Skip to main content
Glama

@yawlabs/ansible-mcp

Add to Yaw MCP

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

What is actually true in THIS Ansible checkout on THIS control node: the exact option specs of the modules you have INSTALLED (so coding agents stop writing options that do not exist in your collection version), task-argument checks, role interfaces, inventory structure and vars (redacted), play structure, effective config, requirements drift, and what a collection upgrade would break in your tasks. It is read-only: it never runs a play, never runs --check, never connects to a managed host and never supplies a vault secret. It complements Red Hat's servers rather than replacing them: AAP MCP answers what is true in the controller, ADT MCP takes actions (lint --fix, navigator runs, scaffolding, EE builds). Run them together.

npm version License: MIT

Built and maintained by Yaw Labs.

Why this one?

Your checkout has community.general 9.5.2; the model's training data has whatever version it saw most. Agents then write git_config: list_all: true (removed in 11.0.0), forget name (required since 12.0.0), or set state: present on rhsm_repository (no longer accepted). The VS Code language server knows the exact specs, but only a person in the editor sees them. This server lets the agent check before it writes, against what is installed.

  • Installed, not latest -- the source of truth is ansible-doc --json run against your collections paths, with redirects (ufw -> community.general.ufw) and tombstones resolved.

  • Checks what lint skips -- ansible-lint's args rule skips modules with action plugins (copy, template); ansible_check_task_args catches their unknown options and bad values, and says plainly which cross-option rules ansible-doc cannot express.

  • YAML 1.1 aware -- Ansible parses YAML 1.1, so unquoted off is false and 0755 is the integer 493. The server reads YAML the same way and says when that is probably a bug.

  • Read-only by construction -- configured vault password scripts never run (a server-owned dummy password file replaces them), script and plugin inventory sources are off by default, and play-level lookups are refused before Ansible parses a playbook (as is any playbook or lint target the pre-scan cannot fully read).

  • Collection upgrade impact -- downloads only the target version into its own cache and diffs the arg specs of the modules your tasks actually use, tied to file:line.

  • macOS, Linux, and Windows through WSL -- Ansible has no Windows control node; on Windows the server spawns it through wsl.exe --exec (no shell anywhere).

Related MCP server: AgentInspect MCP Server

Tools

Tool

What it does

ansible_project_info

ansible-core version, effective config file, collections and roles paths, installed ansible-* binaries, detected playbooks, inventories (with whole-file vault count), roles and requirements files. Call this first.

ansible_module_doc

Every option of one module or plugin as installed: type, required, default, choices, aliases, suboptions, deprecations, no_log, the providing collection version, [has action plugin], returns and (optionally) examples.

ansible_module_search

Find installed modules/plugins by name or description, ranked exact, prefix, token, then description.

ansible_check_task_args

Check inline task YAML or a tasks file / playbook against the installed docs: unknown options, missing required ones (aliases count), bad choices and types, suboptions, mode: 0755, deprecated options, duplicate keys. Never claims "valid": it names what ansible-doc cannot check.

ansible_role_interface

A role's argument_specs entry points and options, defaults (redacted, no_log honoured), undocumented defaults, dependencies, vars names, galaxy_info. Local roles and ns.collection.role.

ansible_inventory

Groups, hosts, and inventory-level vars (names or values), always redacted. Whole-file vaults degrade to a per-file view instead of failing.

ansible_playbook_structure

--syntax-check, then plays, matched hosts, tasks with module and file:line, tags, and the deprecation warnings Ansible printed while parsing.

ansible_config

Effective config with origins (ansible.cfg, env, default); galaxy credentials always redacted; settings the server overrides for safety are flagged.

ansible_collections

requirements.yml vs installed: ok / VIOLATES / MISSING with file:line, galaxy constraint semantics, and shadowed copies across collections paths.

ansible_lint_summary

ansible-lint --offline grouped by rule with counts, severities and locations. Never fixes.

ansible_upgrade_impact

What breaks in this project's tasks if a collection moves to an exact version: removed/moved modules (runtime.yml redirects and tombstones), removed options and aliases, newly required options, dropped choices, type and default changes, requirements constraints, requires_ansible, an optional syntax-check against the target, and a verdict.

Every tool takes an optional dir (the project). Tool names carry an ansible_ prefix and never reuse ADT MCP's names (ansible_lint, ansible_navigator, ...), so both can sit behind one aggregator.

