Skip to content

Objections and questions — MCP Servers

Rules for using this:

  • Answer the question that was asked, then stop. A long answer to a short question reads as evasion.
  • If the answer is "it doesn't do that", say so first, then say what it does do. Never lead with the workaround.
  • Everything here is checkable in a public repository. If you are not sure, say "let me check" and check — you can, live, in front of them.

"Who controls what the AI can do?"

Two independent gates.

"First, the server. Read-only removes nine mutating tools from the OpenShift server — they do not exist, so the agent cannot call them. That's structural, not a policy that can be overridden. Second, the bearer token. It inherits the creating user's RBAC in AAP — so the scope is whatever that user has, and the environment's allow_write_operations flag is a second gate on the server side."

Source: .mcp.json (--read-only), inventory/group_vars/demo/mcp.yml, CLAUDE.md.

"Is this secure? The repo is public."

Yes. No credential is committed.

"The server definitions are in .mcp.json — committed, public, auditable. But the kubeconfig is gitignored and generated per machine. The AAP bearer token lives in a gitignored .aap/ file that the committed stdio entry reads at launch — never in a tracked file. The vault-encrypted secrets file is not tracked either — untracking it is what makes the repo reusable."

Source: .mcp.json, .gitignore (.kube/, .aap/), utilities/aap-mcp-stdio.sh, CLAUDE.md (secrets architecture).

"What if it hallucinates?"

It cannot hallucinate about cluster state.

"Every piece of infrastructure data you saw came from a live query — namespaces_list, vm_guest_info, pods_list. The assistant did not summarise from memory, it asked the cluster. If the cluster is down, the call fails — visibly, in the terminal. It does not fill in what it thinks should be there."

"On the write side, the governed path goes through AAP — same survey, same RBAC, same audit log. The assistant cannot bypass that to push a change directly."

"Why not just use oc and curl?"

You can. The value is velocity, not capability.

"An MCP tool call replaces the sequence: look up the hostname in connection.yml, decrypt the token from the vault, construct the curl or oc command, parse the JSON result. That costs a few minutes per question. The tool call costs a sentence. Same data, same source of truth, less ceremony."

Source: docs/plan/platform-addons-plan.md — "stop paying a curl + vault read + JSON parse every time we need to ask a cluster a question."

"What about observability?"

Grafana Cloud is connected and receiving data.

"We have a Grafana Cloud MCP server — 81 tools, covering dashboards, Prometheus queries, Loki logs, alerting, incidents, traces, and more. The service account is Viewer — read-only, same governance thesis as the rest. Grafana Alloy is deployed on the clusters, pushing Prometheus metrics and logs to Grafana Cloud — cluster health, KubeVirt VM metrics, AAP job telemetry, and pod logs from the key namespaces. The agent can answer 'is the cluster healthy' or 'how long did the last provision take' the same way it answers 'what VMs are running' today."

If they ask about Dynatrace: "Dynatrace is the application-level complement — OneAgent, Davis AI, the things you'd use for APM. Grafana Cloud is infrastructure-level — cluster metrics, logs, job telemetry. Both are tracked, neither replaces the other."

Source: docs/plan/grafana-plan.md, #260, #99.

"What about MCP and networking devices?"

Not yet. Options brief is written, decisions are pending.

"We've researched Cisco, Palo Alto and Aruba. Only Cisco has official MCP servers — DevNet Content Search, Meraki, Catalyst Center. Palo Alto's official server covers Cortex, not PAN-OS firewalls. Aruba's is explicitly unsupported by the vendor. Every vendor server is stdio-only with no container image, so putting one on OpenShift is a real project — containerise, adapt the transport, expose a Route, inject credentials from the vault."

Source: docs/plan/network-mcp-plan.md, #94.

"There's no MCP server for the platform I care about."

Then you build one, and that is not the consolation prize.

"Most platforms don't have one yet, and some that do ship a server you can't constrain — every tool enabled, no read-only mode. When you build it yourself you choose the tool surface, so you can ship a server that has no write tools at all. Not disabled, not behind a flag — absent. That's a stronger guarantee than anything you can bolt onto someone else's server."

If they ask what it takes: an official SDK in one of five Tier 1 languages, stdio first because it needs no hosting, then streamable HTTP if it has to run in a cluster.

Source: building-a-server.md.

"What about ServiceNow?"

No server here, and the demo does not need one.

"The one worth showing is ServiceNow's own MCP Server Console, and it needs Zurich Patch 9 or later — our demo instance is on Yokohama, so it's not available to us yet. But the write path is the part that matters, and that's servicenow.itsm in a job template. It's already pinned in this repo. An MCP server would let the agent read the incident for context; Ansible would still be the only thing that writes."

Do not offer to wire up a community server. That is a deliberate omission — they are read-write with no way to constrain them.

Source: servicenow.md, hub/certified-requirements.yml.

"What happens when the token expires?"

Silent failure, then 401.

"The kubeconfig and the AAP bearer token both expire. When they do, tool calls start failing with 401 — no graceful degradation, no warning. The fix is to re-run the generator: make-kubeconfig.sh for OpenShift, make-aap-mcp.sh for AAP. The whole /sales-demos-mcp skill does both."

The RHDP environment itself can expire, which takes the token with it — both environments were dead on 2026-09-02 (#101). Check reachability before trusting a committed cluster name.

"Can I have it?"

"Yes. The .mcp.json file is committed and public — you can read it right now. kubernetes-mcp-server is Apache-2.0, from the containers org on GitHub. The AAP MCP server ships with Ansible Automation Platform 2.5 and later. The deployment guide is in Red Hat's documentation."

Source: .mcp.json, kubernetes-mcp-server, AAP MCP Server docs.

"Is this just for Claude?"

No. MCP is an open protocol.

"The Model Context Protocol is an open specification — any client that speaks MCP can use these servers. We use Claude Code because it supports MCP natively, but the servers themselves are not Claude-specific. The same kubernetes-mcp-server works with any MCP client."

Source: modelcontextprotocol.io.

"How much does this cost to run?"

"The OpenShift MCP servers cost nothing to run — they are local processes on your laptop, no cluster resources. The AAP MCP server is a single pod in the cluster. On our environment it requested about 1 GiB of memory. The personal access token is free to create."

Source: inventory/group_vars/aap/probe_workloads.yml (resource estimates).

Questions to ask them

After Beat 3 (live read): - "What's the most common question your team asks about your clusters that currently requires logging into the console or running oc?"

After Beat 4 (governed write): - "What would your change-control board need to see before they'd approve an AI-initiated change?"

Before the close: - "Is the barrier to trying this technical, or is it organizational?" — the one that reveals whether the next conversation is an architecture session or a stakeholder alignment meeting. They are very different meetings.

Things not to say

  • "MCP is the future of AI tooling" — they do not care about the protocol, and futures are claims you cannot back with a file in the repo
  • "This replaces your runbooks" — it reads infrastructure and launches job templates, it does not replace operational procedures
  • "The AI is always right" — it queries live data so it does not hallucinate cluster state, but it can still misinterpret what it reads. Say "it asks the cluster" not "it knows"
  • Any promise of a date for network MCP servers (#94) — the options brief has three open decisions
  • "We can hook up ServiceNow" — not on this instance, and not with a community server. Say what the write path already does instead