Act I · Perimeter
Agents on a god-mode control node invent inventory.
Prompt injection will still ask for bad ops. Policy and topology must refuse — not hope the model behaves.
Without a fabric
- Agent supplies hosts=all and a custom -i
- Free-form command / shell modules
- Every worker is an MCP entrypoint → lateral hop risk
- “Hope the model behaves” as the security model
With ansible-flow-mcp
- Nothing is a target until enrolled (token + SSH identity)
- Hub inventory is source of truth — client -i rejected
- Agent attaches to the hub only; spokes cannot MCP-hop peers
- Module deny list + check-mode default + path-jailed playbooks
You need this when
- You want Cursor / Claude / OpenCode to run Ansible like an operator, not freestyle root across the fleet
- Multi-host must mean bastion ops you already understand (SSH, inventory, enrollment) — not a mesh hop plane
- Prompt injection is inevitable — structure has to refuse
Enrollment is the perimeter. An empty bay is not a target. A join token is a
one-time key, not a permanent god mode. The hub is the only door the agent ever sees.