Lucas Manuel Rodriguez
56763d13c1
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** #43544. Moves `fleet-mcp` from `tools/fleet-mcp/` to `cmd/fleet-mcp/`. It is becoming a production server used by customers, so it now lives under `cmd/` alongside the other Fleet binaries. Per the module strategy chosen for this move, it **remains a standalone Go module** (keeps its own `go.mod`/`go.sum` and isolated deps such as `mark3labs/mcp-go`, `logrus`, `gorilla/websocket`, `godotenv`) — the root `github.com/fleetdm/fleet/v4` module is unchanged. ### What changed - `git mv tools/fleet-mcp/ → cmd/fleet-mcp/` (history preserved as renames). - Updated all path references: - Root `Makefile` `update-go` module list. - `.github/workflows/test-fleet-mcp.yml` — trigger paths, `go-version-file`, `working-directory`. - `.github/dependabot.yml` — gomod directory. - `cmd/fleet-mcp/render.yaml` — `rootDir`. - `cmd/fleet-mcp/README.md`, `Makefile`, `schema.go` — path comments/links. - `articles/fleet-mcp.md` — README link. - Removed the `fleet-mcp/` row from `tools/README.md`. ### Follow-up (not in this PR) - The Render service's Blueprint file path must be updated from `tools/fleet-mcp/render.yaml` to `cmd/fleet-mcp/render.yaml` in the Render dashboard. ## Testing - `go build .` in `cmd/fleet-mcp` — OK - `go test -race -count=1 ./...` — `ok fleet-mcp` - [x] QA'd all new/changed functionality manually
65 lines
3.4 KiB
Bash
65 lines
3.4 KiB
Bash
# Fleet MCP Server — Configuration Template
|
|
# Copy this file to .env and fill in your values:
|
|
# cp .env.example .env
|
|
#
|
|
# IMPORTANT: this .env file is loaded only when the binary is launched
|
|
# directly (SSE transport, local dev, smoke tests). Claude Desktop runs
|
|
# the binary in stdio mode and reads its env from the `env` block of
|
|
# claude_desktop_config.json — see README.md for the JSON template.
|
|
|
|
# ── Server ────────────────────────────────────────────────────────────────────
|
|
|
|
# Port for the SSE transport (ignored in stdio mode; Render injects this in prod)
|
|
PORT=8080
|
|
|
|
# Bearer token MCP clients must send in the Authorization header.
|
|
# Required at startup on every transport, including stdio. The server refuses
|
|
# to start without it. Generate with:
|
|
# openssl rand -hex 32
|
|
MCP_AUTH_TOKEN=YOUR_MCP_AUTH_TOKEN
|
|
|
|
# Alternative: read MCP_AUTH_TOKEN from a file. When set, MCP_AUTH_TOKEN_FILE
|
|
# wins over MCP_AUTH_TOKEN. Useful for systemd LoadCredential, Docker secrets,
|
|
# or any setup where the token should not appear in process env.
|
|
# MCP_AUTH_TOKEN_FILE=/run/secrets/mcp_auth_token
|
|
|
|
# ── Fleet ─────────────────────────────────────────────────────────────────────
|
|
|
|
# Base URL of your Fleet instance (include scheme; include port if non-standard)
|
|
FLEET_BASE_URL=https://your-fleet.example.com
|
|
|
|
# Fleet API token — generate one in Fleet under Settings > Integrations > API.
|
|
# Docs: https://fleetdm.com/docs/using-fleet/rest-api#authentication
|
|
#
|
|
# MUST be an API-only Fleet user: the MCP refuses to start otherwise.
|
|
# API-only users have no UI session, their own audit identity,
|
|
# and can be scoped to only the endpoints/teams the MCP needs.
|
|
#
|
|
# LEAST PRIVILEGE: use the lowest Fleet role that covers the tools you use.
|
|
# An observer token covers all the tools, except for `run_live_query` which needs observer-plus.
|
|
# No maintainer or admin role is required.
|
|
FLEET_API_KEY=YOUR_FLEET_API_KEY
|
|
|
|
# ── Logging ───────────────────────────────────────────────────────────────────
|
|
|
|
# Verbosity: debug | info | warn | error
|
|
LOG_LEVEL=info
|
|
|
|
# ── Live queries ──────────────────────────────────────────────────────────────
|
|
|
|
# How long run_live_query waits for hosts to report before returning. Accepts
|
|
# any Go duration string (e.g. 25s, 1m). Multi-host runs stop early once every
|
|
# online host has responded; this is just the upper bound. Mirrors the same
|
|
# variable on the Fleet server — keep this >= the server's value. Default 25s.
|
|
# FLEET_LIVE_QUERY_REST_PERIOD=25s
|
|
|
|
# ── TLS (only if your Fleet uses a self-signed cert; pick AT MOST one) ────────
|
|
|
|
# Option A: Skip TLS verification — DEV/TEST ONLY, never use in production.
|
|
# Server logs an error if FLEET_BASE_URL isn't a localhost address when this is set.
|
|
# FLEET_TLS_SKIP_VERIFY=true
|
|
|
|
# Option B: Trust a custom CA certificate (recommended for self-signed Fleet).
|
|
# Path to a PEM-encoded certificate.
|
|
# FLEET_CA_FILE=/path/to/ca.pem
|