Overview
The Dell PowerProtect Backup Services Model Context Protocol (MCP) server acts as a secure gateway that connects compatible AI agents to the Dell PowerProtect Backup Services Cloud using your existing account permissions.
By integrating this server, you can manage your data protection environment, run workflows, and query environment metrics using natural language prompts within supported AI tools.
❗️Important
Setup workflows vary depending on your chosen AI agent. The MCP server has permissions to read and modify configuration settings, but it cannot delete Cloud configurations or backup data.
Key Benefits
Enhanced Operational Efficiency: Administrators can monitor backup fleets, inspect historical audit logs, and pull legal discovery states without context-switching to the primary administration console.
Governed Security and RBAC Layer: All interactions are strictly constrained by implicit Role-Based Access Control (RBAC) via a 3-Legged OAuth 2.1 flow. The AI application acts exclusively on behalf of the authenticated user; if an operator lacks console permissions to view a specific workload, the native API blocks execution.
How MCP Server Works
The MCP server establishes a secure remote HTTP connection:
You add the MCP server URL to the supported AI agents.
The agent prompts you to authenticate via the Administration Console.
Once authenticated, the MCP server exposes supported tools to your agent.
The agent uses these tools to fetch environment data and answer your natural language requests.
Compatibility- Supported AI Agents
The MCP server currently supports following AI Agents:
Claude ( Desktop, Code, Cowork, Web)
Cursor/ VS Code
Google Antigravity
Microsoft Copilot Studio
Configure MCP server
Step 1: Configure the remote MCP server
To connect an MCP-compatible agent to Dell PowerProtect Backup Services, add the MCP server using the following server details.
Name: Dell PPBS MCP (or any name that helps you identify the server.)
📝 Note
The MCP server is currently not available for environments hosted on the Australia control plane and FedRAMP GovCloud.
Example agent configuration
Use the format supported by your MCP-compatible agent. The exact fields and setup steps vary by agent.
AI agents with built-in connector User Interface
If your AI agent has a built-in connector/integration User Interface, use that option instead of manual configuration. Add the MCP server URL for your region (see Step 1) as a custom connector.
📝 Note
Refer to your AI agent's own documentation for the exact steps, since the user Interface vary by vendor and change independently of this article.
JSON example
{
"mcpServers": {
"dell-mcp": {
"type": "http",
"url": "https://dell-mcp.druva.com/mcp"
}
}
}
TOML example
[dell-mcp.druva]
url = "https://dell-mcp.druva.com/mcp"
Confirm the required configuration format in the documentation for your MCP-compatible agent.
Step 2: Authentication
When you connect to the MCP server for the first time, your agent prompts you to authenticate by redirecting to the Cloud Platform console. Use the same credentials that you use to sign in to the Cloud Platform console. Authentication supports both password and TOTP methods.
Step 3: Test the connection
Start your MCP-compatible agent after you add the MCP server.
Ask a simple question, such as:
List available tools.
The connection is working if the agent uses the MCP server and returns a response that matches your permissions.
Example Operational Prompts
Once connected, you can monitor your Dell PowerProtect Backup Services environment using natural language commands:
Provide a summary of the global backup success rate across all regions.
Create a daily health overview detailing total data backed up, success percentages, and active critical alerts.
Show me the resources which are consuming the most space and what kind of files are stored on them.
Check the backup health status for all integrated SaaS applications.
Look at the audit logs and identify any unusual activities by admin [Name].
Which users are currently on legal hold and how much data is backed up for those users?
Produce a detailed backup health report for all endpoints devices
MCP Server Capabilities
The MCP server capabilities are available through tools and skills. This MCP server includes the following tools.
Tool | Purpose |
druva___list_skills | Lists the skills or capabilities available through the MCP server. The AI agent uses this tool to discover which actions are supported. |
druva___recommend_skill | Identifies the most relevant skill for a user request. The agent uses this tool when a natural-language request must be matched to a supported capability. |
druva___retrieve_skill | Retrieves the details required to use a selected skill. The agent uses this tool after it selects a skill and needs the instructions or action details required to continue. |
druva___run_read_script | Runs the supported script associated with the selected skill. The agent uses this tool to fetch data from the environment. |
druva___run_write_script | Runs the supported script or action associated with the selected skill. The agent uses this tool to perform actions in your Data Protection environment. |
Limitations & Access Control
Agent-Side Approvals: Some agents ask you to manually approve tool execution before a script runs. This is an agent-specific safety feature, not a Dell-controlled setting.
Interpretation Variance: Results can vary slightly depending on how your specific AI agent interprets and phrases background prompts.
Troubleshooting & FAQs
Q. Why can’t my MCP-compatible agent connect to the MCP server?
Verify the following:
The server URL is exactly the one mentioned below -
The agent supports remote HTTP-based MCP servers.
Check that your corporate firewall, network, browser, or endpoint security controls are not blocking outbound traffic to the URL.
Q. Why does authentication fail or not complete?
Sign in again with your Administrator Console credentials.
If authentication still fails, check whether:
Your session expired.
The browser sign-in flow was blocked.
The MCP-compatible agent blocked or did not complete the sign-in flow.
Your network or endpoint security controls blocked the authentication flow.
Q. Why does a request return no data?
Verify that:
Your active Administrator role has permission to view the requested workload, object, or target region.
Ensure that the target workload or time range you are asking about actually contains active data in your console.
Q. Why does a request fail with a permission error?
Verify that your role allows the requested data. Existing role-based access control (RBAC), permissions, and access boundaries apply when you use the MCP server.
Q. Why doesn’t the MCP compatible agent ask for approval?
Do not assume that approval prompts are guaranteed. Approval and confirmation behavior depends on the MCP compatible agent. Existing RBAC, permissions, and security controls still apply.
Q. Why is my query not using the MCP server?
AI agents can sometimes misroute generic prompts. Try being explicit: "Using the MCP server, list the recent critical alerts."