Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,14 @@ A _Model Context Protocol_ (MCP) Server is an external service that acts as a ga

An MCP eliminates the need for custom integrations by providing a universal "language" for AI models to access and interact with real-world systems, data, and tools.

The MCP operates using a client-server architecture:
The MCP operates using a client/server architecture:

[cols="a,a,a", options="header"]
|===
| Component | Role | Description
| MCP Host | The application environment | This is where the user interacts with the AI, such as an AI-powered IDE like VS Code or a chatbot interface.
| MCP Host | The application environment | This is where the user interacts with the AI, such as an AI-powered IDE like Visual Studio Code or a chatbot interface.
| MCP Client | Connection manager | A component within the Host that translates LLM requests into the MCP format.
| MCP Server | Resource provider | An external service that connects to underlying systems like databases or APIs.
| MCP Server | Resource provider | An external service that connects to underlying systems such as databases or APIs.
|===

By using this standardized protocol, any LLM that implements the MCP Client can use any MCP Server.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,4 @@ A successful build produces output ending with:
----
Successfully tagged localhost/my-cfn-mcp-ee:latest
Complete! The build context can be found at: /path/to/ee-build/context
----



----
11 changes: 8 additions & 3 deletions downstream/modules/builder/proc-configure-remote-mcp-server.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
[role="_abstract"]
If you need to bypass local installation and dynamically choose your deployment mode at build time, configure your role to reference a remote MCP server over HTTP.

.Add a remote server to your role
*Add a remote server to your role*
To define a remote MCP server, set the type to http in your registry metadata:

----
Expand All @@ -24,9 +24,14 @@ cfn_mcp_registry:
cfn_mcp_version: "latest"
----

When `type` is set to `http`, the framework skips installation and only registers the server in the manifest with its URL.
When `type` is set to `http`, the framework skips installation and only registers the server in the manifest with its URL.

.Support both modes
[NOTE]
====
The package is still downloaded and installed; only the manifest entry changes (using `"url"` instead of `"command"`).
====

*Support both modes*
The GitHub MCP role in `ansible.mcp_builder` demonstrates a pattern for supporting both embedded and remote modes. You can adopt this pattern by:

. Creating a `vars/remote.yml` file with the remote registry definition.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@ This procedure uses the AWS CloudFormation MCP Server (`awslabs.cfn-mcp-server`)
.Procedure
. Create the collection directory structure and a new Ansible collection to hold your custom MCP role:
+
`mkdir -p collections/ansible_collections/myorg/mcp_cfn/roles/cfn_mcp/
{defaults,tasks,meta}`
`mkdir -p collections/ansible_collections/myorg/mcp_cfn/[defaults,tasks,meta]`
+
`mkdir -p collections/ansible_collections/myorg/mcp_cfn/playbooks`
+
Expand Down Expand Up @@ -42,7 +41,7 @@ collections/ansible_collections/myorg/mcp_cfn/
---
namespace: myorg
name: mcp_cfn
version: 0.7.2
version: 1.0.1.9
readme: README.md
authors:
- Your Name
Expand All @@ -53,7 +52,7 @@ tags:
- aws
- cloudformation
dependencies:
ansible.mcp_builder: ">=0.7.2"
ansible.mcp_builder: ">=1.0.1.9"
----
The dependencies field ensures that the `ansible.mcp_builder` collection is installed alongside your collection.
+
Expand All @@ -70,7 +69,7 @@ cfn_mcp_registry:
description: "AWS CloudFormation MCP Server - manage AWS resources via
Cloud Control API"

cfn_mcp_version: "0.7.2"
cfn_mcp_version: "1.0.1.9"
----
+
The registry variable must follow the naming convention `<role_name>_registry`. The fields are:
Expand Down Expand Up @@ -132,7 +131,7 @@ myrole_build_path: "example/build"
- cfn_mcp_verify_result.rc != 0
----
+
The two `include_role` tasks are the minimum required. The `install_manager`` task reads your registry metadata and installs the MCP server using the appropriate method. The `generate_manifest` task adds the server to the `mcpservers.json` manifest.
The two `include_role` tasks are the minimum required. The `install_manager`` task reads your registry metadata and installs the MCP server by using the appropriate method. The `generate_manifest` task adds the server to the `mcpservers.json` manifest.
+
The verification step is optional but recommended. It confirms the installed server is callable.

