Skip to content
vops

MCP and transports

MCP is an adapter over the same local broker used by the CLI and dashboard. It does not own provider credentials or implement deployment independently.

Prefer stdio

Terminal window
vops mcp serve

Standard input/output is the default when a client can launch a local process. It avoids a listening port, inherits the local process lifecycle and is the preferred setup for Codex, Claude Code and other desktop clients that support local MCP commands.

Client setup writes the appropriate launch configuration.

Loopback HTTP

Use authenticated HTTP when a persistent local controller is already running or the client specifically needs an HTTP endpoint:

Terminal window
VOPS_MCP_HTTP_TOKEN=... \
  vops mcp serve --transport http --port 4737

The endpoint is:

http://127.0.0.1:4737/mcp

It:

  • binds to loopback;
  • validates the request host;
  • requires bearer authentication;
  • does not create an internet-accessible endpoint.

The HTTP bearer token protects transport access. A governed infrastructure tool still requires the appropriate vops agent session token and policy decision. Do not conflate the two credentials.

Tool shape

The MCP surface is intentionally compact. It exposes:

  • getting-started and knowledge discovery;
  • capability discovery;
  • repository and spec workflows;
  • provider, target and catalog inspection;
  • plan proposal;
  • approved operation execution;
  • operation state and verification.

It does not expose generic shell, arbitrary SSH or raw provider API tools.

Capability definitions generate the MCP schemas so the CLI, dashboard labels and agent tools do not evolve as separate contracts.

Cloud-hosted agents

A cloud-hosted agent cannot normally reach the user’s 127.0.0.1. Supporting that environment requires an explicit bridge or tunnel controlled by the user. The local MVP does not create one.

Do not bind the MCP server to 0.0.0.0 as a shortcut. That changes the trust model and exposes a high-value local control surface to the network.

Troubleshoot discovery

  1. Run vops agent status --project ..
  2. Restart a client that reads MCP configuration only at launch.
  3. Verify the configured command points at the current vops executable.
  4. Confirm public knowledge discovery before creating a private session.
  5. For HTTP, verify loopback reachability and bearer configuration separately from session policy.