Add ansible mcp role by EMaksy · Pull Request #116 · trento-project/ansible

EMaksy · 2026-04-22T13:31:45Z

Description

This pr adds Ansible support for deploying the Trento MCP Server

This pr adds a new mcp.yml playbook and mcp_server role to
install, configure, and start mcp-server-trento as a systemd service.

Supported deployment modes:

Deploy MCP on trento_server and use local OpenAPI paths.
Deploy MCP on dedicated mcp_hosts and use mcp_server_trento_url with OpenAPI autodiscovery paths.

site.yml now imports mcp.yml after server provisioning. MCP is
enabled by default but it can be skipped by provision_mcp: false.

The goal of the site playbook was a simple way to deploy everything, so why not add the mcp server to it ?

Changes

Add mcp.yml for MCP Server provisioning.
Add cleanup-mcp.yml for MCP-only cleanup.
Add mcp_server role
Extend Trento shared defaults/discovery for MCP host resolution.
Extend reverse proxy configuration to expose MCP under ``/mcp-server-trento```
Include MCP playbooks in RPM packaging.
Document MCP deployment, client URL, PAT usage, and dedicated-host setup.

Deployment Behavior

Users choose the target by defining inventory groups in their inventory.yml:

If the inventory contains an mcp_hosts group, the playbook installs
mcp-server-trento on the hosts in that group. This is the dedicated
MCP deployment path.
If the inventory does not contain mcp_hosts, the playbook installs
mcp-server-trento on trento_server. This is the default same-host
deployment path.
Same-host MCP reads the local Trento Web and Wanda OpenAPI
specifications through OAS_PATH
Dedicated-host MCP cannot use local 127.0.0.1 OpenAPI paths because
Web and Wanda run on the Trento server host. Instead, it connects to
Trento through TRENTO_URL and AUTODISCOVERY_PATHS

Usage

Install only the MCP Server. Without an mcp_hosts group, this deploys
MCP on trento_server:

ansible-playbook -i inventory.yml mcp.yml

Install MCP as part of the full Trento deployment:

ansible-playbook -i inventory.yml site.yml

Skip MCP when running the full Trento deployment:

ansible-playbook -i inventory.yml site.yml -e provision_mcp=false

Deploy MCP on a dedicated host by adding an mcp_hosts group next to
trento_server in the inventory and running either mcp.yml or
site.yml:

Client Access

When provision_proxy is true, MCP clients should connect through the
Trento reverse proxy:

https://<trento_server_name>/mcp-server-trento/mcp

The Trento MCP Server does not install or configure an LLM client. Users must
generate a Personal Access Token in Trento Web and configure it in their
MCP client.

Cleanup Behavior

This PR adds cleanup-mcp.yml for removing only the Trento MCP Server
while keeping the core Trento deployment intact.

Run MCP-only cleanup with:

ansible-playbook -i inventory.yml cleanup-mcp.yml

Cleanup follows the same host selection rules as installation:

If mcp_hosts exists, MCP cleanup runs on the hosts in mcp_hosts.
If mcp_hosts is absent, MCP cleanup runs on trento_server.

The MCP cleanup role:

stops and disables the mcp-server-trento systemd service;
removes MCP listener firewall access when the role had opened it;
removes MCP health-check firewall access when health checks and
health-port exposure were enabled.

The cleanup playbook does not remove the mcp-server-trento RPM
package, matching the existing cleanup convention for most installed
packages.

antgamdia

Thanks for the effort in adding the MCP server to the Ansible playbook! Looking good!
I'm not that skilled in the Ansible stuff, but I've added some general comments around the MCP server.

antgamdia · 2026-05-07T11:13:17Z

+  and `agent` playbooks. MCP is enabled by default and can be skipped
+  by setting `provision_mcp=false`.


I personally like it's installed by default; however, I don't think it is the case for other installations (like the Helm Chart). Ideally, the installation experience should be consistent, IMO.

I agree the cross-installer inconsistency isn't ideal. The reason i kept it default-on for Ansible is that site.yml has always been the "give me everything" entry point.

antgamdia · 2026-05-07T11:14:48Z

+mcp_server_oas_paths:
+  - "http://127.0.0.1:{{ trento_web_listen_port }}/api/all/openapi"
+  - "http://127.0.0.1:{{ trento_wanda_listen_port }}/api/all/openapi"
+mcp_server_trento_url: "{{ trento_server_url | default('https://{}'.format(trento_server_name), true) }}"


No need to populate it for local installations, I think.
Ref: https://github.com/trento-project/mcp-server/blob/4d12ea104ccba3e480b9344384e67a5151d286ca/packaging/suse/rpm/systemd/mcp-server-trento.example#L44-L45

antgamdia · 2026-05-07T11:15:54Z

+galaxy_info:
+  author: "trento-developers@suse.com"
+  description: Install and configure Trento MCP Server
+  company: SUSE


