vv-pilot-mcp
MCP server for accessing QA databases, k8s logs, and Kafka via Amazon Q / Copilot.
Installation
Option 1: uvx (no install required)
Add to your MCP config (~/.aws/amazonq/mcp.json or .amazonq/mcp.json in your workspace):
{
"mcpServers": {
"qa-server": {
"command": "uvx",
"args": ["vv-pilot-mcp"],
"timeout": 60000,
"disabled": false
}
}
}
This auto-downloads and runs the server on demand. Requires uv installed.
Option 2: pipx (global install)
pipx install vv-pilot-mcp
Then add to your MCP config:
{
"mcpServers": {
"qa-server": {
"command": "vv-pilot-mcp",
"timeout": 60000,
"disabled": false
}
}
}
To update later:
pipx upgrade vv-pilot-mcp
First-Time Setup
On first use, the server will prompt you for:
- SSH password — your jump host password
- DB jump host — SSH alias for the DB jump host (e.g.
qa-psql-1.qa-new) - Vault forward host — SSH alias for the vault tunnel (e.g.
vault-np-forward-new)
All values are saved securely to ~/.config/qa-mcp/.env (chmod 600) and reused automatically on subsequent sessions.
Usage
Database
- Open Amazon Q chat and say: "Connect to QA database"
- The server will:
- SSH to the DB jump host (opens browser for OIDC approval on first session)
- Start the vault forward tunnel
- Open the Vault UI in your browser
- Copy the vault token from your profile and paste it in chat
- You're connected! Now ask things like:
- "List all schemas"
- "Find the latest visit from retrobranch1"
- "Update discharge date for visit id 1234"
Kafka
- Say: "Connect to Kafka"
- The server will SSH to the Kafka jump host and launch the kafka-utils container
- Set your client (e.g. "Set client to retrobranch1")
- Now ask things like:
- "List all visit topics"
- "Check connector status for retrobranch1-qa-retrobranch1iodine1-visit"
- "Consume 5 messages from retrobranch1-qa-visit"
- "List consumer groups"
- "Restart the visit connector"
Available Tools
Database
| Tool | Description |
|---|---|
set_password |
Set SSH password (saved for future sessions) |
set_config |
Set any config value (saved for future sessions) |
connect_db_jump_host |
SSH to DB jump host |
start_vault_forward |
Start vault tunnel |
open_vault_ui |
Open vault UI in browser |
set_vault_token |
Set vault token from browser |
connect_database |
Get credentials and connect via psql |
query |
Run SQL query |
list_schemas |
List database schemas |
list_tables |
List tables in a schema |
describe_table |
Describe table columns |
Kubernetes
| Tool | Description |
|---|---|
k8s_connect |
SSH to k8s jump host |
k8s_sso_login |
Run AWS SSO login |
k8s_sso_confirm |
Confirm SSO after browser approval |
k8s_pods |
List pods |
k8s_logs |
Get pod logs |
k8s_describe |
Describe a k8s resource |
Kafka
| Tool | Description |
|---|---|
kafka_connect |
SSH to Kafka host and launch kafka-utils container |
kafka_set_client |
Set CLIENT env var (e.g. retrobranch1, imc1) |
kafka_exec |
Run any raw command in the container |
kafka_list_topics |
List topics (with optional grep filter) |
kafka_consume |
Consume messages from a topic (avro, bounded) |
kafka_produce |
Produce a message to a topic (may fail due to ACLs) |
kafka_consumer_groups |
List/describe/delete/reset consumer groups |
kafka_connector |
List/status/pause/resume/restart/delete connectors |
General
| Tool | Description |
|---|---|
connection_status |
Check connection state |
disconnect |
Tear down all sessions |
Configuration
All config is stored in ~/.config/qa-mcp/.env:
QA_SSH_PASSWORD=<your-password>
QA_DB_JUMP_HOST=qa-psql-1.qa-new
QA_VAULT_JUMP_HOST=vault-np-forward-new
QA_VAULT_URL=https://localhost:18200
QA_VAULT_OIDC_ACCOUNT=you@iodinesoftware.com
QA_DEFAULT_CLUSTER=qa-cluster-1
QA_DEFAULT_DB=iodine
QA_DEFAULT_USER_TYPE=dba
You can also set these as environment variables to override the file.
Prerequisites
- SSH config with aliases for your jump hosts
- Access to the QA environment (OIDC)
- uv (for Option 1) or pipx (for Option 2)
Development
git clone git@github.com:vijayveeramani/vv-pilot-mcp.git
cd vv-pilot-mcp
python -m venv .venv
source .venv/bin/activate
pip install -e .
Release Workflow
- Bump version in
pyproject.toml - Commit, tag, and push:
git add -A && git commit -m "v0.x.0: description" git tag v0.x.0 git push origin main --tags
- Build and publish to PyPI:
rm -rf dist/ python -m build twine upload dist/*
Metadata
Release files for vv-pilot-mcp 0.4.7
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| vv_pilot_mcp-0.4.7.tar.gz | 37.0 kB | Without provenance | Details for vv_pilot_mcp-0.4.7.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| vv_pilot_mcp-0.4.7-py3-none-any.whl | Python 3 | none | any | Details for vv_pilot_mcp-0.4.7-py3-none-any.whl |
Total release size: 54.4 kB
Release files / vv_pilot_mcp-0.4.7.tar.gz
| Download URL | vv_pilot_mcp-0.4.7.tar.gz |
|---|---|
| Size | 37.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a9d7384f3d50a1ecc14ea812e15781297a1acf44894e8d8839637cc9e1a90d57
|
|
BLAKE2b-256 checksum How to use checksums |
e3da909a9dfa33daa0884230dafa08697203d6f174d932c3f6c773cc2bb11a90
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.6
|
Release files / vv_pilot_mcp-0.4.7-py3-none-any.whl
| Download URL | vv_pilot_mcp-0.4.7-py3-none-any.whl |
|---|---|
| Size | 17.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6f866d33781f328b67b5994226e1b811e70a0ba47347060ef35343361a386697
|
|
BLAKE2b-256 checksum How to use checksums |
f10699261fecfcab24c0ec76b24fe9b432f68d7252ce6e70822ed94d020658e5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.6
|
Security for vv-pilot-mcp 0.4.7
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.