Name: Commvault
Author: Commvault

LABSCO SUMMARY

Backup operations, with an unusually frank note on the risk of running it beside other servers.

The functional draw is job control and SLA in one place, and the Salesforce path is genuinely rare — browsing backed-up records with a WHERE filter, not just confirming a backup ran. The security section is worth reading before deployment: it spells out that MCP gives no isolation between servers in a session, so a hostile server's tool descriptions can steer an agent toward the stored Commvault token, and recommends an isolated session for that reason.

What it is

An MCP server for Commvault environments. It gives an agent access to job details and control, commcell metrics, client and storage information, user permissions, plan configuration and backup schedules, with optional integrations for browsing DocuSign and Salesforce backups.

What you get

Jobs — view details and history, control jobs by suspending, resuming, resubmitting or killing them, and monitor status and performance
Commcell — SLA status and compliance, security posture and scores, storage space utilisation, commcell details and entity counts
Estate — client groups and clients, subclients and client properties, storage policies and pools, users and user groups with their security associations, plan configurations, and backup schedules
Salesforce backups behind ENABLE_SALESFORCE_TOOLS=true — get_salesforce_client resolves a 15- or 18-character org ID to a Commvault clientId, and get_salesforce_records fetches backed-up records for an object such as Account or Contact from the latest snapshot, with limit defaulting to 50 and capped at 1000, offset, and an optional free_query WHERE filter
DocuSign backups behind ENABLE_DOCUSIGN_TOOLS=true — set up the vault and workflow, back up completed envelopes to a Commvault S3 vault, then list and restore them

Requirements

Python 3.11 or higher and uv. Clone the repo and run uv run setup.py, which walks through Metallic or on-premise deployment, transport mode (stdio, streamable-http or sse), server connection details, and the authentication method. Two auth options: OAuth, which needs Commvault SP42 CU 27 or above with OAuth configured in the CommServe and a redirect URI of OAUTH_BASE_URL/auth/callback; or token-based auth with an access token, a refresh token and your own secret, stored in an OS-native keyring — Windows Credential Manager, macOS Keychain, or Secret Service or KWallet on Linux. Start with uv run -m src.server, or build the Docker image, which runs OAuth mode only. Running more than one install under the same OS user requires a unique MCP_INSTANCE_ID per install, or each setup.py run overwrites the other's keyring entries and you get 401 Invalid token after a restart. Behind a proxy, set TRUSTED_PROXY_IPS. Apache License.

Setup effort

Build from source — git clone https://github.com/Commvault/commvault-mcp-server.git

See installation options

USE CASES

01

Finding out why last night's backup did not finish

Look at the job's details and history, then resume or resubmit it from the conversation.

02

Reporting on SLA compliance

Pull SLA status, security scores and storage utilisation for the commcell in one pass.

03

Recovering a Salesforce record from a backup

Resolve the org ID to a Commvault client, then read the backed-up records for that object with a filter.

get_salesforce_clientget_salesforce_records

04

Auditing who can do what

List users and groups with their security associations alongside the plans they are covered by.

55 tools

Listed in project docs. Your client may show a different list.

`get_job_detail`

Gets complete details about a job for a given job id.

BEFORE YOU INSTALL

What to know first

Tools you get

55 tools named in the project's documentation.

Requires

Python 3.11 or later
uv
A Commvault environment: an access token and refresh token, or OAuth on SP42 CU 27 or above
Node.js for npx, with token-based authentication

Where it runs

All 3 documented setups run the server on your machine.

INSTALLATION

Connect your client

This one is built from source rather than installed with a single command.

Server setup

TERMINAL

git clone https://github.com/Commvault/commvault-mcp-server.git
cd commvault-mcp-server
uv run setup.py

The setup script asks for Metallic or on-premise, the transport (stdio, streamable-http or sse), the host and port for the remote modes, and the authentication method. With token-based authentication it generates a server secret, stores it in the OS keyring and prints it once ("Copy this server secret for your LLM configuration"); the secret expires after 30 days.

Start the server:

TERMINAL

uv run -m src.server

Docker instead (OAuth mode only): choose OAuth in uv run setup.py so it writes .env, then docker build -t commvault-mcp-server . and docker run --rm -p 9090:9090 --env-file .env commvault-mcp-server

MCP Clients

Any MCP client — streamable HTTP

<YOUR_SERVER_URL>/mcp is your server's address: the README puts the server behind a TLS reverse proxy for production. After Authorization:, paste the server secret uv run setup.py printed.

