apache-aiops 0.2.0__tar.gz

apache_aiops-0.2.0/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
+  "name": "apache-aiops",
+  "displayName": "Apache HTTP Server AIops",
+  "version": "0.2.0",
+  "description": "Governed Apache HTTP Server operations — 17 MCP tools with audit.",
+  "author": {
+    "name": "Wei Zhou",
+    "email": "zhouwei008@gmail.com",
+    "url": "https://github.com/AIops-tools"
+  },
+  "homepage": "https://github.com/AIops-tools/Apache-AIops",
+  "repository": "https://github.com/AIops-tools/Apache-AIops",
+  "license": "MIT",
+  "keywords": [
+    "apache",
+    "httpd",
+    "web-server",
+    "mcp",
+    "aiops"
+  ]
+}

apache_aiops-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [bootstrap, main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Install Python and dependencies
+        run: |
+          uv python install 3.11
+          uv sync --dev --python 3.11
+      - name: Tests
+        run: uv run pytest -q
+      - name: Lint
+        run: uv run ruff check .
+      - name: Security scan
+        run: uv run bandit -r apache_aiops -ll -q
+      - name: Build
+        run: uv build

apache_aiops-0.2.0/.github/workflows/mcp-publish.yml

@@ -0,0 +1,55 @@
+name: mcp-publish
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish-mcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Wait for PyPI
+        # The release event also triggers the PyPI publish workflow; the MCP
+        # registry validates that the package version exists on PyPI, so poll
+        # until it has propagated (every 15s, up to 10 minutes).
+        run: |
+          python3 - <<'EOF'
+          import json
+          import sys
+          import time
+          import urllib.error
+          import urllib.request
+
+          with open("server.json", encoding="utf-8") as f:
+              package = json.load(f)["packages"][0]
+          name, version = package["identifier"], package["version"]
+          url = f"https://pypi.org/pypi/{name}/{version}/json"
+          deadline = time.monotonic() + 600
+          while True:
+              try:
+                  with urllib.request.urlopen(url, timeout=10):
+                      print(f"{name}=={version} is available on PyPI.")
+                      sys.exit(0)
+              except (urllib.error.URLError, OSError) as exc:
+                  print(f"{name}=={version} not on PyPI yet ({exc}); "
+                        "retrying in 15s...")
+              if time.monotonic() >= deadline:
+                  sys.exit(f"Timed out after 10 minutes waiting for "
+                           f"{name}=={version} to appear on PyPI. "
+                           "Check the PyPI publish workflow, then re-run "
+                           "this workflow via workflow_dispatch.")
+              time.sleep(15)
+          EOF
+      - name: Install mcp-publisher
+        run: |
+          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+      - name: Login to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+      - name: Publish server.json
+        run: ./mcp-publisher publish

apache_aiops-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,26 @@
+name: Publish to PyPI
+
+# Trusted Publishing (OIDC) — publishes from GitHub's runners with no API token,
+# sidestepping the local-IP / account new-project rate limit. Configure a matching
+# "trusted publisher" for this package on PyPI (see the repo release notes).
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required for PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1

apache_aiops-0.2.0/.gitignore

@@ -0,0 +1,23 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+
+# Virtual envs / build
+.venv/
+dist/
+build/
+
+# uv
+uv.lock
+
+# Local config / secrets (never commit)
+*.env
+.env
+config.yaml
+
+# OS
+.DS_Store
+.coverage

apache_aiops-0.2.0/.mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "apache-aiops": {
+      "type": "stdio",
+      "command": "uvx",
+      "args": [
+        "--from",
+        "apache-aiops==0.2.0",
+        "apache-aiops-mcp"
+      ]
+    }
+  }
+}

apache_aiops-0.2.0/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## v0.2.0 — 2026-11-05
+
+- Expand to 17 governed MCP/CLI tools with build/runtime config, bounded mod_status/error-log reads and privacy-preserving access-status summaries.
+- Add configtest-preflighted graceful reload with dry-run and unknown-outcome reporting.
+- Preserve stderr output from Apache commands and report partial probe failures explicitly.
+- Prevent error-log reads from resolving into this tool's own audit/config directory.
+- Add GitHub CI for tests, lint, security scan and build.
+
+## 0.1.0
+
+- Initial local development version; not published.

