mirror of
https://github.com/jmagar/unraid-mcp.git
synced 2026-03-01 16:04:24 -08:00
Addresses all critical, high, medium, and low issues from full codebase review. 494 tests pass, ruff clean, ty type-check clean. Security: - Add tool_error_handler context manager (exceptions.py) — standardised error handling, eliminates 11 bare except-reraise patterns - Remove unused exception subclasses (ConfigurationError, UnraidAPIError, SubscriptionError, ValidationError, IdempotentOperationError) - Harden GraphQL subscription query validator with allow-list and forbidden-keyword regex (diagnostics.py) - Add input validation for rclone create_remote config_data: injection, path-traversal, and key-count limits (rclone.py) - Validate notifications importance enum before GraphQL request (notifications.py) - Sanitise HTTP/network/JSON error messages — no raw exception strings leaked to clients (client.py) - Strip path/creds from displayed API URL via _safe_display_url (health.py) - Enable Ruff S (bandit) rule category in pyproject.toml - Harden container mutations to strict-only matching — no fuzzy/substring for destructive operations (docker.py) Performance: - Token-bucket rate limiter (90 tokens, 9 req/s) with 429 retry backoff (client.py) - Lazy asyncio.Lock init via _get_client_lock() — fixes event-loop module-load crash (client.py) - Double-checked locking in get_http_client() for fast-path (client.py) - Short hex container ID fast-path skips list fetch (docker.py) - Cap resource_data log content to 1 MB / 5,000 lines (manager.py) - Reset reconnect counter after 30 s stable connection (manager.py) - Move tail_lines validation to module level; enforce 10,000 line cap (storage.py, docker.py) - force_terminal=True removed from logging RichHandler (logging.py) Architecture: - Register diagnostic tools in server startup (server.py) - Move ALL_ACTIONS computation to module level in all tools - Consolidate format_kb / format_bytes into shared core/utils.py - Add _safe_get() helper in core/utils.py for nested dict traversal - Extract _analyze_subscription_status() from health.py diagnose handler - Validate required config at startup — fail fast with CRITICAL log (server.py) Code quality: - Remove ~90 lines of dead Rich formatting helpers from logging.py - Remove dead self.websocket attribute from SubscriptionManager - Remove dead setup_uvicorn_logging() wrapper - Move _VALID_IMPORTANCE to module level (N806 fix) - Add slots=True to all three dataclasses (SubscriptionData, SystemHealth, APIResponse) - Fix None rendering as literal "None" string in info.py summaries - Change fuzzy-match log messages from INFO to DEBUG (docker.py) - UTC-aware datetimes throughout (manager.py, diagnostics.py) Infrastructure: - Upgrade base image python:3.11-slim → python:3.12-slim (Dockerfile) - Add non-root appuser (UID/GID 1000) with HEALTHCHECK (Dockerfile) - Add read_only, cap_drop: ALL, tmpfs /tmp to docker-compose.yml - Single-source version via importlib.metadata (pyproject.toml → __init__.py) - Add open_timeout to all websockets.connect() calls Tests: - Update error message matchers to match sanitised messages (test_client.py) - Fix patch targets for UNRAID_API_URL → utils module (test_subscriptions.py) - Fix importance="info" → importance="normal" (test_notifications.py, http_layer) - Fix naive datetime fixtures → UTC-aware (test_subscriptions.py) Co-authored-by: Claude <claude@anthropic.com>
162 lines
5.5 KiB
Python
162 lines
5.5 KiB
Python
"""Virtual machine management.
|
|
|
|
Provides the `unraid_vm` tool with 9 actions for VM lifecycle management
|
|
including start, stop, pause, resume, force stop, reboot, and reset.
|
|
"""
|
|
|
|
from typing import Any, Literal
|
|
|
|
from fastmcp import FastMCP
|
|
|
|
from ..config.logging import logger
|
|
from ..core.client import make_graphql_request
|
|
from ..core.exceptions import ToolError, tool_error_handler
|
|
|
|
|
|
QUERIES: dict[str, str] = {
|
|
"list": """
