Skip to content

serve

drpcli mcp serve

Run a Model Context Protocol server

Synopsis

Run an MCP (Model Context Protocol) server that exposes the drpcli command surface as MCP tools, suitable for embedding in MCP-aware clients such as Claude Desktop or Claude Code. Each MCP tool call runs the corresponding drpcli command in-process and returns its JSON output.

With no transport flag the server speaks MCP over stdin/stdout and inherits authentication from the surrounding drpcli flags and environment variables (RS_ENDPOINT, RS_KEY, etc.). Every tool call then runs with that one process credential.

With --unix or --https the server listens instead of using stdin/stdout, and stdio is not served at all. Every request must carry an "Authorization: Bearer " header; a request without one is rejected with 401. That per-request token -- not the process credential -- is the identity the request's tools run as, so a caller can only reach what its own token authorizes.

Use --read-only to expose only commands that read state. Mutating commands (create, update, destroy, params set, generate repo, ...) are then filtered out of the published tool list entirely.

Text Only
drpcli mcp serve [flags]

Examples

Text Only
  # Start with default credentials from environment
  drpcli mcp serve

  # Read-only mode (no mutations)
  drpcli mcp serve --read-only

  # Connect to a specific endpoint
  drpcli mcp serve -E https://drp.example.com:8092 -U admin

  # Serve docs from the stable tree instead of dev
  drpcli mcp serve --docs-version stable

  # Serve docs from a local zip (airgapped / pinned snapshot)
  drpcli mcp serve --local-docs drp-docs.zip

  # Disable the documentation tools
  drpcli mcp serve --no-docs

  # Serve to an ai-agent sandbox over a unix socket (bearer required)
  drpcli mcp serve --unix /var/run/dr-provision/mcp.sock

  # Do not truncate large results -- only for a caller that can spill them
  drpcli mcp serve --max-tool-bytes -1

  # Serve over HTTPS (bearer required)
  drpcli mcp serve --https 0.0.0.0:8099 --tls-cert server.crt --tls-key server.key

Options

Text Only
      --docs-url string        Base URL of the docs site for remote docs (default "https://docs.rackn.io")
      --docs-version string    DRP docs tree version to serve over the docs tools (e.g. dev, stable, v4.17) (default "dev")
  -h, --help                   help for serve
      --https string           Serve MCP over HTTPS on this host:port; requires a bearer token on every request
      --local-docs string      Path to a local docs archive (zip, .tgz, or rofs tar/iso/squashfs; a top-level llms.txt plus an md/ tree); overrides remote docs
      --max-tool-bytes int     Cap a single tool result at this many bytes (0 uses the 100000 default; a negative value disables the cap)
      --no-docs                Disable the DRP documentation tools (docs_search/docs_fetch)
      --output-format string   Output format MCP tools return for every call (json or yaml) (default "json")
      --read-only              Only expose tools that read state; mutating commands are not registered
      --tls-cert string        TLS certificate for --https
      --tls-key string         TLS key for --https
      --unix string            Serve MCP over HTTP on this unix socket path; requires a bearer token on every request
      --unix-mode string       Permissions for the --unix socket, as an octal string (default "0600")

Options inherited from parent commands

Text Only
      --ca-cert string                     CA certificate used to verify the server certs (with the system set)
  -c, --catalog string                     The catalog file to use to get product information (default "https://repo.rackn.io")
      --catalog-path string                The path to where the catalog file exists on the drp server. By default and historically this has been /files/rebar-catalog. For example, if no catalog urls are provided, the complete path will be https://drp-ip:8090/files/rebar-catalog (default "/files/rebar-catalog")
  -S, --catalog-source string              A location from which catalog items can be downloaded. For example, in airgapped mode it would be the local catalog
      --client-cert string                 Client certificate to use for communicating to the server - replaces RS_KEY, RS_TOKEN, RS_USERNAME, RS_PASSWORD
      --client-key string                  Client key to use for communicating to the server - replaces RS_KEY, RS_TOKEN, RS_USERNAME, RS_PASSWORD
  -C, --colors string                      The colors for JSON and Table/Text colorization.  8 values in the for 0=val,val;1=val,val2... (default "0=32;1=33;2=36;3=90;4=34,1;5=35;6=95;7=32;8=92")
  -d, --debug                              Whether the CLI should run in debug mode
  -D, --download-proxy string              HTTP Proxy to use for downloading catalog and content
  -E, --endpoint string                    The Digital Rebar Provision API endpoint to talk to (default "https://127.0.0.1:8092")
  -X, --exit-early                         Cause drpcli to exit if a command results in an object that has errors
      --fetch-catalogs all                 Determines which catalog urls to use to fetch the catalog. If set to all, all the catalog urls defined with catalog_url and catalog_urls as well as the default catalog will be used. If set to server, only the catalog urls defined on the server will be used. If set to cli, then the specific url specified with the -c flag will be used. It defaults to `all`. Allowed values `all, `server`, `cli`. (default "all")
  -f, --force                              When needed, attempt to force the operation - used on some update/patch calls
      --force-new-session                  Should the client always create a new session
  -F, --format string                      The serialization we expect for output.  Can be "json" or "yaml" or "text" or "table" (default "json")
      --http-request-retry-count int       Specifies the number of retries for downloads in case of failure
      --http-request-retry-delay-max int   Specifies the maximum delay (in seconds) between HTTP/HTTPS retry attempts (default 60)
      --ignore-unix-proxy                  Should the client ignore unix proxies
  -N, --no-color                           Whether the CLI should output colorized strings
  -H, --no-header                          Should header be shown in "text" or "table" mode
  -x, --no-token                           Do not use token auth or token cache
  -P, --password string                    password of the Digital Rebar Provision user (default "r0cketsk8ts")
  -p, --platform string                    Platform to filter details by. Defaults to current system. Format: arch/os
  -J, --print-fields string                The fields of the object to display in "text" or "table" mode. Comma separated
  -r, --ref string                         A reference object for update commands that can be a file name, yaml, or json blob
      --server-verify                      Should the client verify the server cert
  -G, --show-global-help-flags             Show global flags in help message
  -T, --token string                       token of the Digital Rebar Provision access
  -t, --trace string                       The log level API requests should be logged at on the server side
  -Z, --trace-token string                 A token that individual traced requests should report in the server logs
  -j, --truncate-length int                Truncate columns at this length (default 40)
  -u, --url-proxy string                   URL Proxy for passing actions through another DRP
  -U, --username string                    Name of the Digital Rebar Provision user to talk to (default "rocketskates")

SEE ALSO

Auto generated by spf13/cobra on 14-Sep-2026