity_rca— capacity vs used, offline drives/nodes, per-drive hotspots and imbalance → each finding as cause + suggested action (nearfull/full thresholds are named constants, not magic).bucket_exposure_audit— every bucket scored and ranked for anonymous/public policy statements (read and, far worse, write), missing default encryption, versioning off, no lifecycle.lifecycle_gap_analysis— the storage ILM should be reclaiming but isn't: versioned buckets with no noncurrent expiry (old bytes accrue forever), incomplete multipart uploads with no abort rule (invisible space), large buckets with no lifecycle — with a clearly-labelled reclaimable estimate.healing_health— heal backlog and per-erasure-set write-quorum risk: how many more drive failures each set can tolerate, which sets are healing, where heal errors are piling up.- Governed writes. Bucket policy / versioning / lifecycle / quota changes
capture the real prior state and record an undo descriptor;
bucket_deleteis refused unless the bucket is verifiably empty (including versions and delete markers) andremove_incomplete_uploadsonly touches uploads older than a safety window.
What works
- CLI (
minio-aiops ...):init,overview,doctor,health check/status,capacity rca/usage,heal status/drives/nodes,bucket ls/info/objects/audit/ilm-gap/uploadsplus guarded writes (bucket versioning-set/policy-set/lifecycle-set/quota-set/purge-uploads/delete),secret set/list/rm/migrate/rotate-password,mcp. Destructive commands take--dry-runand double-confirm. - MCP server (
minio-aiops mcporminio-aiops-mcp): the full 48 tools (29 read, 19 write), every one wrapped with the bundled@governed_toolharness. The CLI is a convenience subset; the MCP surface is the whole tool. CLI writes delegate to the same governed functions, so they are audited identically. - Encrypted credentials: the secret key lives in an encrypted store
~/.minio-aiops/secrets.enc(Fernet + scrypt) — never plaintext on disk. Unlock with a master password fromMINIO_AIOPS_MASTER_PASSWORD(MCP/CI) or an interactive prompt (CLI). - Metrics auth, both modes: servers running
MINIO_PROMETHEUS_AUTH_TYPE=publicare scraped directly; for the default (jwt) mode the bearer token is derived from the stored credentials — no extra secret to manage. - Reversibility: reversible writes capture prior state and record an inverse undo descriptor (prior policy JSON, prior lifecycle XML, prior versioning state, prior quota).
Capability matrix (48 MCP tools)
From the project's README.