Division of authority

Question

Authority

Controller jobs, job templates, controller inventories, RBAC

AAP MCP

Scaffold content, ansible-lint --fix, run via ansible-navigator, set up a venv or EE

ADT MCP

Interactive editing for a person

VS Code Ansible extension (language server)

Generate new content from intent

Ansible Lightspeed

Execute modules against hosts

not this server

Installed specs, task-argument validity, role interfaces, local inventory, play structure, effective config, dependency drift, collection upgrade impact

ansible-mcp (read-only)

What is read-only, and what touches the network

  • Never run: plays, modules, --check, --diff, fact gathering. The only Ansible commands are ansible --version, ansible-config dump, ansible-doc, ansible-inventory --list/--host/--graph, ansible-playbook --syntax-check/--list-*, ansible-galaxy collection list / role list, ansible-lint --offline, and (only in ansible_upgrade_impact) ansible-galaxy collection install --no-deps -p <server cache>.

  • Never written: your project, your collections and roles paths, requirements files, and anything inside an existing ~/.ansible. Ansible's local temp, galaxy cache and (when you have none) galaxy token file are redirected to the server's cache. The one residue: Ansible creates an empty ~/.ansible when it does not exist, and ansible-lint creates empty ~/.ansible/roles / ~/.ansible/collections when they are missing.

  • Vault: no secret is ever supplied, and a vault_password_file / vault_identity_list script named in ansible.cfg never runs (it is replaced by a server-owned file holding a random password). Inline !vault values print as <vaulted>; whole-file vaults are listed, not read.

  • Dynamic inventory (script, constructed, cloud plugins) runs code and calls APIs, so it is off unless ANSIBLE_MCP_ALLOW_DYNAMIC_INVENTORY=1; skipped sources are named in the answer.

  • Residual risk, stated: ansible-playbook --syntax-check (and ansible-lint, which runs it) evaluates Jinja in play-level name, hosts and vars_files and imports playbook-adjacent vars_plugins/. Treat dir as code you would run --syntax-check on. Lookups in those fields are refused before Ansible sees them unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1, and local plugin files are listed in the answer.

  • Redaction (ansible_inventory, ansible_role_interface, ansible_config, lint messages): vault markers, plus any string equal to a hidden one, plus values under secret-like names (ansible_become_password, api_token, vault_db_password, ... but not vault_addr or private_key_file), plus secret-shaped strings (private keys, JWTs, GitHub/GitLab/Slack/npm tokens; URL passwords masked in place). Galaxy server tokens and passwords are always redacted. There is no "show secrets" switch.

  • Network: only ansible_upgrade_impact, on a cache miss, to Galaxy or the servers in your ansible.cfg (openWorldHint: true). The cache is never evicted automatically; deleting it is safe.

Example ansible_check_task_args output (real docs, community.general 9.5.2):

playbooks/tasks/bad_args.yml: 7 tasks checked against installed docs (ansible-core 2.21.5): 5 problems in 3 tasks
  :3 ansible.builtin.copy [has action plugin; ansible-lint skips its arguments]
    unknown option owner_name (line 7)
    unknown option state (line 9)
    backup (line 8): expected bool, got a string that is not a boolean ('maybe')
  :12 ansible.posix.mount
    missing required option path (aliases: name)
  :18 ansible.builtin.file (key=value form): ok (dest is an alias of path)
  :21 ansible.builtin.copy: ok by docs [not checked: src and content are mutually exclusive in the module's argument_spec, which ansible-doc does not expose]
  :32 ansible.builtin.apt: ok; 2 templated values not checked (state, update_cache)
  :38 community.general.ufw (from short name ufw)
    proto (line 41): 'tcpx' is not one of any|tcp|udp|ipv6|esp|ah|gre|igmp

Example ansible_upgrade_impact output (real 9.5.2 -> 12.0.0 docs):

upgrade community.general 9.5.2 -> 12.0.0 (major) for /work/site
target: requires_ansible '>=2.17.0' ok (ansible-core 2.21.5); dependencies: none; downloaded (cache: ...)
constraints: requirements.yml:3 pins '>=9.0.0,<10.0.0' (change it to allow 12.0.0)
used modules (7): git_config, proxmox_kvm, consul_acl, slack, rhsm_repository (playbooks/site.yml); timezone (roles/common/tasks/main.yml); ufw (roles/webapp/tasks/main.yml, via short name ufw)
BREAKING (5):
  playbooks/site.yml:17 community.general.git_config: option list_all removed (line 19)
  playbooks/site.yml:17 community.general.git_config: name is newly required, not set
  playbooks/site.yml:23 community.general.proxmox_kvm: moved to community.proxmox.proxmox_kvm; community.proxmox is not installed (add it to requirements.yml)
  playbooks/site.yml:31 community.general.consul_acl: removed in 10.0.0 (tombstone): Use community.general.consul_token and/or community.general.consul_policy instead.
  playbooks/site.yml:43 community.general.rhsm_repository: state=present no longer accepted (choices: enabled, disabled) (line 45)
BEHAVIOR CHANGES (1):
  playbooks/site.yml:37 community.general.slack: prepend_hash not set; default 'auto' -> 'never'
syntax-check with 12.0.0 (playbooks/site.yml): first error playbooks/site.yml:22: couldn't resolve module/action 'community.general.proxmox_kvm' (syntax-check stops at the first error and does not check options)
verdict: BREAKING (5)

