openstack-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OS_CLOUD | No | Name of the cloud in clouds.yaml. Credentials come from openstacksdk: OS_CLOUD with clouds.yaml, or OS_* variables (password or application credentials). | |
| OS_CACERT | No | CA bundle path. OPENSTACK_MCP_CACERT_PEM takes precedence over OS_CACERT. | |
| OS_AUTH_URL | No | Keystone authentication URL, e.g. https://keystone.example.com:5000/v3. | |
| OS_PASSWORD | No | Password for password authentication. | |
| OS_USERNAME | No | Username for password authentication. | |
| OS_PROJECT_ID | No | Project ID for password authentication. | |
| OS_REGION_NAME | No | Region name, e.g. RegionOne. | |
| OS_PROJECT_NAME | No | Project name (alternative to OS_PROJECT_ID). | |
| OPENSTACK_MCP_MODE | No | readonly or admin. | readonly |
| OS_USER_DOMAIN_NAME | No | User domain name, e.g. Default. | |
| OS_CLIENT_CONFIG_FILE | No | Path to clouds.yaml. clouds.yaml is found the usual way (OS_CLIENT_CONFIG_FILE, ./clouds.yaml, ~/.config/openstack/clouds.yaml, /etc/openstack/). | |
| OPENSTACK_MCP_HTTP_HOST | No | HTTP bind host; path is /mcp. | 127.0.0.1 |
| OPENSTACK_MCP_HTTP_PORT | No | HTTP bind port. | 8000 |
| OPENSTACK_MCP_LOG_LEVEL | No | stderr log level. SDK loggers stay at CRITICAL. | WARNING |
| OPENSTACK_MCP_MAX_LIMIT | No | Largest accepted limit (up to 1000). | 100 |
| OPENSTACK_MCP_TRANSPORT | No | stdio or streamable-http. | stdio |
| OPENSTACK_MCP_CACERT_PEM | No | CA bundle as PEM text; takes precedence over OS_CACERT. | |
| OPENSTACK_MCP_API_TIMEOUT | No | Seconds per OpenStack request; no retries. | 10 |
| OPENSTACK_MCP_PROJECT_IDS | No | Comma-separated project IDs the server may use; the first is the default. | |
| OPENSTACK_MCP_DEFAULT_LIMIT | No | Items per list call when limit is omitted. | 50 |
| OPENSTACK_MCP_ALLOW_INSECURE | No | Allow verify: false or an http:// auth URL. | false |
| OPENSTACK_MCP_ENABLE_PROMPTS | No | Register the prompt. | true |
| OS_APPLICATION_CREDENTIAL_ID | No | Application credential ID for application credential authentication. | |
| OPENSTACK_MCP_ENABLE_RESOURCES | No | Register openstack://scope. | true |
| OPENSTACK_MCP_HTTP_ALLOW_REMOTE | No | Allow a non-loopback HTTP bind. The HTTP transport has no authentication. | false |
| OPENSTACK_MCP_ENABLE_WRITE_TOOLS | No | With admin, registers write tools. | false |
| OPENSTACK_MCP_MAX_RESPONSE_BYTES | No | Largest result; larger ones fail with response_too_large. | 524288 |
| OS_APPLICATION_CREDENTIAL_SECRET | No | Application credential secret for application credential authentication. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_scopeA | Show mode, allowed projects, limits and whether credentials are configured. Does not contact the cloud. Call it first. |
| list_serversB | List servers in the project with flavor, image, addresses and volumes. Paged with limit and marker. |
| get_serverC | Get one server by ID. |
| list_flavorsA | List flavors visible to the project: vCPUs, RAM (MiB), disk (GiB). Paged with limit and marker. |
| list_imagesB | List images visible to the project, optionally filtered. Paged with limit and marker. |
| get_imageC | Get one image by ID. |
| list_volumesA | List volumes in the project with size (GiB), type and attachments. Paged with limit and marker. |
| get_volumeC | Get one volume by ID. |
| list_volume_attachmentsA | List Cinder attachment records (API microversion 3.27 or later). Connection details are not returned. Paged with limit and marker. |
| get_volume_attachmentA | Get one Cinder attachment record by ID, without connection details. |
| list_networksA | List the project's networks, or shared networks with shared=true. Paged with limit and marker. |
| get_networkC | Get one network by ID. |
| list_subnetsB | List the project's subnets with CIDR, gateway and DHCP settings. Paged with limit and marker. |
| get_subnetC | Get one subnet by ID. |
| list_portsB | List the project's ports with fixed IPs and security groups. Paged with limit and marker. |
| get_portB | Get one port by ID, including allowed address pairs. |
| list_floating_ipsC | List the project's floating IPs and the ports they map to. Paged with limit and marker. |
| list_routersB | List the project's routers with gateway and static routes. Paged with limit and marker. |
| get_routerC | Get one router by ID. |
| list_router_interfacesA | List a router's internal interfaces: port, subnet and IP address. Not paged; complete=false means the router has more interfaces. |
| list_security_groupsB | List the project's security groups with their rules. Paged with limit and marker. |
| get_security_groupB | Get one security group by ID with its rules. |
| list_regionsB | List Keystone regions. Not paged. |
| list_domainsA | List Keystone domains. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_projectsA | List Keystone projects. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_servicesA | List services registered in the Keystone catalog. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_endpointsA | List Keystone catalog endpoints with interface and URL. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_hypervisorsA | List Nova hypervisors with state and capacity. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_compute_servicesA | List Nova services such as nova-compute, with host and state. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_aggregatesA | List Nova host aggregates with availability zone and hosts. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_network_agentsA | List Neutron agents with host and liveness. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
| list_volume_servicesA | List Cinder services such as cinder-volume, with host and state. Usually needs more than a project reader role; forbidden means the role is missing, not that the list is empty. Not paged; narrow with filters. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| find_servers_by_security_group | Find servers that have a security group attached. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| scope | Same document as the get_scope tool. |
TDQS
Scored across 32 tools
Most tools map cleanly to a distinct resource+action (list_subnets/get_subnet, list_routers/get_router), so selection is usually obvious. The main friction is the overloaded 'services' family — list_services (Keystone catalog) vs list_compute_services, list_volume_services, and list_network_agents — plus list_volumes/list_volume_attachments/list_volume_services, which rely heavily on descriptions to tell apart.
Nearly everything follows a predictable snake_case verb_noun pattern with list_X/get_X pairs per resource, which makes the set easy to scan. get_scope is the one outlier: it does not retrieve a cloud resource by ID and breaks the otherwise uniform 'get one <resource>' semantic.
Thirty-two tools is heavy, but they are distributed across five OpenStack services (Nova, Neutron, Cinder, Keystone) in a mechanical list/get pattern rather than being redundant filler. It sits at the borderline where an agent must scan a large namespace to find the right call.
The surface is entirely read-only: there is no way to create, update, or delete a server, volume, network, or security group, nor any server action tools (start/stop/reboot) or volume attach/detach. For a server named openstack-mcp-server, the read path is thorough but the lifecycle coverage is a significant gap.