Summary

Backup operations, with an unusually frank note on the risk of running it beside other servers.

The functional draw is job control and SLA in one place, and the Salesforce path is genuinely rare — browsing backed-up records with a WHERE filter, not just confirming a backup ran. The security section is worth reading before deployment: it spells out that MCP gives no isolation between servers in a session, so a hostile server's tool descriptions can steer an agent toward the stored Commvault token, and recommends an isolated session for that reason.

What it is

An MCP server for Commvault environments. It gives an agent access to job details and control, commcell metrics, client and storage information, user permissions, plan configuration and backup schedules, with optional integrations for browsing DocuSign and Salesforce backups.

What you get

Jobs — view details and history, control jobs by suspending, resuming, resubmitting or killing them, and monitor status and performance
Commcell — SLA status and compliance, security posture and scores, storage space utilisation, commcell details and entity counts
Estate — client groups and clients, subclients and client properties, storage policies and pools, users and user groups with their security associations, plan configurations, and backup schedules
Salesforce backups behind `ENABLE_SALESFORCE_TOOLS=true` — `get_salesforce_client` resolves a 15- or 18-character org ID to a Commvault `clientId`, and `get_salesforce_records` fetches backed-up records for an object such as Account or Contact from the latest snapshot, with `limit` defaulting to 50 and capped at 1000, `offset`, and an optional `free_query` WHERE filter
DocuSign backups behind `ENABLE_DOCUSIGN_TOOLS=true` — set up the vault and workflow, back up completed envelopes to a Commvault S3 vault, then list and restore them

Requirements

Python 3.11 or higher and `uv`. Clone the repo and run `uv run setup.py`, which walks through Metallic or on-premise deployment, transport mode (stdio, streamable-http or sse), server connection details, and the authentication method. Two auth options: OAuth, which needs Commvault SP42 CU 27 or above with OAuth configured in the CommServe and a redirect URI of `OAUTH_BASE_URL/auth/callback`; or token-based auth with an access token, a refresh token and your own secret, stored in an OS-native keyring — Windows Credential Manager, macOS Keychain, or Secret Service or KWallet on Linux. Start with `uv run -m src.server`, or build the Docker image, which runs OAuth mode only. Running more than one install under the same OS user requires a unique `MCP_INSTANCE_ID` per install, or each `setup.py` run overwrites the other's keyring entries and you get `401 Invalid token` after a restart. Behind a proxy, set `TRUSTED_PROXY_IPS`. Apache License.