Quick start

1. Have ansible-core where the server can run it. On macOS / Linux, ansible-core (and optionally ansible-lint) on PATH, or in a venv you point ANSIBLE_MCP_BIN_DIR at. On Windows, inside WSL:

# inside WSL (any distro); a venv under $HOME survives WSL restarts, /tmp does not
python3 -m venv ~/.venvs/ansible && ~/.venvs/ansible/bin/pip install ansible-core ansible-lint

2. Add the server. Claude Code, from the project:

# macOS / Linux
claude mcp add ansible -- npx -y @yawlabs/ansible-mcp@latest

# Windows (Ansible inside WSL)
claude mcp add ansible -e ANSIBLE_MCP_COMMAND_PREFIX='["wsl.exe","-d","Ubuntu","--exec"]' -e ANSIBLE_MCP_BIN_DIR=/home/me/.venvs/ansible/bin -- cmd /c npx -y @yawlabs/ansible-mcp@latest

Or add it to .mcp.json in the project (or anywhere, and set ANSIBLE_MCP_DIR):

macOS / Linux:

{
  "mcpServers": {
    "ansible": {
      "command": "npx",
      "args": ["-y", "@yawlabs/ansible-mcp@latest"]
    }
  }
}

Windows (Ansible inside WSL):

{
  "mcpServers": {
    "ansible": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "@yawlabs/ansible-mcp@latest"],
      "env": {
        "ANSIBLE_MCP_COMMAND_PREFIX": "[\"wsl.exe\",\"-d\",\"Ubuntu\",\"--exec\"]",
        "ANSIBLE_MCP_BIN_DIR": "/home/me/.venvs/ansible/bin"
      }
    }
  }
}

Why the extra step on Windows? Since Node 20, child_process.spawn cannot directly execute .cmd files (that's what npx is on Windows). Wrapping with cmd /c is the standard workaround.

3. Restart your MCP client and ask, for example: "Add a task that opens port 8443 with ufw -- check the arguments against our installed collections first."

Windows and WSL, in detail

  • The prefix must use wsl.exe --exec (or -e), never --: with --, WSL re-parses the arguments with bash and a value like it's breaks the command. The server refuses a prefix without --exec.

  • Nothing from the Windows environment crosses into WSL. Variables the Ansible side needs (proxies, ANSIBLE_COLLECTIONS_PATH) are forwarded by name with ANSIBLE_MCP_PASS_ENV.

  • Windows paths are translated with the mount root wslpath reports (C:\work\site -> /mnt/c/work/site). A project inside WSL works too: pass dir as \\wsl.localhost\Ubuntu\home\me\site (the distro must match the prefix's -d).

  • On a Windows drive every folder looks world-writable to WSL, and Ansible then ignores ansible.cfg. When the project has one, the server sets ANSIBLE_CONFIG to it explicitly and says so.

  • The server's Ansible-side cache lives under the WSL user's ~/.cache/ansible-mcp (never /tmp, which WSL empties on restart).

Tell your agent to use it

Paste this into the project's CLAUDE.md (or AGENTS.md):

## Ansible

Module options drift between collection versions. Use the ansible MCP server:

- Call `ansible_project_info` once per session.
- Before writing or editing a task, call `ansible_module_doc` for its module, then
  run `ansible_check_task_args` on the task (or the file). Fix every problem it
  reports; quote values it flags as YAML 1.1 traps.
- Before using a role, read `ansible_role_interface`.
- Before bumping a collection in requirements.yml, run `ansible_upgrade_impact`.
- Never run plays, `--check` or `ansible-lint --fix` on your own; ask first.

Configuration

All optional.

Env var

Default

Purpose

ANSIBLE_MCP_DIR

the server's working directory

Project used when a tool call passes no dir.

ANSIBLE_MCP_COMMAND_PREFIX

(unset: native)

JSON array prepended to every Ansible command, e.g. ["wsl.exe","-d","Ubuntu","--exec"]. A value not starting with [ is split on whitespace. Required on Windows.

ANSIBLE_MCP_BIN_DIR

(unset: PATH)

Ansible-side directory holding ansible-* (a venv's bin). Also put first on the child's PATH (ansible-lint needs ansible-playbook next to it).

ANSIBLE_MCP_PATH_STYLE

auto

wsl or native. auto is wsl when the prefix starts with wsl/wsl.exe. Other prefixes (ssh, docker exec) get env -C <dir> ... and are best effort.

ANSIBLE_MCP_PASS_ENV

(unset)

Comma-separated names of server env vars to forward to the Ansible side in prefix mode.

ANSIBLE_MCP_TIMEOUT_MS

120000

Kill any Ansible command after this long (the upgrade download gets 3x).

