Chapter 7. Deploying Ansible MCP server on Ansible Automation Platform

Procedure

1. Log in to Red Hat OpenShift Container Platform as an administrator.
2. Navigate to the namespace where you want to install the MCP server.
3. Select Operators Installed Operators.
4. From the list of installed operators, select Ansible Automation Platform.
5. In the Ansible Automation Platform tile, click Create instance.
6. From the Configure via field, select the Form view, then provide the instance name. For example, aap-mcp.

7. Select the YAML view, and replace the spec: section with the following snippet:

   spec:
     no_log: true
     # Components
     controller:
       disabled: false
     eda:
       disabled: false
     hub:
       disabled: true
     lightspeed:
       disabled: true
     mcp:
       disabled: false
       allow_write_operations: false

   Copy to Clipboard Toggle word wrap
   Important

   Use the allow_write_operations variable to configure the operational access level of the Ansible MCP server:

   • Read-only access: Set the variable to false to restrict the AI agent to viewing data only. In this mode, the AI tool can query job statuses and logs, but cannot trigger new automation in the Ansible Automation Platform. The MCP server is set to read-only mode by default.
   • Read-write access: Set the variable to true to allow the AI agent to make changes in Ansible Automation Platform, such as executing jobs or modifying the system state.
8. Click Create. The Ansible MCP server is created.

9. Optional: If you changed the permissions of the Ansible MCP server after it was created and deployed, you must delete the AnsibleMCPServer custom resource and recreate it.

   Perform the following steps:

   1. Go to the Ansible Automation Platform portal.
   2. Under Resources, search for the AnsibleMCPServer custom resource.
   3. Select the active AnsibleMCPServer instance. An active AnsibleMCPServer instance is identified by the -mcp suffix appended to the Ansible Automation Platform custom resource name.
   4. Select the Settings menu on the right side of the instance, and then click Delete AnsibleMCPServer.
   5. After the reconciliation process completes, the existing MCP server instance is deleted, and a new Ansible MCP server instance is created.

Verification

1. Navigate to Workloads Deployments.
2. Check that the deployment you created is listed there. For example: aap-mcp.
3. Check one of the pod’s logs and verify there are no errors.

Procedure

1. From the navigation panel, select Access Management Users.
2. Select the username for your user profile to configure OAuth 2 tokens.
3. Select the Tokens tab. When no tokens are present, the Tokens screen prompts you to add them.

4. Click Create token, and provide the following details:

   • Application: Enter the name of the application with which you want to associate your token. Alternatively, you can search for it by clicking Browse. This opens a separate window that enables you to choose from the available options. Select Name from the filter list to filter by name if the list is extensive.

     Note

     To create a Personal Access Token (PAT) that is not linked to any application, leave the Application field blank.

   • Description: (Optional) Provide a short description for your token.

   • Scope: (Required) Specify the level of access you want this token to have. The scope of an OAuth 2 token can be set as one of the following:

     • Write: Allows requests sent with this token to add, edit, and delete resources in the system.
     • Read: Limits actions to read only. The write scope includes the read scope.
5. Click Create token. The token information is displayed.

6. On the token information page that appears, click the Copy icon and save the token for future use.

   Important

   This will be the only time the token is displayed. Therefore, ensure that you save the token for future use.

1. From the navigation panel, select Access Management OAuth Applications.
2. Select the application you want to verify from the Applications list view.

3. Select the Tokens tab.

   Your token should be displayed in the list of tokens associated with the application you chose.

Procedure

1. Go to the AI tool that you want to connect to the Ansible Automation Platform.

2. Follow your AI client’s instructions to configure the MCP server settings.

   Typically, you must specify the MCP server configurations in the mcp.json file.

3. When configuring the mcp.json file, add the Ansible MCP server URL in the following format:

   <Ansible MCP server URL>/<toolset>/mcp

   Key:

   • Ansible MCP server URL = The URL of the Ansible MCP server. For example, https://api.example.com/.

     To obtain the Ansible MCP server URL, contact your organization administrator.

   • Toolset = The toolset that you want to connect to. For example, job_management, inventory_management, system_monitoring, user_management, security_compliance, and platform_configuration.

   • Token = The API token of the Ansible MCP server.

     Use the following format to add details about your Ansible MCP server in the the mcp.json file:

     "mcpServers": {
             "aap-mcp-job-management": {
               "type": "http",
               "url": "https://api.example.com/job_management/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             },
             "aap-mcp-inventory-management": {
               "type": "http",
               "url": "https://api.example.com/inventory_management/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             },
             "aap-mcp-system-monitoring": {
               "type": "http",
               "url": "https://api.example.com/system_monitoring/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             },
             "aap-mcp-user-management": {
               "type": "http",
               "url": "https://api.example.com/user_management/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             },
             "aap-mcp-security-compliance": {
               "type": "http",
               "url": "https://api.example.com/security_compliance/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             },
             "aap-mcp-platform-configuration": {
               "type": "http",
               "url": "https://api.example.com/platform_configuration/mcp",
               "headers": {
                 "Authorization": "Bearer ${env:MY_SERVICE_TOKEN}"
               }
             }
           },

     Copy to Clipboard Toggle word wrap
     Important

     Use a concise MCP server name, ideally limited to 20 characters. This is because AI agents combine the MCP server name with the tool name to create a unique identifier, and most AI agents enforce a 64-character limit on this combined identifier.