{"resourceId":"aap-27-mcp-server-ga-dual-permission-data-exposure-guidance","versions":[{"version":"external-61384c947475d54a4e0f4324629ab04595144eecdb3de53a683da0915bff878f","resource":{"id":"aap-27-mcp-server-ga-dual-permission-data-exposure-guidance","title":"Red Hat Ansible Automation Platform 2.7 documentation: MCP server is GA, read-only by default, and passes tool results to external LLM providers without added filtering","organization":"Red Hat (Ansible Automation Platform documentation)","sector":"Strategic partner platform: agent access to IT automation","geography":"Global (product documentation)","publishedAt":"Red Hat documentation for AAP 2.7, page undated; states GA as of the June 3, 2026 release; retrieved Oct. 30, 2026","publicationDate":null,"eventDate":"2026-06-03","sourceName":"Red Hat Documentation","sourceLabel":"Red Hat Ansible Automation Platform 2.7 Overview: About the MCP server","sourceUrl":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/extend-con_about_ansible_mcp_server","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement"],"finding":"Vendor documentation states that the MCP server for Ansible Automation Platform has been generally available and fully supported in AAP 2.6 and later since the June 3, 2026 release. It uses a dual-layer model: a global read-only default that blocks job launches and configuration changes regardless of user rights, and an optional read-write mode limited by the RBAC of the user's API token. Red Hat warns that LLMs can misinterpret prompts or hallucinate commands, so read-write mode may cause unintended changes. With an external LLM provider, all tool call results (job details, inventory contents, host variables, IP addresses, DNS names, configuration) are sent to that provider. The MCP server adds no filtering or redaction beyond the AAP API; secret credential fields are masked, but credential names, types and usernames are visible. Red Hat collects anonymized telemetry from the MCP server.","sledRelevance":"Newly relevant because Red Hat's Oct. 29 blog directs customers to start agentic operations with this MCP server, and same-day third-party coverage misdescribed it as a Technology Preview. For state, county, university and district IT teams, the documented data flow matters: connecting a hosted AI assistant to AAP exposes infrastructure inventory to that provider, which may conflict with state security policy, CJIS or FERPA-related system rules.","evidence":"Read the AAP 2.7 MCP server overview page in full and the AAP 2.7 Extend guide PDF, which repeats the read-write risk warning. The page is vendor documentation with no publication date; it reports design and support status, not field results. The original Feb. 2, 2026 Red Hat blog introducing the server as a Technology Preview in AAP 2.6.4 was also opened to confirm the status change.","architectureImplications":"The MCP server is a pass-through gateway between an external AI client and the AAP API. Data minimization must be done through token scoping, toolset selection and keeping sensitive values out of inventory variables and job output. Agencies that require data to stay in-house would need a self-hosted model behind the MCP client.","governanceImplications":"Read-write enablement is a global administrative decision that should go through change control. Agencies should record which MCP clients and LLM providers are approved, and which tokens they use.","securityPrivacyImplications":"Infrastructure details (IPs, hostnames, host variables) leave the agency when an external LLM provider is used. Hallucinated commands are an acknowledged risk in read-write mode. Secrets stored outside the AAP credential system may also be exposed.","caveats":"Vendor documentation, undated page; describes intended controls, not tested behavior; no independent security assessment of the MCP server was found.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: this is a governed way to let AI assistants use Ansible automation, and it is supported in production. Lead with the controls (read-only by default, actions limited to the user's RBAC), and be upfront about the data flow: with a hosted LLM, inventory and job data go to that provider. For SLED buyers, offer a read-only pilot with an approved or self-hosted model. Do not describe it as a Technology Preview; that changed in June 2026.","engineering":"Engineering framing: treat the MCP server as a thin pass-through. It adds no redaction, so scoping happens through least-privilege API tokens, limited toolsets and keeping secrets in the AAP credential system. Keep the global read-only default for initial pilots. If read-write is required, restrict tokens to specific job templates and require approvals in workflows. Check which LLM provider the MCP client uses and whether infrastructure data may leave the agency under policy.","delivery":"Delivery framing: roll out in two stages. First, read-only access for a small group with a dedicated low-privilege token and an approved AI client. Second, read-write only for specific job templates, after a security review of data exposure and a test showing that unauthorized actions are rejected. The automation platform team owns tokens and toolsets; security owns the approved-provider list. Review MCP usage logs and token scopes each quarter."