ANSIBLE_MCP_CACHE

~/.cache/ansible-mcp

Server-side cache (and the Ansible-side one in native mode): the dummy vault file, local temp, upgrade targets. Safe to delete.

ANSIBLE_MCP_REMOTE_CACHE

$HOME/.cache/ansible-mcp on the Ansible side

The Ansible-side cache in prefix mode.

ANSIBLE_MCP_ALLOW_DYNAMIC_INVENTORY

(unset)

1 re-enables script, constructed and plugin inventory sources (they run code and may call cloud APIs).

ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS

(unset)

1 lets playbooks with lookups in play-level name / hosts / vars_files be parsed (Ansible runs those lookups on this machine).

Runtime (oam or Node):

The ansible-mcp command prefers oam when it finds a usable one and otherwise runs on Node. It never serves on an oam older than 0.19.1.

Env var

Default

Purpose

ANSIBLE_MCP_RUNTIME

auto

auto: the newest oam at 0.19.1 or newer, else Node. oam: oam or exit with an error. node: always Node -- the escape hatch when a problem only shows up under oam.

OAM_BIN

(unset)

Path to the oam binary to use. Otherwise the launcher checks OAM_INSTALL_DIR, the installed locations (~/.oam/bin, and %LOCALAPPDATA%\oam\bin on Windows) and PATH, and takes the newest.

An outdated oam is fixed with oam self-update. Under Yaw MCP, which runs servers on oam by default, yaw-mcp set <namespace> runtime=node switches this server to Node. There is no --permission sandbox option: the server spawns Ansible and reads whatever directory a call names, so there is nothing narrow to grant.

Requirements

  • Node.js 20+

  • ansible-core on the control node (verified with 2.21.5); ansible-lint for ansible_lint_summary (verified with 26.10.1)

  • Windows: WSL with ansible-core installed in a distro, and ANSIBLE_MCP_COMMAND_PREFIX set. Without it, only ansible_project_info (static half) and ansible_role_interface (local files) answer; the rest say what to set.

  • ansible_upgrade_impact: Galaxy (or your configured servers) reachable the first time a target version is requested; later runs for that version are offline

Contributing

git clone https://github.com/YawLabs/ansible-mcp.git
cd ansible-mcp
npm install
npm run lint       # Biome check
npm run lint:fix   # Auto-fix
npm run build      # tsup bundle + declarations
npm test           # Vitest (integration tests run only when Ansible is reachable)
npm run typecheck  # oam check . when oam is installed, else tsc --noEmit
npm run check:oam-floor  # the oam floor agrees across the repo and matches the latest oam release

See CONTRIBUTING.md for the full workflow, including release process.

License

MIT

Follow @YawLabs on X

Available Tools

11 tools
ansible_check_task_argsCheck task argumentsA
Read-onlyIdempotent

Check tasks (inline YAML, or a tasks file / playbook) against the INSTALLED module docs: unknown options, missing required ones, bad choices and types (YAML 1.1 aware: unquoted off/yes/0755), suboptions, deprecated options. ansible-doc cannot express cross-option rules (mutually_exclusive, required_if), so the answer says what it could not check; it catches action-plugin modules (copy, template) that ansible-lint's args rule skips.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
fileNoTasks file, role tasks file or playbook, relative to dir
lineNoOnly the task whose span contains this line
taskNoYAML: one task mapping, or a list of tasks

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds real behavioral value beyond them: it discloses a limitation (cross-option rules like mutually_exclusive/required_if cannot be checked and the answer reports what it could not check) and notes YAML 1.1 quirks (unquoted off/yes/0755) that affect results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense and front-loaded with the core purpose, then limitations. It is a single packed sentence-plus-clause, but nearly every phrase earns its place; slightly heavy for one breath but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries some of that burden; it hints at the answer's self-reported gaps, which is helpful. Combined with 100% schema coverage and rich annotations, an agent has enough to invoke it correctly, though return shape is only implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully documents dir, file, line and task, giving a baseline of 3. The description references the input forms (inline YAML, tasks file/playbook) but adds no format or syntax detail beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check) and resource (task arguments) and enumerates the exact scope: inline YAML, tasks file or playbook checked against INSTALLED module docs, covering unknown/missing/typed/deprecated options. It also positions itself against ansible-lint's args rule, so an agent can distinguish it from sibling lint/doc tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (ansible-lint's args rule) and the condition under which this tool is preferable (it catches action-plugin modules the linter skips), which is clear usage context. However, it never gives an explicit 'use this when X, not when Y' routing statement or prerequisites, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_collectionsCollections vs requirementsA
Read-onlyIdempotent

requirements.yml (collections and roles) against what is installed: ok, VIOLATES (with file:line) or MISSING, using galaxy constraint rules, plus collections shadowed across collections paths (the first in COLLECTIONS_PATHS wins). Never installs anything.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
requirementsNoRequirements file relative to dir (default: requirements.yml, collections/requirements.yml, roles/requirements.yml)
include_extrasNoList installed collections nothing requires

