# KVMFleet Mcp

> Use Claude Desktop, Cursor, or Continue to query and control your KVM Fleet servers. Reads by default; writes are opt-in. Apache 2.0.

- **Type:** MCP server
- **Install:** `agentstack add mcp-kvmfleet-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [KVMFleet](https://agentstack.voostack.com/s/kvmfleet)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [KVMFleet](https://github.com/KVMFleet)
- **Source:** https://github.com/KVMFleet/mcp
- **Website:** https://kvmfleet.io

## Install

```sh
agentstack add mcp-kvmfleet-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# @kvmfleet/mcp — MCP server for KVM Fleet

A [Model Context Protocol](https://modelcontextprotocol.io) server
that lets AI assistants (Claude Desktop, Cursor, Continue, etc.)
work across your KVM Fleet fleet through the official REST API.
All access is RBAC-enforced, policy-checked, and audited
server-side.

## What you can ask it to do

**Read mode** (default):

- *"How many devices do I have? Which are offline?"*
- *"Show me failed logins in the last 24 hours."*
- *"What approvals are waiting on me right now?"*
- *"Generate this month's NIS2 compliance snapshot — surface the dropped controls."*
- *"What alerts fired overnight?"*
- *"Verify my audit log integrity."*
- *"When was my audit chain last anchored to a witness?"*
- *"Why was alice@acme.co denied access to srv-pdx-3 yesterday?"* (logged decision + reason)
- *"Show the CPU-temp trend for R7525-NORD-1 over the last 12 hours."*
- *"Run the `compliance-evidence` workflow for ISO 27001 and give me an auditor link."* (prompt)

**Write mode** (opt-in, see below):

- *"Power-cycle host R7525-NORD-1."*
- *"Mount ubuntu-24.04.iso on R7525-NORD-1 — I'll reinstall."*
- *"Approve the access request from alice@acme.co for the kernel-patching ticket."*
- *"End the console session that's been open more than 8 hours on srv-pdx-3."*
- *"Acknowledge the disk-full alert on the prod database host."*

## Tools

### Reads (always available)

| Tool | Maps to |
|---|---|
| `list_devices` | `GET /v1/devices` |
| `get_device_health` | `GET /v1/devices/{id}` |
| `get_power_state` | `GET /v1/devices/{id}/power` |
| `get_device_metrics` | `GET /v1/devices/{id}/metrics` |
| `query_audit_log` | `GET /v1/audit/events` |
| `verify_audit_integrity` | `GET /v1/audit/integrity` |
| `get_audit_chain_head` | `GET /v1/audit/head` |
| `get_inclusion_proof` | `POST /v1/audit/inclusion-proof` |
| `list_audit_witnesses` | `GET /v1/audit-witnesses` |
| `list_open_console_sessions` | `GET /v1/console-sessions?open_only=true` |
| `list_access_grants` | `GET /v1/access-grants` |
| `list_policies` | `GET /v1/policies` |
| `list_policy_evaluations` | `GET /v1/policy-evaluations` |
| `list_alerts` | `GET /v1/alerts/history` |
| `list_isos` | `GET /v1/isos` |
| `list_team` | `GET /v1/team` |
| `get_compliance_config` | `GET /v1/compliance` |
| `get_compliance_score` | `POST /v1/reports/{framework}?format=json` |
| `render_compliance_report` | `POST /v1/reports/{framework}` (json / csv) |
| `list_report_shares` | `GET /v1/report-shares` |

`list_policy_evaluations` returns logged past decisions — each with one
`result` and one human-readable `reason`. It is not a live rule-by-rule
trace.

### Writes (opt-in via `KVMFLEET_MCP_ALLOW_WRITES=true`)

| Tool | Maps to | Confirm? |
|---|---|---|
| `power_action` | `POST /v1/devices/{id}/power` | yes for off / off_hard / cycle |
| `request_access` | `POST /v1/devices/{id}/access-requests` | — |
| `approve_access` | `POST /v1/access-grants/{id}:approve` | — |
| `deny_access` | `POST /v1/access-grants/{id}:deny` | — |
| `revoke_access` | `POST /v1/access-grants/{id}:revoke` | yes |
| `mount_iso` | `POST /v1/devices/{id}/iso:mount` | yes |
| `unmount_iso` | `POST /v1/devices/{id}/iso:unmount` | — |
| `end_console_session` | `POST /v1/console-sessions/{id}:end` | yes |
| `acknowledge_alert` | `POST /v1/alerts/history/{id}/acknowledge` | — |
| `resolve_alert` | `POST /v1/alerts/history/{id}/resolve` | — |
| `create_report_share` | `POST /v1/report-shares` | yes (publishes an external link) |

Write tools requiring `confirm: true` will refuse the call with a
clear error if the LLM omits the flag. This protects against
"AI accidentally power-cycled prod".

## Prompts

Curated, one-shot governance workflows — invoke them as slash-commands in
clients that surface MCP prompts (e.g. Claude Desktop). Each composes only
the tools above and is verb-bounded: it assembles and summarises; it never
attests, detects, or diagnoses.

| Prompt | Composes | Produces |
|---|---|---|
| `compliance-evidence ` | `render_compliance_report` + `get_inclusion_proof` + (writes) `create_report_share` | an evidence pack: report summary, offline-verifiable proof bundle, optional auditor link |
| `access-review [days]` | `list_access_grants` + `query_audit_log` | a who-accessed-what summary over the window for a human reviewer |
| `audit-integrity-check` | `verify_audit_integrity` + `get_audit_chain_head` | the chain re-walk result + current chain head |
| `policy-posture` | `list_policies` + `list_policy_evaluations` | configured rules + how they have been deciding access |

## Install

