What this Ansible checkout contains and how Ansible sees it: ansible-core version, effective config file, collections and roles paths, installed ansible-* binaries, detected playbooks, inventories, roles and requirements files. Call it first. Read-only; never connects to a managed host (AAP MCP covers controller state, ADT MCP takes actions).

Exact options (type, required, default, choices, aliases, suboptions) of a module or plugin as INSTALLED here (ansible-doc), with the collection version that provides it and redirects resolved. Use before writing a task; options drift between collection versions, so training-data guesses are often wrong.

Find installed modules or plugins by name or description (ansible-doc -l), ranked exact name, prefix, token, then description match. Pass query, collection, or both.

Check tasks (inline YAML, or a tasks file / playbook) against the INSTALLED module docs: unknown options, missing required ones, bad choices and types (YAML 1.1 aware: unquoted off/yes/0755), suboptions, deprecated options. ansible-doc cannot express cross-option rules (mutually_exclusive, required_if), so the answer says what it could not check; it catches action-plugin modules (copy, template) that ansible-lint's args rule skips.

A role's interface: argument_specs entry points and options (no_log honoured), defaults with redacted values, which defaults are undocumented, dependencies, vars names and galaxy_info. Works for local roles (roles_path, dir/roles, or a path) and collection roles (ns.collection.role).

Groups, hosts and inventory-level vars (ansible-inventory --graph/--list/--host), always redacted: vault values, secret-like names and secret-shaped values are hidden, templates are shown unrendered. Script and plugin inventory sources run code, so they are skipped unless ANSIBLE_MCP_ALLOW_DYNAMIC_INVENTORY=1 (which can also call cloud APIs); vault secrets are never supplied, so whole-file vaults degrade to a per-file view.

Plays, matched hosts, tasks (with module and file:line where unambiguous) and tags of a playbook (ansible-playbook --syntax-check, then --list-hosts --list-tasks --list-tags), plus deprecation warnings Ansible printed while parsing; never runs a play. Parses playbooks with Ansible: treat dir as code you would run --syntax-check on (play-level Jinja and playbook-adjacent vars plugins are evaluated); lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1.

The effective configuration for this dir (ansible-config dump) with each setting's origin (ansible.cfg, env, default); galaxy server tokens and passwords are always redacted. Settings this server overrides for safety in its other tools (vault password files, inventory and vars plugins) are flagged.

requirements.yml (collections and roles) against what is installed: ok, VIOLATES (with file:line) or MISSING, using galaxy constraint rules, plus collections shadowed across collections paths (the first in COLLECTIONS_PATHS wins). Never installs anything.

ansible-lint (offline) grouped by rule with counts, severities and file:line locations; never fixes anything (ADT MCP's ansible_lint fixes). Parses playbooks with Ansible: treat dir as code you would run --syntax-check on (play-level Jinja and playbook-adjacent vars plugins are evaluated); lookups in play-level fields are refused unless ANSIBLE_MCP_ALLOW_PLAY_LOOKUPS=1.

What breaks in THIS project's tasks if one collection moves to an exact version: removed or moved modules (meta/runtime.yml redirects and tombstones), removed options and aliases, newly required options, dropped choices, type and default changes, each tied to the task's file:line, plus requirements.yml constraints and a verdict. Downloads the target collection from Galaxy (or the configured servers) into this server's cache on first use; never touches dir, requirements files or your collections paths.