apache_aiops-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wei <zhouwei008@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

apache_aiops-0.2.0/PKG-INFO

@@ -0,0 +1,50 @@
+Metadata-Version: 2.5
+Name: apache-aiops
+Version: 0.2.0
+Summary: Governed Apache HTTP Server diagnosis for config, virtual hosts, modules and HTTP health.
+Author-email: Wei Zhou <zhouwei008@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: httpx<1.0,>=0.27
+Requires-Dist: mcp[cli]<3.0,>=2.0
+Requires-Dist: pyyaml<7.0,>=6.0
+Requires-Dist: rich<16.0,>=13.0
+Requires-Dist: typer<1.0,>=0.12
+Description-Content-Type: text/markdown
+
+<!-- mcp-name: io.github.AIops-tools/apache-aiops -->
+# Apache AIops
+
+A dedicated, governed MCP server, CLI and skill for Apache HTTP Server with 17 MCP tools. It uses Apache's own `apachectl` diagnostics, optional operator-configured HTTP health and `mod_status` URLs, and bounded reads of an operator-configured error log plus a privacy-preserving access-log status summary. Every call is audited and budgeted by the vendored governance harness.
+
+## What it checks
+
+- Apache version, config syntax, parsed virtual hosts and loaded modules.
+- Build options and parsed runtime configuration.
+- Parsed config include tree, compiled modules and directives from static modules.
+- Optional machine-readable `mod_status` metrics, bounded error-log tail and privacy-preserving access-status summary.
+- Optional HTTP health status without downloading the response body.
+- `apache_diagnose` correlates the checks and preserves failures as errors with `data: null`.
+
+## Setup from source
+
+Requires Python 3.11+, `uv`, and `apachectl` on the operator host. Run `uv sync --dev`, `uv run apache-aiops init`, then `uv run apache-aiops doctor`. Manual `~/.apache-aiops/config.yaml`:
+
+```yaml
+targets:
+  - name: local
+    apachectl_bin: apachectl
+    probe_url: http://127.0.0.1/health
+    status_url: http://127.0.0.1/server-status?auto
+    error_log: /var/log/apache2/error.log
+    access_log: /var/log/apache2/access.log
+    timeout: 10
+    verify_ssl: true
+```
+
+Run `uv run apache-aiops diagnose`. The MCP entry point is `uv run apache-aiops-mcp`. The optional HTTP probe is configured by the operator, not chosen by a tool caller. TLS verification is enabled by default, and `ca_file` accepts a custom CA PEM.
+
+## Scope and verification
+
+`graceful-reload` first runs `configtest`, supports dry-run and two CLI confirmations, and reports an unknown final outcome even if the command returned: existing workers may still serve the old config. It has no safe inverse when the prior config file is not snapshotted. Vhost editing, TLS certificate management and module changes remain outside this release. See [verification](docs/VERIFICATION.md). Missing operations and live-environment feedback are welcome as issues or PRs.

