Multi-host fabric
One bastion. Enrolled children only.
Not full mesh. Agent → hub MCP. Hub → spokes over SSH only. Spokes never open the fabric to peers.
Agent · Cursor / CLI / OpenCode
HUB
inventory SoT · issue-token · run_* · spoke_call
spoke-01
local exec
spoke-02
local exec
spoke-03
local exec
✗ no spoke → spoke MCP · ✗ no agent on workers
Hub
init
Keys, CA path, inventory with self
Hub
issue-token
TTL · one-time jti · signed
Spoke
join
Token + SSH identity exchange
Runtime
ForceCommand
MCP session · no shell
CLI
$ ansible-flow-mcp hub init --name ctrl-01
$ ansible-flow-mcp hub issue-token --name web-03 --ttl 15m
$ ansible-flow-mcp spoke join --token … --hub user@hub:22
$ ansible-flow-mcp hub spoke-call --node web-03 --tool list_collections
GAINS
Non-enrolled hosts untargetable
Host key checking on
No lateral MCP fabric
Host key checking on
No lateral MCP fabric
HONEST
Hub compromise = fleet
Same class as any
Ansible control node
Same class as any
Ansible control node