add_serverLABSCO SUMMARY
The token the model cannot read is the whole design.
A generic run-any-command server on a live box is one confident mistake away from a deleted volume. Here the split is structural: reads are free, writes on a production-like server need a string only you hold, and the genuinely irrecoverable operations need a separate backup attestation on top. The author is equally clear about the limit — once you are in FULL mode with the token, the model can do anything the SSH user can, and backupVerified is your word, not a check.
What it is
A mode-based MCP server for running real servers from an AI client. Reading is always allowed inside a read-only allowlist; changing anything on a production-like box requires a consent token passed out of band, which the model cannot read or fabricate. Discovery is read-only by design, and deployments go through a reviewable script rather than a stream of ad-hoc commands.
What you get
- 32 tools covering server lifecycle, discovery, execution and audit
- Three access modes:
SAFE(default, read-only allowlist, no expiry),PROVISION(system installs, 1 hour default expiry) andFULL(root, 30 minutes default expiry); sessions drop back to SAFE when they lapse - A read-only discovery scan of OS, hardware, listening ports, installed stack, containers, nginx sites and systemd services, persisted as a profile —
scan_server,get_server_profile, anddiff_server_profileto see what changed since - Deployment that plans instead of firing:
check_port_conflictnames the process holding a port and suggests a free one, andplan_deploymentreturns an idempotent bash script that the server explicitly does not execute - A production write-gate — on a server with
role: production, or one the scanner flags as production-like, a non-SAFE command needsconsentTokenplusacknowledgeProductionWrite: true, and irrecoverable operations additionally needbackupVerified: true. Refusals echo the exact resolved command - Around 250 read-only verbs that run in SAFE, with quote-aware chain splitting so a diagnostic pipeline like
du -sh /opt/* ; echo --- ; df -h /does not force elevation - One SSH connection per server keyed by
serverId, so two conversations working on two boxes cannot clobber each other;run_commandrefuses an ambiguous call rather than guessing when two or more servers are connected - A JSON-lines audit log of every command, mode change, approval and scan, readable through
get_audit_log
Requirements
SSH access to the servers you add — password, a copied key file, an inline key, an external key path, or your existing ~/.ssh/id_*; encrypted keys take a passphrase. Node 18 or newer; clone, npm install, npm run build. Generate the elevation token before you configure anything with openssl rand -hex 24 and store it in a password manager: it goes in DEVOPS_MCP_ELEVATION_TOKEN in your client config, it never expires, and there is no recovery flow — without it, set_mode, approve_action and the production write-gate fall back to accepting the model's own boolean as consent. LOG_LEVEL, LOG_DIR and DEVOPS_MCP_NO_CONSOLE_LOG are optional. MIT licensed.
Setup effort
Build from source — git clone https://github.com/MHasnainJafri/devops-mcp.git devops-mcp
USE CASES
01
Finding out what is actually running on a box
Run the read-only scan and read back the OS, listening ports, containers and nginx sites as a saved profile, with no writes on the target.
02
Deploying a new app without stepping on a live one
Check the port first — the tool names the current listener and suggests a free port — then review the generated bash script before anything runs.
03
Diagnosing disk or service problems safely
Chains of read-only commands stay in SAFE mode, so a disk-usage pipeline needs no elevation and no token.
04
Rotating a server's credentials
Swap the password or SSH key in place; the active session is closed first, the new credentials are tested, and the role, restrictions and scan profile are preserved.
05
Reviewing what the assistant did
Tail the audit log, filtered by time or action, to see every command, mode change and approval.
32 tools
Listed in project docs. Your client may show a different list.
update_serverupdate_server_credentialssetup_server_configlist_serverstest_connectionconnect_serverdisconnect_serverscan_serverget_server_profilediff_server_profilecheck_port_conflictlist_containerslist_playbooksrun_commandplan_deploymentrun_playbookinstall_dockerinstall_nginxconfigure_nginxdeploy_appcontainer_actiontransfer_filesget_current_modeset_modeapprove_actionlist_pending_approvalsrotate_consent_tokengenerate_ssh_keyrevoke_ssh_keyget_audit_loghealth_checkBEFORE YOU INSTALL
What to know first
Tools you get
32 tools named in the project's documentation.
Requires
Node.js 18+
Where it runs
All 3 documented clients run the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
TERMINAL
git clone https://github.com/MHasnainJafri/devops-mcp.git devops-mcp
cd devops-mcp
npm install
npm run build
openssl rand -hex 24MCP Clients
Claude Desktop, Cursor, Windsurf
JSON
{
"mcpServers": {
"devops-mcp": {
"command": "node",
"args": [
"<YOUR_PATH_TO_DEVOPS_MCP>/dist/index.js"
],
"env": {
"DEVOPS_MCP_ELEVATION_TOKEN": "<YOUR_DEVOPS_MCP_ELEVATION_TOKEN>",
"LOG_LEVEL": "info"
}
}
}
}<YOUR_PATH_TO_DEVOPS_MCP> is the folder you cloned into. For DEVOPS_MCP_ELEVATION_TOKEN, paste the output of openssl rand -hex 24 (the last step above, which is step 2 in the project's README) and keep a copy in a password manager: it never expires and there is no recovery flow.