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, so the bar is lower, yet the description still adds real behavioral content: the exact result vocabulary (ok, VIOLATES with file:line, MISSING), that galaxy constraint rules drive the verdict, and that shadowed collections are resolved by COLLECTIONS_PATHS order. It does not describe output shape or how multiple violations are aggregated, keeping it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence that front-loads the input/output contract (requirements.yml vs installed, statuses) before the auxiliary shadowing rule. The opening fragment lacks an explicit verb, which costs it a point, but there is no filler and every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description bears the return-value burden and largely meets it by naming the three result states and the file:line detail, plus the shadowing diagnostic. Remaining gaps — output structure, aggregation of multiple failures, handling of a missing requirements file — are minor for a read-only checker.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description's mention of requirements.yml and COLLECTIONS_PATHS loosely touches the requirements and dir parameters but adds no syntax, precedence default, or meaning beyond the schema — notably nothing about include_extras.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The tool is a comparison/diff of a requirements file against installed collections and roles, returning ok/VIOLATES/MISSING — a specific operation on a specific resource, and 'Never installs anything' distinguishes it from any install-oriented sibling. The verb is implicit ('requirements.yml ... against what is installed') and the name 'ansible_collections' alone would suggest listing rather than diffing, but the title and body together make the purpose recoverable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this versus siblings such as ansible_upgrade_impact or ansible_config, and no prerequisites (e.g. must the project be a real Ansible project dir?). Only the negative 'Never installs anything' hints at scope; an agent gets no routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_configEffective Ansible configA
Read-onlyIdempotent

The effective configuration for this dir (ansible-config dump) with each setting's origin (ansible.cfg, env, default); galaxy server tokens and passwords are always redacted. Settings this server overrides for safety in its other tools (vault password files, inventory and vars plugins) are flagged.

NameRequiredDescriptionDefault
allNoEvery setting, not only those changed from the defaults
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
limitNoMax settings listed (default 300)
filterNoCase-insensitive substring of the setting name

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive, closed-world behavior, so the bar is lower. The description still adds real value beyond them: secrets (galaxy tokens, passwords) are always redacted, and settings the server overrides for safety are flagged — both material to interpreting the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with no filler; the core output contract (effective config plus origins) is front-loaded. Slightly clause-heavy but each clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must convey the return shape — and it does: settings with origins, redaction of secrets, and safety-override flags. It covers what an agent needs to interpret results, though it omits any note on pagination/truncation behavior tied to `limit`.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so `all`, `dir`, `limit`, and `filter` are already fully documented in the schema. The description adds no syntax or behavioral detail about these parameters (e.g. how `filter` interacts with `all`), so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: the effective Ansible configuration for a directory, mapped to `ansible-config dump`, with per-setting origin attribution. That is far more precise than a tautology. It does not explicitly differentiate itself from siblings like `ansible_project_info`, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: an agent infers it should call this when it needs to know which config values are in effect and where they come from. There is no explicit when-to-use/when-not or naming of an alternative sibling for related questions (e.g. project info).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_inventoryInventory structure and varsA
Read-onlyIdempotent

Groups, hosts and inventory-level vars (ansible-inventory --graph/--list/--host), always redacted: vault values, secret-like names and secret-shaped values are hidden, templates are shown unrendered. Script and plugin inventory sources run code, so they are skipped unless ANSIBLE_MCP_ALLOW_DYNAMIC_INVENTORY=1 (which can also call cloud APIs); vault secrets are never supplied, so whole-file vaults degrade to a per-file view.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
hostNoShow one host's vars (--host)
varsNonone | names | values (default: names for the list, values for host)
groupNoRoot the graph at this group
limitNoMax hosts listed (default 200)
inventoryNoInventory source relative to dir (default: ansible.cfg's)

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description goes well beyond them: always-redacted output, hidden vault/secret-shaped values, unrendered templates, the dynamic-inventory env-var gate (with a cloud-API caveat), and per-file vault degradation. This is unusually rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the resource and operations, and every clause carries information (redaction, gating, degradation). It is a dense run-on paragraph, but little is wasted; a slight structure split would improve scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries return-value burden and does explain what is included, what is redacted, and how vaults/dynamic sources degrade. It falls short of describing the concrete output shape or how 'limit' truncation surfaces, but is otherwise complete for a 6-param, no-required-param tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description maps parameters to CLI modes (--graph roots via group, --host targets a host, --list drives vars), adding meaning beyond the schema. It reinforces defaults ('names for the list, values for host') already in the schema, but the mode mapping is genuine added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource (inventory: groups, hosts, inventory-level vars) and the exact operations it maps to (--graph/--list/--host). This clearly distinguishes it from siblings like ansible_playbook_structure and ansible_project_info, which cover different artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than explicit: the note that script/plugin sources are skipped unless ANSIBLE_MCP_ALLOW_DYNAMIC_INVENTORY=1 tells the agent when dynamic inventories apply. However, there is no explicit when-to-use-this vs. an alternative sibling (e.g., project_info) guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_lint_summaryansible-lint summaryA
Read-onlyIdempotent

