From a45b1564ccb2da858c31c5645c6067db2db76012 Mon Sep 17 00:00:00 2001 From: Ravi Kiran Date: Mon, 21 Sep 2026 20:35:44 +0530 Subject: [PATCH] Document how to enable the MCP server The MCP server page told readers they need an environment with the server enabled but nothing explained how. Add an administrator section covering TLS, the .env settings, the compose profile, the missing block on pre-0.6.26 installs, verification and disabling. Link it from the prerequisites and call the assistant's server "built-in" in the overview so it is not confused with the opt-in external one. Part of OPS-4863. Co-Authored-By: Claude Fable 5.1 --- ai-assistance/mcp-server.mdx | 30 +++++++++++++++++++++++++++++- ai-assistance/overview.mdx | 2 +- 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/ai-assistance/mcp-server.mdx b/ai-assistance/mcp-server.mdx index 8653e2b..89b1ac3 100644 --- a/ai-assistance/mcp-server.mdx +++ b/ai-assistance/mcp-server.mdx @@ -16,7 +16,7 @@ This page is about connecting external agents to OpenOps. For the AI assistant b ## Prerequisites -* An OpenOps environment with the MCP server enabled. +* An OpenOps environment with the MCP server enabled. If you administer the environment, see [Enabling the MCP server](#enabling-the-mcp-server). * A user account in that OpenOps environment. * An AI agent that can connect to remote MCP servers and sign in through your browser, such as Claude Code, Codex, Cursor, Visual Studio Code, or the Claude app. @@ -187,6 +187,34 @@ Every agent you authorize appears in OpenOps, where you can review and disconnec Removing the server from your agent's configuration doesn't revoke the agent's access in OpenOps. The agent stays listed in **Connected apps** until you disconnect it there. To fully disconnect, do both. +## Enabling the MCP server + +This section is for OpenOps administrators. In the Docker Compose deployment, the MCP server is disabled by default. Enabling it requires OpenOps 0.6.26 or later. + +1. Enable TLS for your installation. Agents sign in through OAuth, which OpenOps serves only over HTTPS; plain `http` is accepted only when `OPS_PUBLIC_URL` is `http://localhost`. See [Enabling TLS](/getting-started/deployment/aws-ec2#enabling-tls) in the deployment guide. +2. Open the `.env` file in your OpenOps installation directory and set the following variables: + ```shell + OPS_OAUTH_ENABLED=true + OPS_OAUTH_RS_CLIENT_SECRET= + COMPOSE_PROFILES=mcp + ``` + Generate the secret with `openssl rand -hex 32`. The MCP container doesn't start while the secret is empty. `COMPOSE_PROFILES=mcp` makes `docker compose up -d` start the MCP container; the line is present but commented out in `.env.defaults`. + + + **Installations created before 0.6.26:** updates keep your existing `.env` file, so it doesn't contain the MCP settings. Copy the "MCP server for external agents" block from `.env.defaults` into `.env` first, then edit the values above. + +3. Restart the OpenOps containers: + ```shell + sudo docker compose down + sudo docker compose up -d + ``` +4. Verify that the server is reachable. The following command returns a JSON document that names your host as the `resource`: + ```shell + curl https:///.well-known/oauth-protected-resource/mcp + ``` + +To disable the MCP server, set `OPS_OAUTH_ENABLED=false`, remove the `COMPOSE_PROFILES=mcp` line, and run `sudo docker compose --profile mcp down` followed by `sudo docker compose up -d`. All connected agents lose access. + ## Troubleshooting * **The agent reports that the server needs authentication:** Run the agent's login step, such as `/mcp` in Claude Code or `codex mcp login openops`, and check that the server URL ends with `/mcp`. diff --git a/ai-assistance/overview.mdx b/ai-assistance/overview.mdx index 3ac0b2c..99f8330 100644 --- a/ai-assistance/overview.mdx +++ b/ai-assistance/overview.mdx @@ -42,7 +42,7 @@ You can use it to ask a variety of questions about OpenOps, your cloud resources * "What kind of data does a specific [OpenOps table](/reporting-analytics/tables/) contain, and what workflows use it?" * "What are the recent trends in the FinOps community?" -To provide in-depth answers about your OpenOps installation, the AI assistant takes advantage of the OpenOps MCP server, which is enabled by default. OpenOps also lets you connect external AI agents such as Claude Code or Codex to your environment. See [MCP Server](/ai-assistance/mcp-server) for details. +To provide in-depth answers about your OpenOps installation, the AI assistant takes advantage of the built-in OpenOps MCP server, which is enabled by default. OpenOps also lets you connect external AI agents such as Claude Code or Codex to your environment. See [MCP Server](/ai-assistance/mcp-server) for details. It can also work with Amazon MCP servers, namely AWS Cost Explorer MCP Server, AWS Pricing MCP Server, and AWS Billing and Cost Management MCP Server. Connecting to these servers enables you to ask questions about your AWS expenses like "How much did I spend on EC2 last month?". However, you need to explicitly enable OpenOps to access the MCP servers. See [LLM Connections](/ai-assistance/llm-connections) for how to connect.