Trust boundary
Controls you can name
ansible-flow-mcp runs the local ansible CLI on the control node. Anyone who can call the MCP tools can change systems that control node can reach. Treat MCP access like SSH to your automation host.
Controls
| Control | Behavior |
|---|---|
| Collection allowlist | Only modules under configured collections |
| Module deny list | command / shell / raw / script denied by default |
| Check mode | Default true on run_module |
| Playbook jail | Allowlisted roots · size limit · .yml only |
| No shell interpolation | argv-only subprocess |
| Hub inventory | Enrolled hosts only · no client -i · host keys on |
| Spoke path | SSH ForceCommand · localhost exec · no peer fabric |
| Join tokens | Signed · TTL · one-time jti replay cache |
| Secret redaction | Common password/token keys redacted in results |
Residual risk (honest): hub compromise equals fleet — the same class as any
Ansible control node. Harden the bastion. Do not expose unauthenticated MCP on the public
internet.