ansible-log-mcp

MCP server that lets Claude Desktop trigger Ansible-driven log scans across an inventory group (e.g. patching_group, up to 200+ hosts) and returns combined results.

Architecture

Claude Desktop -> MCP server (stdio) -> Ansible playbook -> target hosts (parallel forks) -> combined result -> back up the same chain.

Related MCP server: log-analyzer-mcp

Setup

git clone <this-repo>
cd ansible-log-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Edit config.yaml:

• playbook_dir / inventory_path — point at real paths

• allowed_groups — restrict to groups this server may touch

Symlink the real inventory instead of duplicating it:

ln -sf /etc/ansible/hosts playbooks/inventory/hosts.ini

Test before wiring into Claude Desktop

# 1. Playbook directly, against a small test group
ansible-playbook playbooks/logscan.yml \
  -i playbooks/inventory/hosts.ini \
  -e target_group=dev_test_hosts -e search_pattern=error -f 5

# 2. Unit tests
pytest tests/

# 3. MCP server via inspector (browser UI, no Claude Desktop needed)
npx @modelcontextprotocol/inspector python3 server/ansible_mcp.py

Wire into Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "ansible-logs": {
      "command": "/absolute/path/to/.venv/bin/python3",
      "args": ["/absolute/path/to/ansible-log-mcp/server/ansible_mcp.py"]
    }
  }
}

Restart Claude Desktop. Ask: "scan patching_group for kernel panics in the last day."

Security notes

• Runs as a dedicated claude-agent SSH user, key-based auth only

• allowed_groups in config.yaml is the only guardrail on scope — keep it tight

• No become: true by default; add sudo only for specific read commands if needed, not blanket root