Expand Down Expand Up @@ -192,17 +191,17 @@ collections:
[IMPORTANT]
====

The first task must include `ansible.mcp_builder.common` with `public: true`. This initializes the framework and makes shared variables (such as `common_mcp_base_path`) available to subsequent tasks. The ownership fix at the end ensures the MCP server files are accessible by the non-root runtime user inside the execution environment.
The first task must include `ansible.mcp_builder.common` with `public: true`. This initializes the framework and makes shared variables (such as `common_mcp_base_path`) available to later tasks. The ownership fix at the end ensures the MCP server files are accessible by the non-root runtime user inside the execution environment.
====
+
[NOTE]
====
The built-in `ansible.mcp_builder.install_mcp` playbook only supports roles within the `ansible.mcp_builder` namespace. Custom roles in your own collection namespace require their own playbook, as shown above.
====

. Build your collection into a distributable tarball:
. Build your collection into a distributable tar file:
+
`cd collections/ansible_collections/myorg/mcp_cfn`
`ansible-galaxy collection build --output-path /path/to/output/`
+
This produces a file like `myorg-mcp_cfn-0.7.2.tar.gz`.
This produces a file like `myorg-mcp_cfn-1.0.0.tar.gz`.
8 changes: 4 additions & 4 deletions downstream/modules/builder/ref-evaluate-mcp-servers.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,14 @@
= Evaluate MCP servers before installation

[role="_abstract"]
To protect your execution environment from vulnerabilities, evaluate MCP servers before installation by auditing code, pinning versions, enforcing read-only modes, and verifying permissions.
To protect your execution environment from vulnerabilities, evaluate _Model Context Protocol_ (MCP) servers before installation by auditing code, pinning versions, enforcing read-only modes, and verifying permissions.

Before including an MCP server in your execution environment:

* *Review the source code*: MCP servers can execute arbitrary operations on your infrastructure. Audit the server code before installing, especially for servers from community or third-party sources.
* *Review the source code*: MCP servers can run arbitrary operations on your infrastructure. Audit the server code before installing, especially for servers from community or third-party sources.
* *Pin to specific versions*: Use explicit version numbers in your registry metadata rather than latest:
+
`cfn_mcp_version: "0.7.2"`
`cfn_mcp_version: "1.0.1.9"`
+
This ensures reproducible builds and prevents unexpected behavior from upstream changes.

Expand All @@ -22,7 +22,7 @@ This ensures reproducible builds and prevents unexpected behavior from upstream
cfn_mcp_registry:
- name: "awslabs.cfn-mcp-server"
type: "stdio"
lang: "pypi"
lang: "pyoi"
args: ["--readonly"]
description: "AWS CloudFormation MCP Server (read-only)"
----
Expand Down
5 changes: 2 additions & 3 deletions downstream/modules/builder/ref-mcp-builder-collection.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -17,16 +17,15 @@ The framework consists of three main components:

** Installs the appropriate language runtime (Go, Node.js, or Python/uv) if not already present.
** Downloads and installs the MCP server package from the correct source (PyPI, npm, or Git).
** Generates a unified manifest file (`/opt/mcp/mcpservers.json/opt/mcp/
mcpservers.json`) listing all available MCP servers.
** Generates a unified manifest file (`/opt/mcp/mcpservers.json') listing all available MCP servers.
** Creates the `mcp_manage` utility for listing, querying, and running installed MCP servers
* Your custom role defines metadata about the MCP server you want to install. At minimum, it includes:

** A registry variable that specifies the server name, transport type, language, and description.
** A tasks file that invokes the common role's `install_manager` and `generate_manifest` tasks.
* A playbook ties your custom role into the build process. This playbook is called by ansible-builder during the execution environment container build.

*Selecting an installation method*
*Select an installation method*

The framework supports three installation methods, selected by the `lang` field in your registry metadata:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
[role="_abstract"]
Understand how the MCP servers manifest registers and automatically merges multiple server installations into the `/opt/mcp/mcpservers.json` file so that you can effectively track and verify your {ExecEnvShort} configurations.

All installed MCP servers are registered in `/opt/mcp/mcpservers.json`. This file follows the `mcp.json` format established by VS Code, with each server entry containing:
All installed MCP servers are registered in `/opt/mcp/mcpservers.json`. This file follows the `mcp.json` format established by Visual Studio Code, with each server entry containing:

----
{
Expand Down