Zsnoop MCP Server
ZFS snapshot exploration and recovery for AI assistants via persistent SSH.
Data last scanned today · Reviewed today
Overview
Zsnoop MCP Server provides an interface for interacting with ZFS snapshots directly through your AI assistant. It enables users to browse, search, and recover files from remote ZFS hosts without requiring permanent software installation on the remote machine, using only Python 3.11+ and the native ZFS CLI over SSH. The server operates in a read-only mode by default for safety. While version 0.4.0 introduced writable restore capabilities for files and directories, these are strictly opt-in per host and restricted by a mandatory, operator-defined path allowlist. Configuration is handled locally through a simple TOML file, defining your SSH targets and permissions.
Our verdict
With a security score of 38/100, this tool is considered high risk. The score reflects that the server is community-maintained rather than vendor-official and has not undergone an independent editorial security review. While the project implements thoughtful design choices like read-only defaults and path-based allowlists for its restore tools, users should exercise caution. It is suitable for advanced users who can manually audit the repository and configuration before deployment on critical storage systems.
- Read-only by default for secure snapshot exploration.
- Zero direct dependencies reduce potential supply-chain vulnerabilities.
- No agent installation required on remote target hosts.
- Uses operator-defined allowlists to gate writable operations.
- High risk level due to lack of independent security review.
- Community-maintained project without official vendor backing.
- Limited community engagement with only one GitHub star.
Tools
| Tool | Description | Risk |
|---|---|---|
| list_hosts | Configured hosts | low |
| agent_info | Agent version, methods, limits | low |
| list_pools | ZFS pools visible to the agent (live discovery) | low |
| pool_status | Parsed zpool status: vdev tree, scrub, errors | low |
| list_datasets | Filesystems and volumes | low |
| dataset_properties | zfs get (all or filtered) with values + sources | low |
| list_snapshots | Snapshots (optional dataset/time/cap filters) | low |
| snapshot_cadence | Summary: counts by class, gap (per-dataset), span | low |
| stale_snapshots | Snapshots older than a time phrase, sorted by uniqueness | low |
| size_delta | Bytes written between two snapshots of one dataset | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the remote host requirements for the ZFS snoop agent?
The remote host requires Python 3.11 or higher and the zfs command-line tool installed.
›Is the server read-only by default?
Yes, the server is read-only by default. Write operations like restoring files or directories are opt-in and must be explicitly enabled per host in the configuration.
›How are write permissions controlled?
The writable restore tools are gated by an operator-defined path allowlist in the host configuration. Without a non-empty path allowlist, these tools will refuse to perform any write operations.
›Do I need to install software permanently on the remote host?
No, you do not need to install anything permanently. The agent can be streamed over SSH standard input on each connection, though it can also be pre-installed as a single-file script at ~/bin/zfs-snoop-agent.
Alternatives
Changelog
Badge
Maintain this server? Add the live badge to your README.