Skip to content

MCP / AI Integration

KVM Fleet exposes a Model Context Protocol (MCP) server (@kvmfleet/mcp, open source, MIT) that lets AI assistants like Claude read your fleet, audit log, and compliance state and — with opt-in — act on your behalf. Every call goes through the platform REST API with your token, so RBAC, the policy engine, JIT access, approvals, and audit logging all apply unchanged.

Tools

Read tools are always available — devices and health, power state, device metrics history, audit log + integrity + chain head, Merkle inclusion proofs, audit witnesses, console sessions, access grants, policies and logged policy evaluations, alerts, ISOs, team, and compliance config / report rendering / share links.

Write tools are opt-in (see Write mode) — power actions, JIT access (request / approve / deny / revoke), ISO mount / unmount, console-session end, alert ack / resolve, and minting auditor report-share links. Destructive actions (e.g. power-cycle, revoke, mount, session-end, share-link) additionally require an explicit confirm: true argument.

The full tool list and the endpoint each maps to is in the package README.

Prompts

The server ships curated, one-click governance workflows (surfaced as slash-commands in clients that support MCP prompts):

Prompt What it does
compliance-evidence <framework> Assemble an evidence pack: render the report, attach an offline-verifiable inclusion-proof bundle, and (write mode) mint an auditor link
access-review [days] Summarise current grants and recent access events for a periodic review
audit-integrity-check Re-walk the audit hash-chain and report whether it is intact
policy-posture Summarise the configured policies and recent logged decisions

Setup

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "kvmfleet": {
      "command": "npx",
      "args": ["-y", "@kvmfleet/mcp"],
      "env": {
        "KVMFLEET_API": "https://app.kvmfleet.io",
        "KVMFLEET_TOKEN": "kvmf_paste_your_token_here"
      }
    }
  }
}

Claude Code

claude mcp add kvmfleet \
  -e KVMFLEET_API=https://app.kvmfleet.io \
  -e KVMFLEET_TOKEN=kvmf_paste_your_token_here \
  -- npx -y @kvmfleet/mcp

Generate an API token

  1. Log into app.kvmfleet.io.
  2. Go to Account → API tokens → Create token.
  3. Copy the token (shown only once). It inherits your current org role and can be revoked any time.

Write mode

Write tools are not advertised to the assistant unless you opt in. Add KVMFLEET_MCP_ALLOW_WRITES to the env block:

"env": {
  "KVMFLEET_API": "https://app.kvmfleet.io",
  "KVMFLEET_TOKEN": "kvmf_paste_your_token_here",
  "KVMFLEET_MCP_ALLOW_WRITES": "true"
}

When unset (or anything other than the literal string "true"), the assistant sees read tools only.

Example prompts

  • "Are any KVM devices offline right now?"
  • "Show me the audit log for the last 24 hours."
  • "Why was alice@acme.co denied access to srv-pdx-3 yesterday?"
  • "Show the CPU-temp trend for DC1-R3-S7 over the last 12 hours."
  • "Run the compliance-evidence workflow for ISO 27001 and give me an auditor link."

Security

The token is sent only to your KVM Fleet platform — never to Anthropic, the MCP package, or any third party. Every MCP call lands as an audit-event row tagged with the x-kvmfleet-mcp-client header, so a human auditor can split agent-originated from human-originated actions. Server-side RBAC, policy, JIT, 4-eyes approval, and rate limits apply to agent calls exactly as they do to the dashboard.