Ansible MCP Server

@yawlabs/ansible-mcp

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

What is actually true in THIS Ansible checkout on THIS control node: the exact option specs of the modules you have INSTALLED (so coding agents stop writing options that do not exist in your collection version), task-argument checks, role interfaces, inventory structure and vars (redacted), play structure, effective config, requirements drift, and what a collection upgrade would break in your tasks. It is read-only: it never runs a play, never runs --check, never connects to a managed host and never supplies a vault secret. It complements Red Hat's servers rather than replacing them: AAP MCP answers what is true in the controller, ADT MCP takes actions (lint --fix, navigator runs, scaffolding, EE builds). Run them together.

Built and maintained by Yaw Labs.

Why this one?

Your checkout has community.general 9.5.2; the model's training data has whatever version it saw most. Agents then write gitconfig: listall: true (removed in 11.0.0), forget name (required since 12.0.0), or set state: present on rhsmrepository (no longer accepted). The VS Code language server knows the exact specs, but only a person in the editor sees them. This server lets the agent check before* it writes, against what is installed.

• Installed, not latest -- the source of truth is ansible-doc --json run against your collections paths, with redirects (ufw -> community.general.ufw) and tombstones resolved.
• Checks what lint skips -- ansible-lint's args rule skips modules with action plugins (copy, template); ansiblechecktask_args catches their unknown options and bad values, and says plainly which cross-option rules ansible-doc cannot express.
• YAML 1.1 aware -- Ansible parses YAML 1.1, so unquoted off is false and 0755 is the integer 493. The server reads YAML the same way and says when that is probably a bug.
• Read-only by construction -- configured vault password scripts never run (a server-owned dummy password file replaces them), script and plugin inventory sources are off by default, and play-level lookups are refused before Ansible parses a playbook.
• Collection upgrade impact -- downloads only the target version into its own cache and diffs the arg specs of the modules your tasks actually use, tied to file:line.
• macOS, Linux, and Windows through WSL -- Ansible has no Windows control node; on Windows the server spawns it through wsl.exe --exec (no shell anywhere).

Tools

Shortened. The full README is on GitHub.