mirastacklabs-ai/mirastack-redfish-mcp

> Governed MCP server for DMTF Redfish-compliant BMCs — iDRAC, iLO, XCC,
> OpenBMC and compatible implementations. **Read-only by default**: mutating
> tools are not registered unless you explicitly raise the write mode, and
> every mutation is a dry-run until confirmed.
>
> Built by MIRASTACK LABS. Apache-2.0.
Highlights
- MCP stdio and streamable-http transports via the official Python MCP SDK.
- Distilled schema metadata from DMTF Redfish-Publications, pinned to release 2026.1.
- Protocol-correct Redfish behavior: session auth, ETag/If-Match, 202 task polling, and registry-backed error rendering.
- Safe write controls: tiered registration plus dry-run-first confirmations.
Why this exists
A BMC is a pre-OS, out-of-band control plane with authority above normal host-level root access. Giving an autonomous agent BMC access without strong guardrails creates immediate blast-radius risk across power, boot, firmware, and account boundaries. This server forces dangerous actions behind deliberate write-mode elevation, and keeps every mutation dry-run by default so intent can be reviewed before application. The result is a governed operational interface rather than an always-armed remote control. The model can still move fast on diagnostics, but privilege transitions become explicit and auditable.
Installation
Try it in 60 seconds (no hardware)
Run a local DMTF mockup, start the MCP server in read-only mode, and call a read tool:
Example tool call:
Expected output shape:
Discovery mode
The server also starts with **zero endpoint credentials** and still serves read-only
tool discovery (for MCP scanner validation and metadata indexing). In this mode,
schema/corpus-backed tools continue to work, while BMC-connected tools return a
configuration error that names the required environment variables:
MIRASTACK_REDFISH_HOST, MIRASTACK_REDFISH_USERNAME, and
MIRASTACK_REDFISH_PASSWORD (or MIRASTACK_REDFISH_PASSWORD_FILE), or
MIRASTACK_REDFISH_ENDPOINTS for multi-endpoint setup.
Discovery mode also covers a **missing endpoints file**. If MIRASTACK_REDFISH_ENDPOINTS
points at a path that does not exist - which is how container platforms and MCP directory
scanners inject a placeholder - the server logs a warning naming that path on stderr and
starts with zero endpoints. A file that *does* exist but cannot be read or parsed remains a
hard startup failure, and a partially configured single endpoint (for example
MIRASTACK_REDFISH_HOST without MIRASTACK_REDFISH_PASSWORD) still raises, so a typo can
never silently downgrade a configured deployment.
Quick Start (hardware, stdio)
Quick Start (streamable-http)
> **Warning:** binding to 0.0.0.0 exposes BMC control to every host that can reach this port. Bind to loopback unless the listener sits behind an authenticating proxy on a trusted management network.
Configuration
Canonical environment variables
Use MIRASTACK_REDFISH_* variables:
- MIRASTACK_REDFISH_HOST
- MIRASTACK_REDFISH_USERNAME
- MIRASTACK_REDFISH_PASSWORD or MIRASTACK_REDFISH_PASSWORD_FILE
- optional: MIRASTACK_REDFISH_VERIFY_SSL (**default: true**), MIRASTACK_REDFISH_CA_BUNDLE, MIRASTACK_REDFISH_TIMEOUT_SEC, MIRASTACK_REDFISH_AUTH_MODE
Multi-endpoint configuration
Set MIRASTACK_REDFISH_ENDPOINTS to inline JSON or a YAML/JSON file: