Core MCP loop
Search → schema → check → execute
Real Ansible modules from a curated gallery. Slim argSpec before any run. Check mode default. No freestyle shell.
Agent ritual · modules
01
search_modules
Gallery search across allowlisted collections
02
get_module_schema
Slim argSpec for the FQCN — form the args correctly
03
run_module(..., check_mode=true)
Dry-run first — default path for agents
04
run_module(..., check_mode=false)
Apply only when the check looks right
Tools
stdio MCP
| search_modules | Gallery search |
| get_module_schema | Slim argSpec |
| run_module | Ad-hoc · check default on |
| run_playbook | Path-jailed .yml |
| list_collections | Allowlisted catalog |
Hard stops
denied · command / shell / raw / script
jailed · playbook roots only
argv · no shell interpolation
Playbooks:
confirm path → check → apply