apache_aiops-0.2.0/README.md

@@ -0,0 +1,35 @@
+<!-- mcp-name: io.github.AIops-tools/apache-aiops -->
+# Apache AIops
+
+A dedicated, governed MCP server, CLI and skill for Apache HTTP Server with 17 MCP tools. It uses Apache's own `apachectl` diagnostics, optional operator-configured HTTP health and `mod_status` URLs, and bounded reads of an operator-configured error log plus a privacy-preserving access-log status summary. Every call is audited and budgeted by the vendored governance harness.
+
+## What it checks
+
+- Apache version, config syntax, parsed virtual hosts and loaded modules.
+- Build options and parsed runtime configuration.
+- Parsed config include tree, compiled modules and directives from static modules.
+- Optional machine-readable `mod_status` metrics, bounded error-log tail and privacy-preserving access-status summary.
+- Optional HTTP health status without downloading the response body.
+- `apache_diagnose` correlates the checks and preserves failures as errors with `data: null`.
+
+## Setup from source
+
+Requires Python 3.11+, `uv`, and `apachectl` on the operator host. Run `uv sync --dev`, `uv run apache-aiops init`, then `uv run apache-aiops doctor`. Manual `~/.apache-aiops/config.yaml`:
+
+```yaml
+targets:
+  - name: local
+    apachectl_bin: apachectl
+    probe_url: http://127.0.0.1/health
+    status_url: http://127.0.0.1/server-status?auto
+    error_log: /var/log/apache2/error.log
+    access_log: /var/log/apache2/access.log
+    timeout: 10
+    verify_ssl: true
+```
+
+Run `uv run apache-aiops diagnose`. The MCP entry point is `uv run apache-aiops-mcp`. The optional HTTP probe is configured by the operator, not chosen by a tool caller. TLS verification is enabled by default, and `ca_file` accepts a custom CA PEM.
+
+## Scope and verification
+
+`graceful-reload` first runs `configtest`, supports dry-run and two CLI confirmations, and reports an unknown final outcome even if the command returned: existing workers may still serve the old config. It has no safe inverse when the prior config file is not snapshotted. Vhost editing, TLS certificate management and module changes remain outside this release. See [verification](docs/VERIFICATION.md). Missing operations and live-environment feedback are welcome as issues or PRs.

apache_aiops-0.2.0/SECURITY.md

@@ -0,0 +1,5 @@
+# Security
+
+Report vulnerabilities privately through the repository's GitHub security advisory flow when available. Do not post private virtual-host names, configuration dumps, credentials or health URLs in public issues.
+
+Read commands accept only fixed `apachectl` options; the fixed `graceful` write first runs `configtest`. Commands execute as argument lists without a shell. The process account's permissions control which configuration and operator-selected error/access logs it can inspect; log paths are checked again on each read and cannot resolve inside this tool's audit/config directory. The access-status summary returns only HTTP status codes and counts, never raw request paths, IPs or headers; unknown log formats are reported as unparsed. HTTP probe and status URLs come from operator configuration, never agent parameters. The health probe does not return a body; `mod_status` output is bounded. TLS validation is enabled by default. Graceful reload has dry-run, CLI double confirmation and an unknown final outcome until checked.

apache_aiops-0.2.0/apache_aiops/__init__.py

@@ -0,0 +1,8 @@
+"""Apache AIops: governed Apache HTTP Server operations."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("apache-aiops")
+except PackageNotFoundError:
+    __version__ = "0.0.0+unknown"

apache_aiops-0.2.0/apache_aiops/cli/__init__.py

@@ -0,0 +1,9 @@
+"""CLI package for apache-aiops.
+
+Re-exports ``app`` so the pyproject entry point
+``apache-aiops = "apache_aiops.cli:app"`` works unchanged.
+"""
+
+from apache_aiops.cli._root import app
+
+__all__ = ["app"]

