Proxy AIops

Governed, audited AI-ops for Traefik, Caddy and HAProxy reverse proxies / load balancers — for AI agents (via MCP) and humans (via CLI).

Disclaimer: Community-maintained open-source project. Not affiliated with, endorsed by, or sponsored by Traefik Labs, the Caddy project, HAProxy Technologies, or the HAProxy project. Traefik, Caddy and HAProxy are trademarks of their respective owners. MIT licensed.

proxy-aiops speaks to three proxy platforms behind one MCP server — Traefik (its API under /api/..., metrics-text counters via /metrics), Caddy (the admin API, default localhost:2019) and HAProxy (the Data Plane API v2 under /v2/..., HTTP Basic auth) — with the same tools working on all three. Each target in the config names its own platform; a name-keyed platform registry selects the API shape (auth + resource paths), and an explicit support matrix raises teaching errors for ops a platform genuinely cannot do — e.g. Traefik writes point you at its providers (file, container labels, orchestrator CRDs), never a silent no-op.

Every tool runs through a built-in governance harness (vendored, zero external dependency): audit log, token/call budget with runaway circuit-breaker, graduated risk-tier approval, undo-token recording, and output sanitisation.

Why this exists

• One server, three proxies — Traefik, Caddy and HAProxy in a mixed edge, spoken to through identical tool names. Adding another proxy later is a new platform descriptor, not a rewrite.
• Read the whole edge — version, entrypoints/listeners, routes (routers / caddy routes / frontends) with parsed hosts+paths, services and server-level upstream health, middlewares, TLS domain inventory, traffic/error counters, and the live config tree (snapshot + search).
• Flagship RCA analyses — transparent heuristics that show their numbers, never a black-box verdict: backend_health_rca (down upstreams → cause class L4/L6/L7/DNS/maint + action), cert_expiry_sweep (days-to-expiry buckets + per-platform renewal hints), error_rate_rca (5xx share vs the fleet baseline, dominant code → 502/503/504/500 cause), and route_conflict_analysis (shadowed routes, dead routes, redirect loops).
• Governed writes — caddy config set / delete / full load (the prior subtree/config is fetched first, so the recorded undo replays a real restore) and haproxy runtime server state (ready/drain/maint) and weight (undo restores the prior value) — all with dry_run previews; delete/load are risk=high behind an approver gate.

Security: read-only mode

This tool is meant to be handed to an AI agent, so its safety story is enforced by the server rather than requested in a prompt:

export PROXY_READ_ONLY=1

With that set, the 6 write tools are never registered. An MCP client lists 22 tools instead of 28 — the writes are not hidden, not gated behind a flag, and not merely refused when called. They are absent from the session. A model cannot invoke a tool it was never offered, and cannot be argued into one.

That distinction is the whole point. A tool that exists but refuses still invites retry loops and "I'll describe the call instead" behaviour from smaller models, and it leaves a reviewer trusting a promise. An absent tool is a fact you can check: connect, list the tools, and see that the writes are not there.

Enforcement is two layers deep, so the switch cannot be sidestepped by changing entry point:

Read operations are unaffected, and every call is still audited to ~/.proxy-aiops/audit.db.

The read/write split is derived from each tool's declared risk_level, and a test asserts that this never disagrees with the [READ]/[WRITE] tag in the tool's own documentation — so a write can't quietly present itself as a read.

Running a smaller / local model? See agent-guardrails.md — it lists the guardrails this tool now enforces for you (so you don't spend prompt budget restating them) and gives a ready-made system prompt for what's left.

Tool inventory (28 tools)

Reversible writes record an inverse undo descriptor built from the real fetched before-state (set_config_value restores the prior subtree; delete_config_path re-creates it; load_config re-loads the snapshotted config; server state/weight restore the prior value). The undo params match each tool's own signature, so the descriptor replays as-is.

Per-platform support matrix

Unsupported combinations raise a teaching error that says what to use instead — never a silent empty result.

