MCP reference

Alpacon MCP server

Alpacon MCP server: operate your infrastructure from AI assistants, with every action governed and recorded

Overview

The Alpacon MCP server lets AI assistants operate your servers over the Model Context Protocol, so tools like Claude Desktop, Claude Code, Cursor, and VS Code can run commands, transfer files, and inspect infrastructure through natural language instead of you switching between chat and terminal. Every action goes through the same identity, RBAC, and audit trail as the web console and CLI, and no SSH keys or VPN credentials are handed to the agent.

An agent connected to the Alpacon MCP server authenticates through the same identity layer as the web console and CLI. It can list and inspect servers, run commands, transfer files, read metrics and events, and manage IAM, certificates, and security policies—scoped by the same RBAC that governs human users.

What it exposes

The server exposes three kinds of MCP primitives:

• 159 tools across 11 categories, covering everything from server inventory and command execution to IAM, certificates, and audit logs
• 4 prompts that teach an agent the Alpacon operating discipline—how to scope a Work Session, handle approval gates, and pick the right audit lens for a question
• 72 read-only alpacon:// resources, one per major read tool, for clients that prefer to browse data as addressable resources instead of calling a tool

Governance model

• Authenticated and audited: every tool call goes through Alpacon’s identity layer—the same RBAC and audit trail as the web console and CLI. There’s no separate, weaker credential path for AI agents.
• Work Session-scoped mutations: when a caller connects through MCP OAuth or a browser session, infrastructure-mutating actions—running commands, transferring files—must be linked to an active Work Session, an approval-gated record that scopes what the agent can touch and for how long. Static API tokens bypass this gate.
• Access levels on every tool: each tool is annotated Read-only, Additive, Idempotent write, or Destructive, so a client—or a human reviewing a transcript—can tell at a glance whether a call only reads data or changes something. See the tools for the full legend.