OpsKeeper
Build

Plugins

Two plugins ship with OpsKeeper. Both are open source under the project license.

agentteams-plugin-installer

A Dashboard-side plugin that turns the AgentTeams Dashboard into the OpsKeeper plugin console. It exposes five extension points and an HTTP API for the file-system PluginRegistry.

Extension points

  • sidebar-menu — add a navigation entry
  • route — mount a plugin route
  • dashboard-widget — render a widget on the dashboard
  • detail-panel — attach a panel to a detail view
  • toolbar — add a toolbar action

Registry limits

  • 10 MB upload zip
  • 50 MB extracted size
  • 1000 files per package
  • Zip-slip protection on extraction

opskeeper-teamharness

The worker-side plugin. It exposes OpsKeeper's capabilities to any worker that speaks stdio MCP — Bearer + HMAC + W3C traceparent auth, 17 tools, FastAPI HTTP router for plugin lifecycle.

teamharness
# Build the plugin package
bash plugins/opskeeper-teamharness/scripts/build-package.sh

# Run the plugin tests
python3 -m unittest discover -s plugins/opskeeper-teamharness -p 'test_*.py'

# Serve the stdio MCP proxy
opskeeper-teamharness serve \
  --mcp-transport stdio \
  --opskeeper-endpoint http://localhost:8090 \
  --hmac-secret "$OPSKEEPER_PLUGIN_HMAC"

MCP tools

The 17 tools exposed by opskeeper-teamharness:

  • loop.investigate — trigger RCA on an incident
  • loop.correlate — correlate alerts into an incident
  • recovery.verify — independent recovery verification
  • recovery.execute — narrowly-authorized repair action
  • metric.query — query the metrics backend
  • incident.list / incident.get — incident memory
  • postgres.analyze_status — PostgreSQL status snapshot
  • host.get_load / host.get_processes / host.restart_service
  • knowledge.query / knowledge.write — knowledge vault
  • hitl.decide — human-in-the-loop decision
  • state.put / state.get — shared state
  • incident.record — append evidence / recovery signals to the timeline

Authentication

  • Bearer — short-lived JWT for the HTTP API.
  • HMAC — every plugin call is signed with the shared secret. The signature covers method, path, and body.
  • W3C traceparent — propagated across stdio MCP boundaries.

Verifying plugins

verify
make build-plugins
make test-plugins
make verify-plugins