AI agents · real Ansible · bastion fabric
Give agents Ansible.
Not the keys.
MCP tools that search, schema, check, then execute — on a hub that only reaches hosts you enroll over SSH.
search → schema → check → apply
join tokens
ForceCommand
enrolled inventory only
Agent · hub session
stdio
Install nginx on the web group — check first.
list_nodes → groups: web ⊂ prod
search_modules → ansible.builtin.package
run_module(hosts="web", check_mode=true)
ok · changed=0 · would install nginx on spoke-01
Apply.
run_module(..., check_mode=false)
ok · changed=1 · spoke-01 only · inventory fixed
Agent attaches hub only
spokes · localhost exec