Suggested change

company: SUSE

company: SUSE LLC

antgamdia · 2026-05-07T11:20:47Z

+MCP client. With the default `mcp_server_header_name`, clients pass the
+token through the `Authorization` header.
+
+Example MCPHost server entry:


I know we have documented it, but we might shift from MCPHost (now deprecated and archived) to Kit. I mean, no action required now, but eventually we'll have to change the docs 😅

antgamdia · 2026-05-07T11:22:39Z

+For client setup and configuration details, see the official Trento MCP
+Server usage guide at
+https://www.trento-project.io/docs/latest/user-guide/trento-mcp-how-to-use.html
+and the configuration reference at
+https://www.trento-project.io/docs/mcp-server/Trento%20MCP%20Server%20documentation/configuration-options.html.
+


Re: https://github.com/trento-project/ansible/pull/116/changes#r3201020015

Or maybe just the pointers to the docs are enough... that way we don't have to change again and again.

antgamdia · 2026-05-07T11:23:02Z

 key for the agents is automatically retrieved from Trento server and
 passed on to the deployed agents. Thus, the value of
 `agent_web_api_key` variables is ignored when using this playbook.
+`site.yml` also provisions the Trento MCP Server through `mcp.yml`


ditto: https://github.com/trento-project/ansible/pull/116/changes#r3200980929

skrech

I'm going through the PR but before detailed review, I want to point out two things:

When having a ROLE for something, it has a defaults/main.yml file that handles the default values, so there is no need to specify | default() filter on every usage. This makes reading the code hard and at the same time defeats the purpose of defaults/main.yml.
Other services use the firewall role from outside the specific functionality role. Maybe you could adapt the code to be like that? I suspect that did that because you needed variables from the MCP role... I encourage you to think if such configurability is actually needed. For example, I don't know why somebody won't want to enable the port for communication with the MCP server. Even if it really wants to not open a port, then this seems like a condition that comes from host networking concerns (topology), and it's not a role concern. Or at least you should pass-in the value from the playbook to the role if you want to preserve the configurability of this role value.

github-actions

license-eye has checked 142 files.

Valid	Invalid	Ignored	Fixed
110	8	24	0

Click to see the invalid file list

cleanup-mcp.yml
mcp.yml
roles/mcp_server/defaults/main.yml
roles/mcp_server/handlers/main.yml
roles/mcp_server/meta/main.yml
roles/mcp_server/tasks/cleanup.yml
roles/mcp_server/tasks/main.yml
roles/mcp_server/templates/mcp-server-trento.j2

Use this command to fix any missing license headers

```bash

docker run -it --rm -v $(pwd):/github/workspace apache/skywalking-eyes header fix

</details>

EMaksy force-pushed the mcp-ansible branch 3 times, most recently from b6ed59b to 4447989 Compare April 27, 2026 15:26

EMaksy requested review from antgamdia and skrech April 27, 2026 17:45

antgamdia reviewed May 7, 2026

View reviewed changes

skrech reviewed May 11, 2026

View reviewed changes

github-actions Bot reviewed May 11, 2026

View reviewed changes

EMaksy and others added 12 commits May 12, 2026 13:46

add mcp role

c31c3a8

enrich template with variables

4211b5a

add dedicated mcp install

21a6533

fix lint

8a9d79b

Refactor mcp ansible

dcaa842

improve docs

34c3854

improve readme

19e8ec6

simplify setup

1c18675

remove oas paths

9170835

Add license

14aa406

Restore OAS_PATH dual-mode auto-detect

e39dd64

improve docs

f86ec76

EMaksy force-pushed the mcp-ansible branch from 7dbdb5d to f86ec76 Compare May 12, 2026 11:46

vicenteqa self-assigned this Jun 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add ansible mcp role#116

Add ansible mcp role#116
EMaksy wants to merge 12 commits into
mainfrom
mcp-ansible

EMaksy commented Apr 22, 2026 •

edited

Loading

Uh oh!

antgamdia left a comment

Uh oh!

antgamdia May 7, 2026

Uh oh!

EMaksy May 11, 2026

Uh oh!

antgamdia May 7, 2026

Uh oh!

antgamdia May 7, 2026

Uh oh!

antgamdia May 7, 2026

Uh oh!

antgamdia May 7, 2026

Uh oh!

antgamdia May 7, 2026

Uh oh!

skrech left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

		and `agent` playbooks. MCP is enabled by default and can be skipped
		by setting `provision_mcp=false`.

Uh oh!

Conversation

EMaksy commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Deployment Behavior

Usage

Client Access

Cleanup Behavior

Uh oh!

antgamdia left a comment

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

EMaksy May 11, 2026

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

antgamdia May 7, 2026

Choose a reason for hiding this comment

Uh oh!

skrech left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

EMaksy commented Apr 22, 2026 •

edited

Loading