English Français العربية

Infra MCP

مجتمعي البيانات وقواعدها

Read-only access to on-prem Linux VMs and PostgreSQL over SSH: service health, logs, database state and table schemas, with allowlists and an audit log.

الشيفرة المصدرية التوثيق

التثبيت

خطوات التثبيت موجودة في التوثيق أدناه. التوثيق

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. infra-mcp
  2. Install
  3. Configure
  4. Run
  5. Updates
  6. Tools
  7. Security model

infra-mcp

Read-only MCP access to on-prem Linux VMs and PostgreSQL databases over SSH.

 agent ──stdio──▶ infra-mcp ──SSH──▶  VMs  (journald · log files)
                                  └──▶  DBs  (read-only PostgreSQL)

An agent can check service health, retrieve bounded logs, inspect DB state, and explore table schemas — without terminal access. Every remote operation is allowlist-gated and written to an append-only audit log.

Install

uv tool install infra-mcp
# or
pip install infra-mcp

Configure

Copy infra-mcp.yaml.example to ~/.infra-mcp/infra-mcp.yaml and edit it.

# Generate a starter config from ~/.ssh/config
infra-mcp generate-config -o ~/.infra-mcp/infra-mcp.yaml

# Create the read-only PostgreSQL role(s)
infra-mcp setup

# Check VM reachability
infra-mcp test

# Refresh discovered services, log dirs, and databases (updates config in place)
infra-mcp discover --in-place

Override the config path with --config or INFRA_MCP_CONFIG.

Run

infra-mcp run

Register as a stdio MCP server in your client (Claude Code, Cursor, …) with command infra-mcp run.

Updates

infra-mcp checks PyPI for a newer release once a day and, when one exists, prints a one-line hint to stderr telling you how to upgrade:

uv tool upgrade infra-mcp   # or: pip install --upgrade infra-mcp

The check runs in the background, never blocks startup, and never touches stdout. Print the installed version with infra-mcp --version. Disable the check entirely by setting INFRA_MCP_NO_UPDATE_CHECK=1.

Tools

VM & services
ToolPurpose
list_vmsAll VMs with reachability and watched services
get_infra_overviewService states + DB health for one VM in a single call
get_service_statussystemd state, uptime, last 5 log lines
get_service_logsBounded journald logs, filtered by severity
get_log_fileLast N lines of an allowed log file, optional grep
Databases
ToolPurpose
get_db_statusConnection counts, waiting locks, long-running query count
query_dbBounded caller-supplied SELECT
list_tablesTables in a database (schema + name), capped at 200
describe_tableColumns, types, primary key, foreign keys for one table
Meta
ToolPurpose
get_audit_logRecent entries from the local audit log

All output is bounded server-side (200 log lines, 100 DB rows, 200 tables/columns max). Truncation is always flagged with a -- TRUNCATED: marker. list_tables and describe_table cache results in memory (TTL: schema_cache_ttl_hours, default 24 h); pass refresh: true to force a live re-read.

Security model

  • SSH commands and systemd services are checked against a per-VM allowlist before any network call.
  • All DB queries run as a read-only role inside a READ ONLY transaction.
  • Log file paths are resolved against a per-VM directory allowlist (.. traversal blocked).
  • Every remote operation is appended to a local JSONL audit log.

الأسئلة الشائعة

ما هو Infra MCP؟

Read-only access to on-prem Linux VMs and PostgreSQL over SSH: service health, logs, database state and table schemas, with allowlists and an audit log.

كيف أثبّت Infra MCP؟

اتبع خطوات التثبيت في توثيقه المعروض في هذه الصفحة وفي مستودعه.

هل Infra MCP مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون Infra MCP؟

ينشره esp4ce. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من القوائم المجتمعية awesome-mcp-servers ومستودع المشروع على GitHub. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.