|
|
query ListVMs {
|
|
vms { id domains { id name state uuid } }
|
|
}
|
|
""",
|
|
# NOTE: The Unraid GraphQL API does not expose a single-VM query.
|
|
# The details query is identical to list; client-side filtering is required.
|
|
"details": """
|
|
query ListVMs {
|
|
vms { id domains { id name state uuid } }
|
|
}
|
|
""",
|
|
}
|
|
|
|
MUTATIONS: dict[str, str] = {
|
|
"start": """
|
|
mutation StartVM($id: PrefixedID!) { vm { start(id: $id) } }
|
|
""",
|
|
"stop": """
|
|
mutation StopVM($id: PrefixedID!) { vm { stop(id: $id) } }
|
|
""",
|
|
"pause": """
|
|
mutation PauseVM($id: PrefixedID!) { vm { pause(id: $id) } }
|
|
""",
|
|
"resume": """
|
|
mutation ResumeVM($id: PrefixedID!) { vm { resume(id: $id) } }
|
|
""",
|
|
"force_stop": """
|
|
mutation ForceStopVM($id: PrefixedID!) { vm { forceStop(id: $id) } }
|
|
""",
|
|
"reboot": """
|
|
mutation RebootVM($id: PrefixedID!) { vm { reboot(id: $id) } }
|
|
""",
|
|
"reset": """
|
|
mutation ResetVM($id: PrefixedID!) { vm { reset(id: $id) } }
|
|
""",
|
|
}
|
|
|
|
# Map action names to GraphQL field names (only where they differ)
|
|
_MUTATION_FIELDS: dict[str, str] = {
|
|
"force_stop": "forceStop",
|
|
}
|
|
|
|
DESTRUCTIVE_ACTIONS = {"force_stop", "reset"}
|
|
|
|
VM_ACTIONS = Literal[
|
|
"list",
|
|
"details",
|
|
"start",
|
|
"stop",
|
|
"pause",
|
|
"resume",
|
|
"force_stop",
|
|
"reboot",
|
|
"reset",
|
|
]
|
|
|
|
ALL_ACTIONS = set(QUERIES) | set(MUTATIONS)
|
|
|
|
|
|
def register_vm_tool(mcp: FastMCP) -> None:
|
|
"""Register the unraid_vm tool with the FastMCP instance."""
|
|
|
|
@mcp.tool()
|
|
async def unraid_vm(
|
|
action: VM_ACTIONS,
|
|
vm_id: str | None = None,
|
|
confirm: bool = False,
|
|
) -> dict[str, Any]:
|
|
"""Manage Unraid virtual machines.
|
|
|
|
Actions:
|
|
list - List all VMs with state
|
|
details - Detailed info for a VM (requires vm_id: UUID, PrefixedID, or name)
|
|
start - Start a VM (requires vm_id)
|
|
stop - Gracefully stop a VM (requires vm_id)
|
|
pause - Pause a VM (requires vm_id)
|
|
resume - Resume a paused VM (requires vm_id)
|
|
force_stop - Force stop a VM (requires vm_id, confirm=True)
|
|
reboot - Reboot a VM (requires vm_id)
|
|
reset - Reset a VM (requires vm_id, confirm=True)
|
|
"""
|
|
if action not in ALL_ACTIONS:
|
|
raise ToolError(f"Invalid action '{action}'. Must be one of: {sorted(ALL_ACTIONS)}")
|
|
|
|
if action != "list" and not vm_id:
|
|
raise ToolError(f"vm_id is required for '{action}' action")
|
|
|
|
if action in DESTRUCTIVE_ACTIONS and not confirm:
|
|
raise ToolError(f"Action '{action}' is destructive. Set confirm=True to proceed.")
|
|
|
|
with tool_error_handler("vm", action, logger):
|
|
try:
|
|
logger.info(f"Executing unraid_vm action={action}")
|
|
|
|
if action == "list":
|
|
data = await make_graphql_request(QUERIES["list"])
|
|
if data.get("vms"):
|
|
vms = data["vms"].get("domains") or data["vms"].get("domain") or []
|
|
if isinstance(vms, dict):
|
|
vms = [vms]
|
|
return {"vms": vms}
|
|
return {"vms": []}
|
|
|
|
if action == "details":
|
|
data = await make_graphql_request(QUERIES["details"])
|
|
if not data.get("vms"):
|
|
raise ToolError("No VM data returned from server")
|
|
vms = data["vms"].get("domains") or data["vms"].get("domain") or []
|
|
if isinstance(vms, dict):
|
|
vms = [vms]
|
|
for vm in vms:
|
|
if (
|
|
vm.get("uuid") == vm_id
|
|
or vm.get("id") == vm_id
|
|
or vm.get("name") == vm_id
|
|
):
|
|
return dict(vm)
|
|
available = [f"{v.get('name')} (UUID: {v.get('uuid')})" for v in vms]
|
|
raise ToolError(f"VM '{vm_id}' not found. Available: {', '.join(available)}")
|
|
|
|
# Mutations
|
|
if action in MUTATIONS:
|
|
data = await make_graphql_request(MUTATIONS[action], {"id": vm_id})
|
|
field = _MUTATION_FIELDS.get(action, action)
|
|
if data.get("vm") and field in data["vm"]:
|
|
return {
|
|
"success": data["vm"][field],
|
|
"action": action,
|
|
"vm_id": vm_id,
|
|
}
|
|
raise ToolError(f"Failed to {action} VM or unexpected response")
|
|
|
|
raise ToolError(f"Unhandled action '{action}' — this is a bug")
|
|
|
|
except ToolError:
|
|
raise
|
|
except Exception as e:
|
|
if "VMs are not available" in str(e):
|
|
raise ToolError(
|
|
"VMs not available on this server. Check VM support is enabled."
|
|
) from e
|
|
raise
|
|
|
|
logger.info("VM tool registered successfully")
|