ansible-lint (offline) grouped by rule with counts, severities and file:line locations; never fixes anything (ADT MCP's ansible_lint fixes). Parses playbooks with Ansible: treat dir as code you would run --syntax-check on (play-level Jinja and playbook-adjacent vars plugins are evaluated); lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
pathsNoPaths relative to dir (default: lint's own discovery)
profileNomin | basic | moderate | safety | shared | production
max_locationsNoLocations listed per rule (default 5)

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds real behavioral detail on top: it never mutates files, play-level Jinja and adjacent vars plugins are evaluated during parsing, and lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1. This is exactly the kind of evaluation/gating nuance an agent cannot get from structured fields, though cost, runtime, or failure modes are unmentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Compact and front-loaded: the output shape and the non-fixing guarantee come first, execution semantics and the env-var guard second. Parenthetical asides carry real information rather than filler, though the second sentence is dense enough to require rereading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return shape ('grouped by rule with counts, severities and file:line locations') plus the max_locations tie-in, which is sufficient for an agent to plan around the result. The main missing piece is when to select this tool over the other Ansible analysis siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so dir, paths, profile, and max_locations are all documented in the schema itself; baseline is 3. The description adds only a semantic framing for dir ('treat dir as code you would run --syntax-check on') and no syntax or format detail for the other three parameters. Fair but not enriching.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('ansible-lint (offline) grouped by rule with counts, severities and file:line locations') and explicitly contrasts itself with the fixing variant ('never fixes anything (ADT MCP's ansible_lint fixes)'). An agent can tell it produces a report rather than edits. It does not distinguish itself from the listed siblings like ansible_check_task_args or ansible_playbook_structure, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies when the tool is appropriate by describing the execution model ('treat dir as code you would run --syntax-check on'), which tells the agent what class of project to point it at. However, it never states when to prefer this over sibling lint/analysis tools, nor does it give preconditions such as needing a valid project directory. Usage is inferable but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_module_docInstalled module/plugin specA
Read-onlyIdempotent

Exact options (type, required, default, choices, aliases, suboptions) of a module or plugin as INSTALLED here (ansible-doc), with the collection version that provides it and redirects resolved. Use before writing a task; options drift between collection versions, so training-data guesses are often wrong.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
nameYesFQCN or short name, e.g. community.general.ufw or ufw
typeNomodule | lookup | filter | test | callback | connection | inventory | become | cache | vars | strategy | shell | cliconf | httpapi | netconf | keywordmodule
include_returnNoList documented return values (modules)
include_examplesNoAppend the EXAMPLES block
description_charsNoTruncate each description to this many characters; 0 = no limit (default 160)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lower. The description adds meaningful behavior: redirects are resolved and the providing collection version is included, which matters for version-drift correctness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, front-loading what the tool returns before the when-to-use rationale. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully previews the returned fields and notes truncation/example toggles exist via parameters. It could say a bit more about the response shape (e.g. redirect chains, version placement), but an agent has enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters including the 'dir' fallback chain and the 'description_chars' truncation semantics. The description adds no parameter-level syntax or format detail beyond what the schema provides; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource ('Exact options of a module or plugin as INSTALLED here') and enumerates the payload ('type, required, default, choices, aliases, suboptions'), plus the collection version and resolved redirects. This is clearly distinguished from sibling tool ansible_module_search, which finds modules rather than describing one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use before writing a task') and a rationale ('options drift between collection versions, so training-data guesses are often wrong'). No named alternative or exclusion, but the usage context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_playbook_structurePlaybook structureA
Read-onlyIdempotent

Plays, matched hosts, tasks (with module and file:line where unambiguous) and tags of a playbook (ansible-playbook --syntax-check, then --list-hosts --list-tasks --list-tags), plus deprecation warnings Ansible printed while parsing; never runs a play. Parses playbooks with Ansible: treat dir as code you would run --syntax-check on (play-level Jinja and playbook-adjacent vars plugins are evaluated); lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
tagsNoOnly these tags (--tags)
limitNoHost pattern (--limit)
playbookYesPlaybook path relative to dir
inventoryNoInventory source relative to dir
max_tasksNoMax tasks listed (default 300)
skip_tagsNoSkip these tags (--skip-tags)

