What Is MCP in Ansible Automation Platform — Model Context Protocol

┌─────────────┐     MCP      ┌──────────────────┐
│ AI Model    │ ◄──────────► │ MCP Server       │
│ (LLM)       │              │ (Tool Provider)  │
└─────────────┘              │                  │
                             │ - Ansible Inventory│
                             │ - Playbook Repo    │
                             │ - AAP API          │
                             │ - Execution History │
                             └──────────────────┘

# What Lightspeed with MCP context can do:
# 1. Know your inventory groups → suggest correct host patterns
# 2. Know installed collections → use correct FQCN
# 3. Know variable naming → follow your conventions
# 4. Know execution history → suggest fixes for failed tasks
# 5. Know your roles → suggest role usage instead of inline tasks

# AAP MCP capabilities:
resources:
  - inventory:
      description: "Current inventory structure and host facts"
      uri: "aap://inventories"
  - job_templates:
      description: "Available job templates and their parameters"
      uri: "aap://job-templates"
  - execution_history:
      description: "Recent job runs, failures, and changes"
      uri: "aap://jobs"
  - credentials:
      description: "Available credential types (not values)"
      uri: "aap://credentials"

tools:
  - launch_job:
      description: "Launch an existing job template"
      parameters:
        template_id: integer
        extra_vars: object
  - check_inventory:
      description: "Query inventory for hosts matching criteria"
      parameters:
        group: string
        filter: string

User: "Deploy our web app to the staging servers"

Without MCP:
→ Generic playbook with placeholder inventory names

With MCP (knows your AAP):
→ Playbook targeting 'staging_webservers' group
→ Uses your custom 'deploy_app' role
→ References correct vault-encrypted variables
→ Follows your naming conventions
→ Includes your standard health check pattern

User: "The nginx deployment failed on web3"

Without MCP:
→ Generic nginx troubleshooting steps

With MCP (knows your execution history):
→ "Job #4521 failed on web3 at task 'Deploy nginx config'
   Error: Template validation failed — nginx.conf.j2 has
   undefined variable 'ssl_cert_path'.
   
   This variable is defined in group_vars/production.yml
   but web3 was recently moved to the 'staging' group
   where it's not set.
   
   Fix: Add ssl_cert_path to group_vars/staging.yml
   or move web3 back to the production group."

User: "Scale the web tier to 10 instances"

MCP Server checks:
1. Current inventory: 5 web servers in 'webservers' group
2. Available job template: 'provision-webserver' 
3. Cloud credentials: AWS configured
4. Last scaling event: 3 → 5 on March 15

AI response:
→ Launches 'provision-webserver' template 5 times
→ Adds new hosts to 'webservers' group
→ Runs 'deploy-app' template on new hosts
→ Updates load balancer configuration

# ansible_mcp_server.py (conceptual)
from mcp.server import MCPServer

server = MCPServer("ansible-project")

@server.resource("inventory")
async def get_inventory():
    """Expose inventory structure to AI"""
    return parse_inventory("inventory/production/hosts.yml")

@server.resource("roles")
async def get_roles():
    """Expose available roles and their defaults"""
    return scan_roles("roles/")

@server.resource("recent_failures")
async def get_failures():
    """Expose recent playbook failures"""
    return query_aap_api("/api/v2/jobs/?status=failed&page_size=10")

@server.tool("run_playbook")
async def run_playbook(playbook: str, inventory: str, extra_vars: dict):
    """Launch a playbook execution"""
    return launch_via_aap(playbook, inventory, extra_vars)

// VS Code settings.json
{
  "ansible.lightspeed.enabled": true,
  "ansible.lightspeed.mcpServers": [
    {
      "name": "my-aap",
      "url": "https://aap.example.com/mcp",
      "auth": "bearer-token"
    }
  ]
}

# MCP for Ansible must respect:
# 1. RBAC — AI can only access what the user can access
# 2. Credential isolation — Never expose secrets through MCP
# 3. Audit logging — All MCP-triggered actions are logged
# 4. Approval gates — Destructive actions require human approval
# 5. Read vs Write — Separate permissions for querying vs executing