},"roleDetails":{"sales":{"customerProblem":"IT teams want AI assistants to query and run automation, but must prevent unreviewed changes and avoid leaking infrastructure data to external AI providers.","stakeholders":["Automation platform owner","CISO and security architects","IT operations leadership","Privacy or records officer","Procurement for AI client licenses"],"discoveryQuestions":["Which AI clients and LLM providers are approved for infrastructure data?","Are secrets ever stored in inventory variables or job output?","Would read-only access deliver enough value for a first phase?","How are AAP API tokens issued, scoped and rotated today?"],"valueHypothesis":"A read-only MCP integration may speed troubleshooting and inventory questions for operations staff without new change risk, provided data exposure to the chosen LLM is acceptable.","potentialEngagement":"A security-reviewed read-only MCP pilot with a scoped token and an approved or self-hosted model, followed by a decision on limited read-write use.","unsupportedClaims":["That MCP integration keeps infrastructure data inside the agency when using a hosted LLM","That RBAC prevents all harmful actions if tokens are over-permissioned","Any productivity gains (no measurements are given)","That it is still a Technology Preview"]},"engineering":{"fit":"Fits AAP 2.6+ customers exploring agentic operations who already manage RBAC and tokens well.","architectureIntegration":"External MCP client (AI assistant) to AAP MCP server, which authenticates with a user's API token to the AAP API; a discover endpoint loads toolsets on demand to reduce token usage.","prerequisites":["Ansible Automation Platform 2.6 or later","Least-privilege API tokens per user or use case","An approved MCP client and LLM provider","Secrets held only in the AAP credential system"],"constraints":["No additional filtering or redaction beyond the AAP API","Tool results go to the external LLM provider","Read-write mode carries risk of unintended changes from model errors","Anonymized telemetry is collected by Red Hat"],"security":"Read-only global default; read-write bounded by token RBAC; secrets masked but credential metadata, IPs, hostnames and host variables are exposed to the model context.","proofOfValue":["Attempt an action outside the token's RBAC and confirm rejection","Inspect what data an inventory query returns to the AI client","Confirm read-only mode blocks job launches for an admin token","Review data-handling terms of the LLM provider used"]},"delivery":{"work":"Deploy the MCP server, configure read-only mode, issue scoped tokens, onboard a pilot group, then evaluate read-write for specific templates.","dependencies":["Security review of data exposure","Approved AI client licensing","Token management process","AAP upgrade to 2.6 or later if needed"],"ownership":"The automation platform team owns the MCP server, tokens and toolsets; security owns the approved-provider list and periodic review.","skillsAdoption":"Train pilot users on safe prompting and on which data must not be shared with external models; train admins on token scoping.","governanceCheckpoints":["Security approval before connecting an external LLM","Change approval to enable read-write mode","Quarterly review of tokens, toolsets and usage"],"acceptanceCriteria":["Proposed: 100% of out-of-scope actions rejected in testing","Proposed: no secrets found in MCP tool responses during a data-exposure review","Proposed: read-write enabled only for listed job templates"],"risks":["Over-permissioned tokens","Sensitive data stored in inventory variables reaching the LLM","Hallucinated commands in read-write mode","Shadow use of unapproved AI clients"]}},"retrievedAt":"2026-10-31T03:12:34Z","enrichedAt":"2026-10-31T03:19:23Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Lets less-experienced staff query automation in natural language, which can widen access; this also raises the need for training on what not to ask an external model.","procurementImplications":"Agencies should review the AI client and LLM provider terms (data retention, training use) as part of enabling MCP, not only the Red Hat subscription. Telemetry collection should be noted in security reviews.","operatingModelImplications":"Creates a new integration point owned by the automation platform team, requiring token lifecycle management and periodic review of exposed toolsets.","sourceVerification":{"openedUrl":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/extend-con_about_ansible_mcp_server","referenceExcerpt":"Large Language Models (LLMs) can occasionally misinterpret prompts or hallucinate commands.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}