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), yet the description adds substantial behavioral context beyond them: the exact underlying ansible-playbook invocations, the guarantee that no play executes, the fact that play-level Jinja and adjacent vars plugins ARE evaluated during parsing, and that lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1. The execution-side-effect disclosure is exactly what an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the return shape before the parsing semantics. The second sentence is dense with nested parentheticals and the env-var caveat, which makes it slightly harder to skim, but no clause is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the burden of describing the return value, and it does so explicitly (plays, hosts, tasks with file:line, tags, deprecation warnings) while also disclosing the parsing model and the lookup restriction. An agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each of the 7 parameters carries its own CLI-flag mapping (--tags, --limit, --syntax-check, etc.), so the schema already does the heavy lifting. The description adds no per-parameter syntax or constraint detail, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and enumerates exactly what it returns: plays, matched hosts, tasks with module and file:line, tags, and parsing deprecation warnings. This is clearly distinct from siblings like ansible_lint_summary or ansible_inventory, which cover different artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives strong context: it is a static analysis tool ('never runs a play') and explicitly frames the playbook as code you would run --syntax-check on. It does not, however, name an alternative sibling or state when to prefer e.g. ansible_lint_summary over this, so the routing guidance is contextual rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_project_infoAnsible project overviewA
Read-onlyIdempotent

What this Ansible checkout contains and how Ansible sees it: ansible-core version, effective config file, collections and roles paths, installed ansible-* binaries, detected playbooks, inventories, roles and requirements files. Call it first. Read-only; never connects to a managed host (AAP MCP covers controller state, ADT MCP takes actions).

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is covered. The description still adds a genuine behavioral fact beyond them: it never connects to a managed host, which tells the agent there are no side effects or remote auth requirements. It stops short of describing cost or output size, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The high-value instruction ('Call it first') is placed after the content list but before the routing clause, and each clause in the enumeration maps to something the tool actually returns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description compensates by listing the returned categories in detail. Combined with the annotations covering safety and idempotency, an agent has everything needed to decide to call it and to interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single optional parameter and schema coverage is 100% – the schema already documents the ANSIBLE_MCP_DIR / working-directory fallback that the description would otherwise need to supply. The description adds no additional semantics for 'dir', so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a concrete verb-plus-resource framing ('What this Ansible checkout contains and how Ansible sees it') and then enumerates the exact payload: ansible-core version, effective config, collections/roles paths, binaries, playbooks, inventories, roles, requirements files. That enumeration lets an agent separate it from siblings like ansible_config or ansible_collections, which each return a narrower slice.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Call it first' states the ordering explicitly, and the parenthetical routes work away from this tool: controller state goes to AAP MCP, actions to ADT MCP. Both the when and the when-not are present, so the agent has a decision rule rather than an inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_role_interfaceRole interfaceA
Read-onlyIdempotent

A role's interface: argument_specs entry points and options (no_log honoured), defaults with redacted values, which defaults are undocumented, dependencies, vars names and galaxy_info. Works for local roles (roles_path, dir/roles, or a path) and collection roles (ns.collection.role).

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
roleYesLocal role name, path relative to dir, or ns.collection.role
entry_pointNoOnly this entry point (default: all)
description_charsNoTruncate each description to this many characters; 0 = no limit (default 160)

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so safety is covered. The description goes beyond that by disclosing output-handling behavior the agent cannot infer: no_log is honoured, default values are redacted, and undocumented defaults are flagged — genuinely useful context for interpreting results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the output inventory front-loaded. The first sentence is dense with a long comma-separated list, but every item is substantive content rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry the return-value burden — and it does, enumerating the sections returned and noting redaction. Combined with read-only annotations and covered input forms, an agent has enough to call and interpret this correctly; only the absence of explicit sibling routing keeps it from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all four parameters, giving a baseline of 3. The description adds resolution semantics not present in the schema, notably the roles_path lookup and the dir/roles convention, which clarifies how the required 'role' argument is resolved.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the specific resource (a role's interface) and enumerates exactly what it surfaces: argument_specs entry points/options, defaults (redacted), undocumented defaults, dependencies, vars names, galaxy_info. That is far more precise than a tautology, and the resource is clearly distinct from siblings like ansible_module_doc or ansible_playbook_structure, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the accepted role forms ('local roles (roles_path, dir/roles, or a path) and collection roles (ns.collection.role)'), which tells the agent what inputs are valid but not when to prefer this tool over alternatives such as ansible_module_doc or ansible_project_info. Usage is implied rather than routed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ansible_upgrade_impactCollection upgrade impactA
Read-onlyIdempotent

What breaks in THIS project's tasks if one collection moves to an exact version: removed or moved modules (meta/runtime.yml redirects and tombstones), removed options and aliases, newly required options, dropped choices, type and default changes, each tied to the task's file:line, plus requirements.yml constraints and a verdict. Downloads the target collection from Galaxy (or the configured servers) into this server's cache on first use; never touches dir, requirements files or your collections paths.

