infra-mcp 0.1.0

Local stdio MCP server for read-only diagnosis of on-prem Linux VMs and PostgreSQL databases

infra-mcp

A local stdio MCP server that gives an AI agent read-only visibility into on-premise Linux VMs (SSH + journald) and PostgreSQL databases. The agent can diagnose service failures, retrieve bounded logs, and check DB health without any user terminal interaction.

v0.1 is deliberately read-only. Every remote operation is gated by:

• an SSH command/service allowlist (checked before any network call),
• a SQL SELECT guard + READ ONLY transaction,
• a directory allowlist for log-file access (with .. traversal blocked),

and every executed remote command is written to an append-only audit log.

Install

uv tool install infra-mcp
# or from source:
uv tool install -e /path/to/infra-probe

(pip install infra-mcp also works.)

Configure

Copy infra-mcp.yaml.example to ~/.infra-mcp/infra-mcp.yaml and edit it. Override the path with --config or the INFRA_MCP_CONFIG environment variable.

Generate a starter config from your ~/.ssh/config:

infra-mcp generate-config -o ~/.infra-mcp/infra-mcp.yaml

Create the read-only PostgreSQL role(s) (admin password is prompted, never stored):

infra-mcp setup

Check VM reachability:

infra-mcp test

Run

infra-mcp run
# or: python -m infra_mcp run

Register it with your MCP client (Claude Code, Cursor, …) as a stdio server whose command is infra-mcp run.

Tools

Tool	Purpose
list_vms	All VMs with reachability + watched services (no IPs)
get_infra_overview	Service states + DB health for one VM in a single call
get_service_status	systemd state, uptime, last 5 log lines
get_service_logs	Bounded journald logs, filtered by severity
get_log_file	Last N lines of an allowed log file, optional grep
get_db_status	Connection counts, waiting locks, long-running query count
query_db	Bounded caller-supplied SELECT
get_audit_log	Recent entries from the local audit log

All output is bounded at the source (hard cap 200 log lines, 100 DB rows) and returned as plain text / compact TSV.

Development

uv pip install -e ".[dev]"
pytest
ruff check .

Tests cover output bounding, the SQL guard, and the path/command allowlists — no live VM or database required.