MCP Administration

This page covers what CloudShark admins need to know to support the MCP server: turning it on, who can create MCP tokens, how access is enforced and revoked, the audit log, and configuration.

Turning On the MCP Server

The MCP server is off by default, both on new installs and on systems upgraded to 5.3. No agent can connect until you turn it on. Add this section to /usr/cloudshark/etc/services.conf:

[mcp]
enabled = true

Then restart the service gateway, which serves /mcp:

systemctl restart cloudshark-service-gateway

Users still need an API token with MCP Access to connect. See Who Can Create MCP Tokens.

Who Can Create MCP Tokens

Access to the MCP server goes through API tokens, and by default only members of the CloudShark Admin group can create API tokens. Regular users won’t see API Tokens in their Preferences menu, so they can’t connect an agent on their own until you do one of the following:

  • Create a token for the user. In Administration > API Tokens, create a token assigned to that user, check MCP Access and the permissions they need, and give them the token. The token has the same access as that user, so treat it like their password.
  • Turn on user managed API tokens. On the Settings page, under User Managed API Tokens, check both Allow users to see API tokens assigned to them and Users can modify or create new API tokens. Every user can then create and manage their own tokens, including MCP tokens.

If you have many users who want to use the MCP server, turning on user managed tokens is usually easier. If you want to control exactly who connects an agent to CloudShark, keep the setting off and create tokens yourself.

Access Control

Capture group permissions are enforced on every call, the same as in the web UI and API. A token only reaches captures its user can see, and each tool also needs the matching token permission. See the tool table.

Deleting an API token, or removing its MCP Access, ends its MCP access immediately.

Audit Log

Each MCP call is logged to disk, separate from the CloudShark activity log, so you can see what left the system and who asked for it. Each entry records the user, the tool, and the capture accessed.

Configuration

The MCP server is configured in the [mcp] section of /usr/cloudshark/etc/services.conf:

[mcp]
enabled = true
audit-log = "/usr/cloudshark/log/mcp-audit.jsonl"
  • enabled: set to true to serve /mcp. The MCP server is off when this is false or missing.
  • audit-log: where MCP calls are logged, one JSON object per line. Defaults to /usr/cloudshark/log/mcp-audit.jsonl. Set it to an empty string to turn logging off. If CloudShark can’t open this file, the MCP server stays off.

Restart the service gateway after any change:

systemctl restart cloudshark-service-gateway