apache_aiops-0.2.0/apache_aiops/cli/_common.py

@@ -0,0 +1,118 @@
+"""Shared helpers for apache-aiops CLI sub-modules."""
+
+from __future__ import annotations
+
+import functools
+from collections.abc import Callable
+from typing import Annotated, Any
+
+import typer
+from rich.console import Console
+from rich.markup import escape
+
+console = Console()
+
+# ─── Shared Option types ───────────────────────────────────────────────────
+
+TargetOption = Annotated[str | None, typer.Option("--target", "-t", help="Target name from config")]
+DryRunOption = Annotated[
+    bool, typer.Option("--dry-run", help="Print the API call without executing")
+]
+
+
+def _cli_error_types() -> tuple[type[BaseException], ...]:
+    """Exceptions translated to a one-line teaching error instead of a traceback.
+
+    ``BudgetExceeded`` (and the retained ``PolicyDenied`` type) are raised by
+    ``@governed_tool`` OUTSIDE the tool body, so ``tool_errors`` never sees them
+    and they never arrive as an ``{"error": ...}`` dict. Their message is the
+    teaching text (e.g. which budget was hit) — without them here such a refusal
+    reaches the CLI as a traceback instead.
+    """
+    from apache_aiops.connection import ApacheCommandError
+    from apache_aiops.governance import BudgetExceeded, PolicyDenied
+
+    return (ApacheCommandError, PolicyDenied, BudgetExceeded, KeyError, OSError, ValueError)
+
+
+def cli_errors(fn: Callable) -> Callable:
+    """Translate known exceptions into one red line + exit code 1."""
+
+    @functools.wraps(fn)
+    def wrapper(*args: Any, **kwargs: Any) -> Any:
+        try:
+            return fn(*args, **kwargs)
+        except (typer.Exit, typer.Abort):
+            raise
+        except _cli_error_types() as e:
+            message = str(e)
+            if isinstance(e, KeyError):
+                message = f"Missing required key or environment variable: {message}"
+            # Upstream text can contain "[/bold]"; unescaped, rich raises on it and the
+            # real error is replaced by a MarkupError traceback.
+            console.print(f"[red]Error: {escape(message)}[/]")
+            raise typer.Exit(1) from e
+
+    return wrapper
+
+
+#: Exit status for a write whose outcome could not be determined — kept distinct
+#: from 0 (confirmed) and 1 (failed) so a script can tell all three apart.
+EXIT_UNDETERMINED = 2
+
+
+def governed(result: Any) -> dict:
+    """Return a governed tool's result, or print its error and exit 1.
+
+    The ``apache_aiops.mcp_server.tools`` twins never raise: ``@tool_errors`` flattens every
+    failure — an unreachable service, a refused login, a bad argument — into
+    ``{"error": ...}``. A CLI command that drops that on the floor prints an empty
+    table and exits 0 as if the service had nothing to report. Route every governed
+    call through here.
+    """
+    # ``outcomeUnknown`` is judged BEFORE ``error``, matching the harness: a
+    # write whose response was lost carries BOTH keys, and it is audited
+    # `unknown` precisely because it may have taken effect. Reporting that as a
+    # plain failure would tell a script the change did not happen and invite the
+    # double-apply the payload's own note warns about.
+    if isinstance(result, dict) and result.get("outcomeUnknown"):
+        console.print(f"[yellow]Outcome undetermined: {escape(str(result.get('note') or ''))}[/]")
+        raise typer.Exit(EXIT_UNDETERMINED)
+    if isinstance(result, dict) and result.get("error"):
+        console.print(f"[red]Error: {escape(str(result['error']))}[/]")
+        raise typer.Exit(1)
+    return result if isinstance(result, dict) else {}
+
+
+def dry_run_print(*, operation: str, api_call: str, parameters: dict | None = None) -> None:
+    """Print a dry-run preview of the API call that would be made."""
+    console.print("\n[bold magenta][DRY-RUN] No changes will be made.[/]")
+    console.print(f"[magenta]  Operation: {operation}[/]")
+    console.print(f"[magenta]  API Call:  {api_call}[/]")
+    for k, v in (parameters or {}).items():
+        console.print(f"[magenta]  Param:     {k} = {v}[/]")
+    console.print("[magenta]  Run without --dry-run to execute.[/]\n")
+
+
+def double_confirm(action: str, resource: str) -> None:
+    """Require two confirmations for a destructive operation."""
+    console.print(f"[bold yellow]⚠️  About to: {action} '{resource}'[/]")
+    typer.confirm(f"Confirm 1/2: {action} '{resource}'?", abort=True)
+    typer.confirm(
+        f"Confirm 2/2: really {action} '{resource}'? This may be irreversible.",
+        abort=True,
+    )
+
+
+def print_truncation_note(result: dict, noun: str) -> None:
+    """Print a visible warning when a listing envelope was capped.
+
+    The JSON already carries ``truncated``, but a human scrolling a long dump
+    will not spot it — and neither will a model summarising the terminal. Say
+    it in words, on the last line, where it cannot be missed.
+    """
+    if isinstance(result, dict) and result.get("truncated"):
+        console.print(
+            f"[yellow]… showing {result.get('returned')} of more {noun} — "
+            f"truncated, re-run with a higher --limit[/]"
+        )