ANY MCP CLIENT — STREAMABLE HTTP · JSON

{
  "mcpServers": {
    "Commvault": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "<YOUR_SERVER_URL>/mcp",
        "--header",
        "Authorization: <YOUR_SERVER_SECRET>"
      ]
    }
  }
}

Any MCP client — Windows

Windows. <YOUR_SERVER_URL>/mcp is your server's address: the README puts the server behind a TLS reverse proxy for production. After Authorization:, paste the server secret uv run setup.py printed.

ANY MCP CLIENT — WINDOWS · JSON

{
  "mcpServers": {
    "Commvault": {
      "command": "cmd",
      "args": [
        "/c",
        "npx",
        "mcp-remote",
        "<YOUR_SERVER_URL>/mcp",
        "--header",
        "Authorization: <YOUR_SERVER_SECRET>"
      ]
    }
  }
}

Any MCP client — plain HTTP

For a server you reach over plain HTTP, such as on your own network. The address is the MCP_HOST, MCP_PORT and MCP_PATH you gave uv run setup.py (the path defaults to /mcp; .env.example uses port 8000). After Authorization:, paste the server secret uv run setup.py printed.

ANY MCP CLIENT — PLAIN HTTP · JSON

{
  "mcpServers": {
    "Commvault": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://HOST:PORT/mcp",
        "--header",
        "Authorization: <YOUR_SERVER_SECRET>",
        "--allow-http"
      ]
    }
  }
}

Commvault

Backup operations, with an unusually frank note on the risk of running it beside other servers.

What it is

What you get

Requirements

Setup effort

Finding out why last night's backup did not finish

Reporting on SLA compliance

Recovering a Salesforce record from a backup

Auditing who can do what

55 tools

get_job_detail

suspend_job

resume_job

resubmit_job

kill_job

get_jobs_list

get_failed_jobs

get_job_task_details

get_retention_info_of_a_job

create_send_logs_job_for_a_job

get_client_group_list

get_client_list

get_client_group_properties

get_clientid_from_clientname

get_subclient_list

get_subclient_properties

run_backup_for_subclient

get_schedules_list

get_schedule_properties

enable_schedule

disable_schedule

get_storage_policy_list

get_storage_policy_properties

get_storage_policy_copy_details

get_storage_policy_copy_size

get_library_list

get_library_properties

get_storage_pool_list

get_mediaagent_list

get_plan_list

get_plan_properties

get_sla_status

get_security_posture

get_security_score

get_storage_space_utilization

create_send_logs_job_for_commcell

get_commcell_details

get_entity_counts

get_users_list

get_user_properties

set_user_enabled

get_user_groups_list

get_user_group_properties

get_associated_entities_for_user_or_group

view_entity_permissions

get_roles_list

get_my_user_info

setup_docusign_backup_vault

trigger_docusign_backup

schedule_docusign_backup

list_backedup_docusign_envelopes

recover_docusign_envelope

get_docusign_jobs

get_salesforce_client

get_salesforce_records

What to know first

Tools you get

Requires

Where it runs

Connect your client

Server setup

MCP Clients

Any MCP client — streamable HTTP

Any MCP client — Windows

Any MCP client — plain HTTP

Same category

Ambari-API MCP

Confluent Cloud

DataWorks

`get_job_detail`

`suspend_job`

`resume_job`

`resubmit_job`

`kill_job`

`get_jobs_list`

`get_failed_jobs`

`get_job_task_details`

`get_retention_info_of_a_job`

`create_send_logs_job_for_a_job`

`get_client_group_list`

`get_client_list`

`get_client_group_properties`

`get_clientid_from_clientname`

`get_subclient_list`

`get_subclient_properties`

`run_backup_for_subclient`

`get_schedules_list`

`get_schedule_properties`

`enable_schedule`

`disable_schedule`

`get_storage_policy_list`

`get_storage_policy_properties`

`get_storage_policy_copy_details`

`get_storage_policy_copy_size`

`get_library_list`

`get_library_properties`

`get_storage_pool_list`

`get_mediaagent_list`

`get_plan_list`

`get_plan_properties`

`get_sla_status`

`get_security_posture`

`get_security_score`

`get_storage_space_utilization`

`create_send_logs_job_for_commcell`

`get_commcell_details`

`get_entity_counts`

`get_users_list`

`get_user_properties`

`set_user_enabled`

`get_user_groups_list`

`get_user_group_properties`

`get_associated_entities_for_user_or_group`

`view_entity_permissions`

`get_roles_list`

`get_my_user_info`

`setup_docusign_backup_vault`

`trigger_docusign_backup`

`schedule_docusign_backup`

`list_backedup_docusign_envelopes`

`recover_docusign_envelope`

`get_docusign_jobs`

`get_salesforce_client`

`get_salesforce_records`