NameRequiredDescriptionDefault
dirNoAnsible project directory. Default: ANSIBLE_MCP_DIR, else the server's working directory.
versionYesExact target version, e.g. 12.0.0 (not a constraint)
playbooksNoPlaybooks to walk (default: all detected)
collectionYesnamespace.name, e.g. community.general
syntax_checkNoConfirm with ansible-playbook --syntax-check against the target
include_unusedNoAlso list removed/moved/deprecated content of the collection this project does not use (capped at 200)

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover read-only/idempotent/non-destructive, and the description adds genuinely non-derivable behavior: it downloads the target collection from Galaxy or configured servers into the server's cache on first use (network + latency implication) and explicitly guarantees it will not modify the project directory, requirements files, or collections paths. That mutation-safety boundary is exactly the kind of context annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences with no filler; the finding categories and the side-effect guarantee are front-loaded before the download caveat. The enumeration of change classes is long but each item is informative rather than redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter, no-output-schema analysis tool, the description conveys the return shape (per-finding file:line attribution, requirements.yml constraints, a verdict) and the side-effect profile, which is what an agent needs to decide to call it. Minor gaps remain around syntax_check interplay and result ordering, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters like dir, version, playbooks, syntax_check, and include_unused are already fully documented in the schema. The description mentions requirements.yml constraints and the file:line attribution, but adds no syntax, format, or default nuance beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with unusual precision: it reports what breaks in the current project's tasks when one collection moves to an exact version, enumerating the change classes (redirects, tombstones, removed options/aliases, newly required options, dropped choices, type/default changes). This is clearly differentiable from siblings like ansible_collections (inventory of installed collections) or ansible_module_doc (docs lookup).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'if one collection moves to an exact version' framing establishes the triggering scenario clearly, and the download/caching sentence plus 'never touches dir, requirements files or your collections paths' sets expectations for a pre-upgrade probe. However, no alternative tool is named for adjacent questions (e.g. a plain version listing), so an agent must infer the boundary rather than being routed explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.2
    • First observedansible_check_task_args
    • First observedansible_collections
    • First observedansible_config
    • First observedansible_inventory
    • First observedansible_lint_summary
    • First observedansible_module_doc
    • First observedansible_module_search
    • First observedansible_playbook_structure
    • First observedansible_project_info
    • First observedansible_role_interface
    • First observedansible_upgrade_impact

TDQS

A4.1/5.0

Scored across 11 tools

Disambiguation5/5

Each tool targets a clearly distinct facet of Ansible project analysis: inventory, config, project info, playbook structure, role interface, module docs/search, task-arg validation, collections requirements, lint summary, and upgrade impact. The descriptions explicitly differentiate overlapping-sounding tools (e.g., ansible_check_task_args vs ansible_lint_summary, ansible_module_doc vs ansible_module_search), leaving no real ambiguity.

Naming Consistency4/5

All tools use a consistent ansible_ prefix and snake_case, which is highly predictable. The only minor deviation is mixed verb/noun construction (ansible_check_task_args and ansible_module_search are verb-led, while most others are noun phrases), but this remains readable and consistent enough.

Tool Count5/5

11 tools is well within the ideal 3-15 range for a read-only Ansible project analysis server. Each tool earns its place by covering a distinct inspection or validation concern, with no obvious redundancy.

Completeness4/5

The surface is broad and complete for read-only analysis: project info, config, inventory, playbook structure, roles, modules, task args, collections, lint, and upgrade impact are all covered. Minor gaps exist, such as no explicit variable-precedence or host-fact inspection tool, but these are largely workaroundable or intentionally out of scope.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    C
    quality
    F
    maintenance
    This Model Context Protocol server enables AI assistants to interact directly with Ansible, allowing them to execute playbooks, manage inventory, check syntax, and perform other Ansible operations.
    18
    27
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Read-only local MCP server for inspecting AgentInspect TypeScript AI-agent traces. Lists runs, exposes bounded causal-failure and TraceFacts evidence, evaluates TraceContract checks, compares runs, and creates share-checked evidence without mutating traces or invoking agent tools.
    8,881 npm
    168
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables safe, local DevOps inspection through a JSON-lines server with schema validation, path isolation, and redaction, supporting read-only Git operations, Kubernetes YAML validation, Terraform plan summaries, and sanitized log analysis.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Read-only MCP server that enables inspecting and auditing markdown agent steering files such as CLAUDE.md, AGENTS.md, GEMINI.md, SKILL.md, rules, commands and memory files. It reads files byte-exactly, outlines headings, lints frontmatter, invisible characters and broken links, estimates per-session token budgets, and locates steering files by when they load, all without ever writing, deleting or making network calls.
    MIT