Model Context Protocol moderate risk

Victoriametrics

MCP server for VictoriaMetrics, enabling data ingestion, querying, and management via PromQL, with potential risks from write operations.

Connections & Capabilities

Connects To

GitHubTwitter

Capabilities

readwrite

Quickstart

Install

npx -y @smithery/cli install @yincongcyincong/victoriametrics-mcp-server --client claude

Config

{
    "mcpServers": {
        "victoriametrics": {
            "command": "npx",
            "args": [
                "-y",
                "@yincongcyincong/victoriametrics-mcp-server"
            ],
            "env": {
                "VM_URL": "",
                "VM_SELECT_URL": "",
                "VM_INSERT_URL": ""
            }
        }
    }
}

Exposed MCP Tools (6)

moderate

vm_data_write

Writes time series data to VictoriaMetrics.

Allows data injection, potentially overwriting or corrupting existing data.

moderate

vm_prometheus_write

Imports Prometheus exposition format data into VictoriaMetrics.

Enables importing potentially malicious or incorrect data.

safe

vm_query_range

Queries time series data over a specified time range.

Read-only operation; no data modification.

safe

vm_query

Queries the current value of a time series.

Read-only operation; no data modification.

safe

vm_labels

Retrieves all unique label names.

Read-only operation; no data modification.

safe

vm_label_values

Retrieves all unique values for a specific label.

Read-only operation; no data modification.

Safety Assessment

This MCP server provides both read and write access to a VictoriaMetrics database. While querying is generally safe, write operations pose a moderate risk if not properly controlled. Ensure proper input validation and resource limits to mitigate potential abuse.

Query operations are generally safe.
Clear separation of read and write operations.
PromQL limits query expressiveness, reducing potential for abuse.
No inherent code execution capabilities.

Write operations (vm_data_write, vm_prometheus_write) can impact data integrity and availability.
Lack of explicit RBAC in the provided documentation.
Potential for resource exhaustion through uncontrolled queries.
Environment variable-based authentication might be vulnerable if not properly managed.