AnsibleByExample

Ansible MCP Security and Compliance Example: Audit Trail Queries via AI

Beginner
2024-01-014By Luca Berton

Lesson 1 of 16 in Security & Compliance

Ansible Security and Compliance Automation — full curriculum
  1. 1. The Compliance-as-Code Model (and Where Ansible Fits)
  2. 2. Ansible's Security Automation Building Blocks
  3. 3. CIS Benchmarks and DISA STIGs Explained
  4. 4. Scanning Hosts for Compliance Drift with OpenSCAP and Ansible
  5. 5. Ansible Lockdown: Using STIG and CIS Roles in Practice
  6. 6. Custom Compliance Checks with assert and Facts
  7. 7. Remediating Findings Safely
  8. 8. CVE-Driven Patch Management
  9. 9. Firewall and SELinux Hardening at Scale
  10. 10. User, Access and Sudo Policy Enforcement
  11. 11. Secrets and Credential Hygiene at Scale
  12. 12. Audit Logging, Reporting and Evidence for Auditors
  13. 13. Event-Driven Remediation with Event-Driven Ansible
  14. 14. Continuous Compliance in CI/CD Pipelines
  15. 15. Change Control and Safe Rollback for Security Playbooks
  16. 16. Capstone: Automated Compliance Pipeline — Scan, Remediate, Report
View path overview →

Red Hat's hosted MCP (Model Context Protocol) Server for Ansible Automation Platform is a Tech Preview that exposes AAP as declarative tools for any LLM or agentic client. Of its 107 tools spread across six tool sets, 12 belong to the Security and compliance set — audit trails and policy checks — which is what lets an AI assistant answer "who changed what, and was it allowed?" without you writing a single API call.

Example: connecting Cursor to the MCP Security and Compliance tools

# mcp-client-config.yaml
# Example client-side config for connecting an MCP-aware agent (e.g. Cursor)
# to Red Hat's hosted MCP Server for Ansible Automation Platform (Tech Preview).
mcpServers:
  aap:
    url: "https://aap.example.com/mcp/v1"
    transport: "http"
    auth:
      type: "bearer"
      token: "{{ aap_mcp_bearer_token }}"   # short-lived token, not a static secret
    toolsets:
      - security_and_compliance   # 12 tools: audit trails, policy checks
      - job_management            # 25 tools, useful for cross-referencing

# retrieve-token.yml
# Playbook fragment showing where the bearer token used above actually comes from.
- name: Fetch a short-lived MCP bearer token from AAP
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Request token via controller_token module
      ansible.controller.token:
        controller_host: "https://aap.example.com"
        controller_username: "{{ aap_username }}"
        controller_password: "{{ aap_password }}"
        scope: "read"
      register: aap_token

    - name: Show token expiry (do not log the token itself)
      ansible.builtin.debug:
        msg: "Token expires: {{ aap_token.token.expires }}"

What this does

The client config is what a tool like Cursor loads to speak MCP to AAP over plain HTTP with Bearer-token auth — exactly the setup Fred van Zwieten used in the live demo at Red Hat Tech Day Netherlands 2026 in Bunnik. Once connected, the security_and_compliance toolset gives the LLM 12 declarative endpoints for audit trails and policy checks; the model never touches the AAP database directly, it calls tools the server exposes, so the request/response shape is fixed by AAP itself, not by the model's imagination.

Natural-language example transcript

This is the kind of exchange the Security and compliance tools were built for — an auditor or platform engineer asking in plain English instead of building a report:

User:  Show me every credential change in the last 7 days and flag
       anything outside business hours.

Agent: [calls security_and_compliance.list_audit_events
        filter: object_type=credential, since=-7d]

       Found 4 credential events:

       | Timestamp (UTC)      | User      | Action  | Object            | In hours? |
       |-----------------------|-----------|---------|-------------------|-----------|
       | 2026-05-28 09:14:02  | j.decker  | UPDATE  | aws-prod-creds    | yes       |
       | 2026-05-29 02:47:51  | svc-cicd  | CREATE  | vault-staging     | no        |
       | 2026-06-01 14:02:10  | a.molina  | DELETE  | old-vcenter-cred  | yes       |
       | 2026-06-02 23:58:44  | j.decker  | UPDATE  | aws-prod-creds    | no        |

       Two events (2026-05-29 and 2026-06-02) occurred outside the
       09:00-18:00 CET business-hours window. Want me to check the
       policy rules to see if off-hours credential changes require
       an approval ticket?

User:  Yes, check that.

Agent: [calls security_and_compliance.check_policy_compliance
        policy=credential-change-approval]

       Policy "credential-change-approval" requires a linked change
       ticket for any credential UPDATE/DELETE outside business hours.
       The 2026-06-02 update by j.decker has no linked ticket — flagged
       as a compliance gap. The 2026-05-29 CREATE by svc-cicd is exempt
       (service accounts under automated CI policy).

The same guardrail behavior Red Hat demoed elsewhere in the session applies here too: the agent can only ask questions the MCP tools allow, it cannot silently rewrite an audit record or waive a policy check — that logic still lives in AAP, not in the model.

Notes / Gotchas

  • Read vs. write scope. Security and compliance tools are audit and policy checks — use a read-scoped bearer token. Nothing in this toolset should require write access to AAP.
  • Tech Preview caveat. The MCP Server was shown as Tech Preview at Red Hat Tech Day Netherlands 2026; treat tool names and exact payloads as subject to change before GA.
  • Token hygiene. Bearer tokens shown in demos are short-lived; never hardcode one in mcp-client-config.yaml — template it in from a vault or your CI secret store.
  • Cross-reference, don't trust blindly. As with the job-management demo (where the agent found a typo and a race condition purely from job stdout), treat audit answers as a starting point for investigation, not a final compliance sign-off.

Natural-language audit queries over MCP don't replace AAP's own RBAC and policy engine — they just make asking the right question faster, while AAP keeps enforcing the answer.

References

All Tutorials