Enterprise DevOps MCP Server

MCP server for governed AI Agent tool calling over Linux, Docker, Kubernetes, and SSH.

让 AI Agent 在安全边界内做基础设施自动化——而不是拿到不受限的 shell。

English · Architecture · Security · Contributing

AI Agent → MCP Protocol → Security Layer → Infrastructure

Positioning

Enterprise AIOps building block: Cursor / Claude / any MCP client calls 18 tools through module whitelist, execute protection, command filtering, and audit logging.

Default posture: read-only (EXECUTE_TOOLS_ENABLED=false).

Related MCP server: SSH Vault MCP

Demo

点击封面在线播放（中文旁白 + 底部字幕）。GitHub 文件页无法内嵌 mp4，演示页托管在 GitHub Pages。

Features

MCP tool catalog

Architecture

flowchart TB
    Client[Cursor / Claude / AI Agent]
    Client --> MCP[MCP Protocol]
    MCP --> Server[Enterprise DevOps MCP Server]
    Server --> Sec[Security Layer]
    Sec --> Sys[Linux]
    Sec --> Dock[Docker]
    Sec --> K8s[Kubernetes]
    Sec --> SSH[SSH]
    subgraph sec [Controls]
      P[Module ACL]
      E[Execute gate]
      F[Command filter]
      A[Audit log]
    end
    Server -.-> P

Screenshots

Cursor / Claude 图为 Product Preview（能力示意）。将本仓库配置进 MCP 后即可在 IDE 中真实调用。

Quick Start

git clone https://github.com/zhifengjin050-arch/enterprise-devops-mcp-server.git
cd enterprise-devops-mcp-server
cp .env.example .env
pip install -r requirements.txt
python scripts/demo_list_tools.py
./scripts/demo_start.sh          # Windows: .\scripts\demo_start.ps1

Keep EXECUTE_TOOLS_ENABLED=false. See demo/README.md. Do not commit .env, kubeconfig, or SSH keys.

Docker

docker compose up -d --build

Cursor MCP

{
  "mcpServers": {
    "enterprise-devops": {
      "command": "python",
      "args": ["scripts/run_devops_mcp.py"],
      "cwd": "YOUR_PROJECT_PATH",
      "env": {
        "EXECUTE_TOOLS_ENABLED": "false"
      }
    }
  }
}

Example: mcp_config_examples/cursor_mcp.json

pytest

Deployment

Never enable execute tools in production without an explicit change-control process.

Roadmap

v1.0.x (current): 18 tools, security layer, audit, Docker, CI.

Later: more cloud providers, finer-grained policy packs, signed audit export.

License

MIT

CONTRIBUTING.md · CODE_OF_CONDUCT.md · SECURITY.md · CHANGELOG.md

Disclaimer: with execute enabled, this software can change hosts and containers. Validate in non-production first.