apache_aiops-0.2.0/apache_aiops/cli/_root.py

@@ -0,0 +1,206 @@
+"""Apache AIops CLI; service reads call governed MCP twins."""
+
+from __future__ import annotations
+
+import json
+import sys
+from typing import Annotated
+
+import typer
+import yaml
+
+from apache_aiops.cli._common import cli_errors, console, double_confirm, governed
+from apache_aiops.cli.undo import undo_app
+from apache_aiops.governance.paths import ops_home
+
+app = typer.Typer(
+    name="apache-aiops", no_args_is_help=True, help="Audited Apache HTTP Server diagnosis."
+)
+app.add_typer(undo_app, name="undo")
+Target = Annotated[str | None, typer.Option("--target", "-t", help="Configured Apache target")]
+
+
+def _print(result: dict) -> None:
+    console.print_json(json.dumps(governed(result)))
+
+
+@app.command("config-includes")
+@cli_errors
+def config_includes(target: Target = None) -> None:
+    """Show the parsed Apache config include tree."""
+    from apache_aiops.mcp_server.tools.httpd import apache_config_includes
+    _print(apache_config_includes(target=target))
+
+
+@app.command("compiled-modules")
+@cli_errors
+def compiled_modules(target: Target = None) -> None:
+    """List modules compiled into Apache."""
+    from apache_aiops.mcp_server.tools.httpd import apache_compiled_modules
+    _print(apache_compiled_modules(target=target))
+
+
+@app.command("static-directives")
+@cli_errors
+def static_directives(target: Target = None) -> None:
+    """List directives supplied by static Apache modules."""
+    from apache_aiops.mcp_server.tools.httpd import apache_static_directives
+    _print(apache_static_directives(target=target))
+
+
+@app.command("build")
+@cli_errors
+def build(target: Target = None) -> None:
+    """Show Apache build flags and paths."""
+    from apache_aiops.mcp_server.tools.httpd import apache_build
+    _print(apache_build(target=target))
+
+
+@app.command("runtime-config")
+@cli_errors
+def runtime_config(target: Target = None) -> None:
+    """Show parsed Apache runtime configuration."""
+    from apache_aiops.mcp_server.tools.httpd import apache_runtime_config
+    _print(apache_runtime_config(target=target))
+
+
+@app.command("server-status")
+@cli_errors
+def server_status(target: Target = None) -> None:
+    """Show configured mod_status auto metrics."""
+    from apache_aiops.mcp_server.tools.httpd import apache_server_status
+    _print(apache_server_status(target=target))
+
+
+@app.command("error-log")
+@cli_errors
+def error_log(limit: int = 50, target: Target = None) -> None:
+    """Tail the operator-configured Apache error log."""
+    from apache_aiops.mcp_server.tools.httpd import apache_error_log
+    _print(apache_error_log(limit=limit, target=target))
+
+
+@app.command("access-status")
+@cli_errors
+def access_status(limit: int = 200, target: Target = None) -> None:
+    """Summarize recent common/combined access-log status codes."""
+    from apache_aiops.mcp_server.tools.httpd import apache_access_status
+    _print(apache_access_status(limit=limit, target=target))
+
+
+@app.command("graceful-reload")
+@cli_errors
+def graceful_reload(dry_run: bool = False, target: Target = None) -> None:
+    """Check config and request an Apache graceful reload."""
+    from apache_aiops.mcp_server.tools.httpd import apache_graceful_reload
+    if not dry_run:
+        double_confirm("gracefully reload Apache", target or "default")
+    _print(apache_graceful_reload(dry_run=dry_run, target=target))
+
+
+@app.command("init")
+@cli_errors
+def init() -> None:
+    """Configure a local Apache HTTP Server target."""
+    from apache_aiops.config import TargetConfig
+
+    name = typer.prompt("Target name", default="local")
+    probe_url = typer.prompt("HTTP health URL (optional)", default="")
+    status_url = typer.prompt("mod_status auto URL (optional)", default="")
+    error_log = typer.prompt("Absolute error log path (optional)", default="")
+    access_log = typer.prompt("Absolute access log path (optional)", default="")
+    chosen = TargetConfig(
+        name=name, probe_url=probe_url or None, status_url=status_url or None,
+        error_log=error_log or None, access_log=access_log or None,
+    )
+    path = ops_home() / "config.yaml"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.exists():
+        raise ValueError(f"Config exists at {path}; edit it to add a target.")
+    path.write_text(
+        yaml.safe_dump({"targets": [{
+            "name": chosen.name, "probe_url": chosen.probe_url,
+            "status_url": chosen.status_url, "error_log": chosen.error_log,
+            "access_log": chosen.access_log,
+        }]})
+    )
+    path.chmod(0o600)
+    console.print(f"Configured {name} at {path}")
+
+
+@app.command("version")
+@cli_errors
+def version(target: Target = None) -> None:
+    """Show Apache version."""
+    from apache_aiops.mcp_server.tools.httpd import apache_version
+
+    _print(apache_version(target=target))
+
+
+@app.command("config-check")
+@cli_errors
+def config_check(target: Target = None) -> None:
+    """Run Apache config syntax test."""
+    from apache_aiops.mcp_server.tools.httpd import apache_config_check
+
+    _print(apache_config_check(target=target))
+
+
+@app.command("vhosts")
+@cli_errors
+def vhosts(target: Target = None) -> None:
+    """Show parsed virtual-host map."""
+    from apache_aiops.mcp_server.tools.httpd import apache_vhosts
+
+    _print(apache_vhosts(target=target))
+
+
+@app.command("modules")
+@cli_errors
+def modules(target: Target = None) -> None:
+    """List loaded Apache modules."""
+    from apache_aiops.mcp_server.tools.httpd import apache_modules
+
+    _print(apache_modules(target=target))
+
+
+@app.command("probe")
+@cli_errors
+def probe(target: Target = None) -> None:
+    """Probe configured HTTP health URL."""
+    from apache_aiops.mcp_server.tools.httpd import apache_probe
+
+    _print(apache_probe(target=target))
+
+
+@app.command("diagnose")
+@cli_errors
+def diagnose(target: Target = None) -> None:
+    """Correlate Apache config and HTTP probes."""
+    from apache_aiops.mcp_server.tools.httpd import apache_diagnose
+
+    _print(apache_diagnose(target=target))
+
+
+@app.command("doctor")
+@cli_errors
+def doctor(target: Target = None) -> None:
+    """Test access to apachectl -v."""
+    from apache_aiops.mcp_server.tools.httpd import apache_version
+
+    _print(apache_version(target=target))
+
+
+@app.command("mcp")
+@cli_errors
+def mcp_cmd() -> None:
+    """Start stdio MCP server."""
+    if sys.version_info < (3, 11):
+        raise typer.Exit(2)
+    from apache_aiops.mcp_server.server import main
+
+    main()
+
+
+if __name__ == "__main__":
+    app()