Rover MCP Server

MCP (ModelContextProvider) server for querying Red Hat internal groups API using client certificate authentication.

Features

• rover_group: Retrieve information about Red Hat internal groups by name

• Client certificate authentication for secure API access

• Proper error handling for common scenarios (404, 403, certificate issues)

Related MCP server: OpenFGA MCP

Prerequisites

• Client certificate (sa-cert.crt) and private key (privkey.pem) files

• Access to Red Hat internal groups API

Building locally

To build the container image locally using Podman, run:

podman build -t rover-mcp:latest .

This will create a local image named rover-mcp:latest that you can use to run the server.

Running with Podman or Docker

Example configuration for running with Podman:

{
  "mcpServers": {
    "rover": {
      "command": "podman",
      "args": [
        "run",
        "-i",
        "--rm",
        "-v", "./sa-cert.crt:/app/sa-cert.crt:ro",
        "-v", "./privkey.pem:/app/privkey.pem:ro",
        "-e", "CERT_FILE=/app/sa-cert.crt",
        "-e", "KEY_FILE=/app/privkey.pem",
        "-e", "MCP_TRANSPORT=stdio",
        "localhost/rover-mcp:latest"
      ],
      "env": {
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

Tools

rover_group

Retrieve information about a Red Hat internal group.

Parameters:

• group_name (string, required): The name of the group to retrieve information for

Example usage:

# Using the equivalent curl command that this tool replicates:
curl -H "Accept: application/json" --cert sa-cert.crt --key privkey.pem \
  -X GET https://internal-groups.iam.redhat.com/v1/groups/<group-name-test>

Returns:

• Success: Group information as JSON

• Error cases:

  • Group not found (404)

  • Access denied (403)

  • Certificate file missing

  • Other HTTP errors

Environment Variables

• CERT_FILE: Path to the client certificate file (default: sa-cert.crt)

• KEY_FILE: Path to the private key file (default: privkey.pem)

• MCP_TRANSPORT: Transport method for MCP communication (default: stdio)

Local Development

1. Ensure you have the required certificate files in the project directory

2. Install dependencies: pip install -r requirements.txt

3. Run the server: python mcp_server.py

Security Notes

• Keep certificate and private key files secure

• Never commit certificate files to version control

• Use read-only volume mounts when running in containers