Skip to main content
Glama
kauzy7

F5 AI Security Docs MCP Server

by kauzy7

F5 AI Security Docs MCP Server

An MCP server that provides search and fetch tools over the entire F5 AI Security documentation site, modeled after the Strands Agents MCP server.

It exposes two tools to MCP-compatible AI assistants:

  • search_docs – TF-IDF, Markdown-aware ranked search across all docs pages.

  • fetch_doc – Token-efficient reader: page catalog → table of contents → individual sections.

How it enumerates the whole site

docs.aisecurity.f5.com is a VitePress static site. VitePress publishes a complete page manifest at /hashmap.json whose keys are the markdown source paths for every rendered page. The server downloads that file once at startup and derives a URL for each page:

api-docs_first-steps.md           -> /api-docs/first-steps.html
release-notes_2026-06-17-saas.md  -> /release-notes/2026-06-17-saas.html
operations_get_scans.md           -> /operations/get_scans.html
index.md                          -> /index.html

(First _ becomes the section separator; .md becomes .html.)

This captures all ~219 pagessystem-overview/, get-started/, application-docs/, api-docs/, api-reference/, the full REST operations/ reference, integrations/, red-team/, use-cases/, reference/, glossary, and release-notes/ — with no fragile HTML crawling.

Related MCP server: FastMCP Documentation Search Server

Architecture

src/f5_aisec_mcp_server/
  config.py              # base_url, allowed host, hashmap path, timeouts
  server.py              # search_docs + fetch_doc MCP tools
  utils/
    page_source.py       # download /hashmap.json -> [(title, url), ...]
    cache.py             # global index + lazy page hydration
    doc_fetcher.py       # HTTP fetch + VitePress HTML -> clean text
    indexer.py           # lightweight TF-IDF inverted index (stdlib only)
    text_processor.py    # titles, snippets, TOC/section parsing

Flow: at startup the hashmap is parsed and the TF-IDF index is seeded with page titles only (no content fetched → fast start). search_docs ranks by title, then lazily fetches the top results to build content snippets. fetch_doc lets the model browse a page's TOC and pull just the section it needs.

Install / Run

Requires Python 3.13+ (developed and tested on 3.13.14).

cd f5-aisec-mcp
python3.13 -m venv venv && source venv/bin/activate
pip install -e ".[dev]"

# Quick-test with the MCP Inspector
npx @modelcontextprotocol/inspector python -m f5_aisec_mcp_server

MCP client configuration

Point command at the venv's Python (absolute path) so the right interpreter and installed mcp package are used:

{
  "mcpServers": {
    "f5-aisec": {
      "command": "/Users/<<USER>>/path/to/project/f5-aisec-mcp/venv/bin/python",
      "args": ["-m", "f5_aisec_mcp_server"],
      "env": { "FASTMCP_LOG_LEVEL": "INFO" },
      "disabled": false,
      "autoApprove": ["search_docs", "fetch_doc"]
    }
  }
}

Tests

pytest tests/

Available Tools

2 tools
fetch_docA

Read F5 AI Security documentation pages with smart sectioning.

Modes:

  1. Catalog mode (omit uri): returns all available document URLs+titles.

  2. TOC mode (uri, no section): returns the page preamble plus a table of contents with section IDs, titles and summaries.

  3. Section mode (uri + section): returns the full content of one section identified by its TOC ID (e.g. "3" or "3.2").

Small documents (under ~8KB) are returned in full regardless of mode.

Recommended workflow:

  1. search_docs("your query") - find relevant URLs

  2. fetch_doc(uri="...") - see structure, preamble and section summaries

  3. fetch_doc(uri="...", section="3") - read the section you need

Args: uri: Document URL (must be under https://docs.aisecurity.f5.com/). If empty, returns a catalog of all available document URLs. section: Section ID from the TOC (e.g. "3" or "3.2"). Omit to get the table of contents.

Returns: Catalog / TOC / section payload, or an error dict on failure.

ParametersJSON Schema
NameRequiredDescriptionDefault
uriNo
sectionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility. It discloses that the tool returns different payloads depending on mode, that small documents are returned fully, that the URI must be under a specific domain, and that errors are returned as dicts. It could mention potential rate limits or loading behavior, but overall it is quite transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections for modes, workflow, args, and returns. It is slightly verbose but every sentence adds value. Front-loading with the main purpose is good. Minor room for trimming, but effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (three modes) and the presence of an output schema, the description covers all necessary aspects: modes, workflow, parameter usage, small document handling, URL constraint, and error return. It is comprehensive and leaves no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description explains both parameters in detail: what happens when uri is omitted (catalog), when section is omitted (TOC), and how section IDs like '3.2' work. It also specifies the URI constraint (must be under https://docs.aisecurity.f5.com/).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Read F5 AI Security documentation pages with smart sectioning.' It describes three distinct modes (catalog, TOC, section) and provides a recommended workflow that distinguishes it from the sibling tool search_docs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use each mode (e.g., 'Catalog mode (omit uri)' and 'Section mode (uri + section)') and gives a recommended three-step workflow. It also clarifies edge cases like small documents being returned fully.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_docsA

Search the F5 AI Security documentation and return ranked results.

Indexes the entire docs.aisecurity.f5.com site (system overview, getting started/installation, application & API docs, the full REST API reference, integrations, red-team campaigns, use cases, glossary, and release notes).

Use this to find relevant F5 AI Security documentation for any question about scanners, providers, projects, campaigns, the API, deployment, etc.

Args: query: Search query string (e.g. "create a custom scanner", "openai compatibility", "guardrails pii", "get scans endpoint"). k: Maximum number of results to return (default: 5).

Returns: List of dictionaries containing: - url: Document URL - title: Display title - score: Relevance score (higher is better) - snippet: Contextual content preview

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes
kNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the indexing scope (entire site), that results are ranked, and the return format. It does not mention rate limits or auth, but for a search tool these are less critical. The transparency is good.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. It starts with a one-sentence summary, then details indexed content, use cases, and parameter descriptions. Every sentence adds value, and it is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (search with two parameters), the description adequately covers indexing scope, parameters, return format, and use cases. An output schema exists (as per context signals) and is described in text, making the documentation complete for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must add meaning. It does: for 'query', it provides example queries; for 'k', it explains 'Maximum number of results to return (default: 5)'. This adds value beyond the schema, though no parameter-level details about expected formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches F5 AI Security documentation and returns ranked results. It specifies the indexed content (entire docs site, including specific sections). This distinguishes it from the sibling 'fetch_doc', which likely retrieves a single document.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to find relevant F5 AI Security documentation for any question about...' and lists example topics. While it doesn't explicitly say when not to use, the context of sibling tool 'fetch_doc' implies this is for searching, not retrieving. Clear usage guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.0
    • First observedfetch_doc
    • First observedsearch_docs

TDQS

A4.6/5.0

Scored across 2 tools

Disambiguation5/5

The two tools have clearly distinct purposes: fetch_doc retrieves documentation content (catalog, TOC, or section), while search_docs finds relevant documents via search. There is no overlap.

Naming Consistency5/5

Both tool names follow a consistent verb_noun pattern (fetch_doc, search_docs), using snake_case and parallel structure.

Tool Count3/5

With only 2 tools, the server is on the low end of the acceptable range. While they cover search and retrieval, a typical documentation server might include additional tools like list_docs or get_doc_metadata.

Completeness5/5

The tools cover the full lifecycle for documentation consumption: search to find documents, fetch_doc to browse catalog, get TOC, and read sections. There are no obvious gaps for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers