Higress OPSSAFE
A Model Context Protocol (MCP) server implementation that enables comprehensive configuration and management of Higress.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server implementation that enables comprehensive configuration and management of Higress. This repository also provides an MCP client built on top of LangGraph and LangChain MCP Adapters, facilitating interaction with the Higress MCP Server through a well-designed agent flow architecture.
Demo
https://github.com/user-attachments/assets/bae66b77-a158-452e-9196-98060bac0df7
Config Environment Variables
Copy the .env.example file to .env and fill in the corresponding values.
Start MCP Client and MCP Server
In stdio mode, the MCP server process is started by the MCP client program. Run the following command to start the MCP client and MCP server:
uv run client.py
Add a new tool
Step 1: Create a new tool class or extend an existing one
- Create a new file in the tools directory if adding a completely new tool category
- Or add your tool to an existing class if it fits an existing category
from typing import Dict, List, Any from fastmcp import FastMCP class YourTools: def register_tools(self, mcp: FastMCP): @mcp.tool() async def your_tool_function(arg1: str, arg2: int) -> List[Dict]: """ Your tool description. Args: arg1: Description of arg1 arg2: Description of arg2 Returns: Description of the return value Raises: ValueError: If the request fails """ # Implementation using self.higress_client to make API calls return self.higress_client.your_api_method(arg1, arg2)
Step 2: Add a new method to HigressClient if your tool needs to interact with the Higress Console API
- Add methods to utils/higress_client.py that encapsulate API cal
0d6ec18a6bc4OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add higress-mcp-server --env HIGRESS_PASSWORD=${HIGRESS_PASSWORD} -- uvx higress-mcp-server{
"mcpServers": {
"higress-mcp-server": {
"command": "uvx",
"args": [
"higress-mcp-server"
],
"env": {
"HIGRESS_PASSWORD": "${HIGRESS_PASSWORD}"
}
}
}
}Exposed tools (10)
5 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add_route | write | |
add_service_source | write | |
get_plugin | read | Get detailed information about a specific Higress plugin. |
get_route | read | |
get_service_source | read | |
list_routes | read | |
list_service_sources | read | |
update_request_block_plugin | write | |
update_route | write | |
update_service_source | write |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
Gates applied: no_behavioural_pass, no_license.
0d6ec18a6bc4full audit observations/trust-audit/mcp-server/higress-group__higress-ops.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 0d6ec18a6bc4 | SAFE | B | 89 | first audit |
Questions
What is the Higress OPS MCP server?
A Model Context Protocol (MCP) server implementation that enables comprehensive configuration and management of Higress.
What tools does Higress OPS expose?
10 in total: 5 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Higress OPS safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Higress OPS need?
It reads HIGRESS_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (0d6ec18a6bc4), read on 2026-10-10. The repository is watched and re-audited when it changes.