```bash
npm install -g @kvmfleet/mcp
```

Or use `npx` directly in the Claude Desktop config below.

## Get an API token

1. Log into [app.kvmfleet.io](https://app.kvmfleet.io).
2. **Account → API tokens → Create token.**
3. Copy the token (shown exactly once).

The token inherits your current org role. Power actions / ISO mount
/ console-session end require `org_admin` or `operator`. Revoke any
time from the same page — it stops working immediately.

## Wire up Claude Desktop

Edit `~/Library/Application Support/Claude/claude_desktop_config.json`
(macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):

```json
{
  "mcpServers": {
    "kvmfleet": {
      "command": "npx",
      "args": ["-y", "@kvmfleet/mcp"],
      "env": {
        "KVMFLEET_API": "https://app.kvmfleet.io",
        "KVMFLEET_TOKEN": "kvmf_paste_your_token_here"
      }
    }
  }
}
```

Restart Claude Desktop. Read tools are now available.

## Enabling write mode

Add `KVMFLEET_MCP_ALLOW_WRITES` to the env block:

```json
{
  "mcpServers": {
    "kvmfleet": {
      "command": "npx",
      "args": ["-y", "@kvmfleet/mcp"],
      "env": {
        "KVMFLEET_API": "https://app.kvmfleet.io",
        "KVMFLEET_TOKEN": "kvmf_paste_your_token_here",
        "KVMFLEET_MCP_ALLOW_WRITES": "true"
      }
    }
  }
}
```

When unset (or anything other than the literal string `"true"`),
write tools are not advertised to the LLM at all. When enabled,
destructive actions still require an explicit `confirm: true` arg.

## What the platform still enforces

The MCP layer is a thin SDK. The platform does the real work on
every call:

- **RBAC** — power actions need org_admin/operator; approving an
  access request needs the appropriate role; the token inherits
  the operator's role.
- **Policy engine** — time-of-day rules, require_mfa,
  max_concurrent_sessions, approval_required, etc. all fire on
  agent-originated calls the same way they fire on human-originated
  ones.
- **JIT access** — a power action against a device that requires
  JIT access will refuse if there's no active grant.
- **4-eyes approval** — an operator approving their own access
  request is refused server-side.
- **Audit chain** — every action lands as an audit-event row in
  the per-org hash chain. The agent's calls are tagged via the
  `x-kvmfleet-mcp-client` header so a human auditor can correlate.
- **Rate limits** — per-device, per-user, per-action limits apply
  unchanged.

If a call is refused, the error from the platform is surfaced
verbatim so the LLM can read it and act on it.

## Privacy

The token is sent to your KVM Fleet platform only — never to
Anthropic, the MCP package, or any third party. Read the
platform's [Privacy Policy](https://kvmfleet.io/privacy.html)
for what's logged on our side (audit-event row per call).

## Local dev

```bash
cd kvmfleet/mcp
npm install
npm run build
npm start                                              # reads only
KVMFLEET_MCP_ALLOW_WRITES=true npm start               # reads + writes
```

## Roadmap

- **MSP context-switch** — `KVMFLEET_MSP_PARENT_ORG_ID` env to scope
  tools to a single managed customer.
- **Tagged audit rows** — the platform will surface
  `actor_type=agent` on audit rows originating from the MCP, so
  compliance reviewers can split human vs. agent action history.
- **Token-scope enforcement** — once API tokens grow a
  `scope: read | write` field on the platform, the MCP will refuse
  to expose writes on a read-only token.

## License

MIT — see [LICENSE](LICENSE). Copyright 2026 KVM Fleet.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [KVMFleet](https://github.com/KVMFleet)
- **Source:** [KVMFleet/mcp](https://github.com/KVMFleet/mcp)
- **License:** MIT
- **Homepage:** https://kvmfleet.io

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-kvmfleet-mcp
- Seller: https://agentstack.voostack.com/s/kvmfleet
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.