Install

uv tool install proxy-aiops        # or: pipx install proxy-aiops

Quick start

proxy-aiops init                     # wizard: pick platform (traefik/caddy/haproxy) + optional encrypted secret
proxy-aiops doctor                   # verify config, secrets, and connectivity
proxy-aiops overview                 # one-shot: version + route/service counts + upstream health
proxy-aiops routes list              # normalised route table
proxy-aiops services upstreams       # server-level upstream health
proxy-aiops analyze health           # backend/upstream health RCA
proxy-aiops analyze errors           # 5xx error-rate RCA
proxy-aiops analyze conflicts        # shadowed/dead routes, redirect loops
proxy-aiops certs --sweep            # TLS cert expiry sweep (traefik/caddy)
proxy-aiops server state app web1 drain --dry-run   # governed haproxy write preview
proxy-aiops config set apps/http/servers/srv0 '{"listen":[":8080"]}' --dry-run

Run the MCP server (stdio) for an agent:

proxy-aiops mcp                      # or: proxy-aiops-mcp

MCP client config

{
  "mcpServers": {
    "proxy-aiops": {
      "command": "uvx",
      "args": ["--from", "proxy-aiops", "proxy-aiops-mcp"],
      "env": { "PROXY_AIOPS_MASTER_PASSWORD": "your-master-password" }
    }
  }
}

Env-block caveat: the env block is only needed when a credential is stored (haproxy always; traefik/caddy only behind Basic auth). MCP clients do not inherit your shell profile — set PROXY_AIOPS_MASTER_PASSWORD (and PROXY_AIOPS_CONFIG / PROXY_AIOPS_HOME if you relocated them) explicitly in the client config, or the server cannot unlock secrets.enc.

Configuration

~/.proxy-aiops/config.yaml (non-secret connection details only):

targets:
  - name: edge1
    platform: traefik        # traefik | caddy | haproxy
    base_url: http://192.0.2.10:8080
    verify_ssl: true
  - name: caddy1
    platform: caddy
    base_url: http://127.0.0.1:2019
  - name: lb1
    platform: haproxy
    base_url: http://192.0.2.20:5555
    username: dpapi          # Data Plane API user

The secret — the HAProxy Data Plane API password, or an optional Basic-auth password in front of Traefik/Caddy — is stored encrypted in ~/.proxy-aiops/secrets.enc (Fernet + scrypt-derived key), never plaintext on disk. Traefik and Caddy commonly run unauthenticated on localhost, so their secret is optional (like a local socket); HAProxy's is required. Set it with proxy-aiops secret set <target> or the init wizard. The store is unlocked by a master password from PROXY_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var PROXY_<TARGET>_SECRET is honoured as a fallback (migrate with proxy-aiops secret migrate).

Governance

Every MCP tool is wrapped by @governed_tool:

• Audit — every call is logged to ~/.proxy-aiops/audit.db (tool, params with secrets redacted, status, duration, risk tier, approver, rationale).
• Budget / runaway guard — per-process token/call caps and a repeat-call circuit breaker (PROXY_MAX_TOOL_CALLS, PROXY_RUNAWAY_MAX, …).
• Graduated risk tiers — secure by default — with no ~/.proxy-aiops/rules.yaml, high-risk writes (delete_config_path, load_config) require an approver: set PROXY_AUDIT_APPROVED_BY (and PROXY_AUDIT_RATIONALE) before they will run. init seeds a starter rules.yaml; an operator-authored rules file is honoured as-is.
• Undo recording — reversible writes record an inverse descriptor to ~/.proxy-aiops/undo.db from the fetched before-state (recording only; an external orchestrator executes it). Undo params match the target tool's own signature, so the descriptor replays as-is.
• Sanitisation — all proxy-returned text is bounded + control-character sanitised before it reaches the agent.

Platform support & verification status

• Platforms: Traefik (API + /metrics), Caddy (admin API), HAProxy (Data Plane API v2).
• Test coverage: behaviour is validated against mocked JSON/metrics responses — every module imports, every MCP tool carries the governance marker, the four flagship analyses are unit-tested against synthetic telemetry, the support matrix is asserted to raise teaching errors (never a silent no-op), and reversible writes are asserted to record the correct inverse undo descriptor. The concrete REST paths are modelled from each project's public API and have not yet been exercised against a live proxy. See docs/VERIFICATION.md for the checklist a live run must satisfy. All three platforms are free and self-hostable (a small container-compose lab with traefik + caddy + haproxy/dataplaneapi is a one-evening setup), and proxy-aiops doctor — a health/info probe per platform — is the fastest live check.
• Routing note: this tool operates reverse proxies / load balancers. Do NOT use it for firewall rules — use firewall-aiops.
• Missing a capability? Open an issue or PR at github.com/AIops-tools/Proxy-AIops — contributions and feedback welcome.

License

MIT — see LICENSE.