OpenStack OperationsBLOCK
90+ production-safe OpenStack tools for AI agents via MCP. Project-scoped & read-only by default. Works with Claude, Open WebUI & any MCP client. FastMCP + OpenStack SDK. Available on PyPI, Docker Hub & Smithery.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MCP OpenStack Operations Server: A comprehensive MCP (Model Context Protocol) server providing OpenStack project management and monitoring capabilities with built-in safety controls and single-project scope.
[](https://opensource.org/licenses/MIT) [](https://www.buymeacoffee.com/call518)
[](https://github.com/call518/MCP-OpenStack-Ops/actions/workflows/pypi-publish.yml)
Architecture & Internal (DeepWiki)
[](https://deepwiki.com/call518/MCP-OpenStack-Ops)
Features
- ✅ Project-Scoped Operations: Every tool enforces the configured
OS_PROJECT_NAME, validating resource ownership so actions stay inside a single tenant. - ✅ Safety-Gated Writes: Modify (
set_*) tooling only registers whenALLOW_MODIFY_OPERATIONS=true, keeping default deployments read-only and auditable. - ✅ 90+ Purpose-Built Tools: Broad coverage across compute, networking, storage, images, identity, Heat, and Octavia load balancing tasks—all constrained to the current project.
- ✅ Bulk & Filtered Actions: Instance, volume, network, image, snapshot, and keypair managers accept comma-delimited targets or filter criteria to orchestrate bulk changes intentionally.
- ✅ Post-Action Feedback & Async Guidance: Mutating tools reuse a shared result handler that adds emoji status checks, asy
e19d2e95f841OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-openstack-ops --env OS_AUTH_HOST=${OS_AUTH_HOST} --env OS_AUTH_PORT=${OS_AUTH_PORT} --env OS_AUTH_PROTOCOL=${OS_AUTH_PROTOCOL} --env OS_AUTH_URL=${OS_AUTH_URL} -- uvx mcp-openstack-ops{
"mcpServers": {
"mcp-openstack-ops": {
"command": "uvx",
"args": [
"mcp-openstack-ops"
],
"env": {
"OS_AUTH_HOST": "${OS_AUTH_HOST}",
"OS_AUTH_PORT": "${OS_AUTH_PORT}",
"OS_AUTH_PROTOCOL": "${OS_AUTH_PROTOCOL}",
"OS_AUTH_URL": "${OS_AUTH_URL}"
}
}
}
}Exposed tools (41)
41 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_availability_zones | read | |
get_floating_ip_pools | read | |
get_floating_ips | read | |
get_heat_stacks | read | |
get_hypervisor_details | read | |
get_image_detail_list | read | |
get_instance | read | |
get_instance_by_name | read | |
get_instance_details | read | |
get_instances_by_status | read | |
get_keypair_list | read | |
get_load_balancer_amphorae | read | |
get_load_balancer_availability_zones | read | |
get_load_balancer_details | read | |
get_load_balancer_flavors | read | |
get_load_balancer_health_monitors | read | |
get_load_balancer_l7_policies | read | |
get_load_balancer_l7_rules | read | |
get_load_balancer_list | read | |
get_load_balancer_listeners | read | |
get_load_balancer_pool_members | read | |
get_load_balancer_pools | read | |
get_load_balancer_providers | read | |
get_load_balancer_quotas | read | |
get_network_details | read | |
get_project_details | read | |
get_quota | read | |
get_resource_monitoring | read | |
get_role_assignments | read | |
get_routers | read | |
get_security_groups | read | |
get_server_events | read | |
get_server_groups | read | |
get_server_volumes | read | |
get_service_status | read | |
get_usage_statistics | read | |
get_user_list | read | |
get_volume_list | read | |
get_volume_snapshots | read | |
get_volume_types | read | |
search_instances | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (7)
**ABSOLUTE RULE**: If any operation fails or lacks required parameters, **NEVER** tell the user it succeeded.
**Never bypass this safety system** - it prevents destructive operations in production.
importlib.import_module(f"{__name__}.{module_name}")logger.info(f"OpenStack connection successful. Token acquired: {token[:20]}...").env.test
.gitleaks.toml
.pre-commit-config.yaml
Gates applied: instruction_override, no_behavioural_pass.
e19d2e95f841full audit observations/trust-audit/mcp-server/call518__openstack-operations.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | e19d2e95f841 | BLOCK | D | 69 | first audit |
Questions
What is the OpenStack Operations MCP server?
90+ production-safe OpenStack tools for AI agents via MCP. Project-scoped & read-only by default. Works with Claude, Open WebUI & any MCP client. FastMCP + OpenStack SDK. Available on PyPI, Docker Hub & Smithery.
What tools does OpenStack Operations expose?
41 in total: 41 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is OpenStack Operations safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does OpenStack Operations need?
It reads OS_AUTH_HOST, OS_AUTH_PORT, OS_AUTH_PROTOCOL, OS_AUTH_URL, OS_PASSWORD, REMOTE_AUTH_ENABLE and REMOTE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does OpenStack Operations run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-openstack-ops.
How current is this page?
The grade is for one exact copy of the source (e19d2e95f841), read on 2026-10-08. The repository is watched and re-audited when it changes.