Is a MCP server exist for Incus

Incus
1

Hello there,

Maybe a silly question but I was wondering if it exists a MCP server for incus ? I’ve seen it exist an API and I’d love to connect a LLM to this.

If the subject has already be treated, sorry for redundancy but I didn’t catch any info so far.

Best Regards,

PS: Incus is an amazing tool, I love it. I will use it as a daily (k8s, CI/CD, …) for personal and professional stuff

2

Hi Frédéric.

I have not heard of one. It is an interesting idea.

You can get everything from Incus as JSON using the CLI tools. That might be enough to connect an LLM or to build a simple MCP interface. If you decide to build a MCP service then Go should work pretty well. Incus is written in Go.

3

Hey @jarrodu ,

Thanks for the comment, I will definitely check that. I’m not really familiar with Go but I guess that worst a try.\

I didn’t yet really realized that I just could use directly the cli tool directly with a LLM. But you right, that’s so simple as that. I will try with Claude code. Great tips :wink:

It’s freaking thinking we can nowdays do such things using LLM …

4

▎ Thanks Jarrod — agreed, Go is the natural fit here since it can use Incus’s own github.com/lxc/incus/client SDK directly instead of shelling out to the CLI and parsing JSON.
▎
▎ I’m going to start on a minimal MCP server for Incus. Planned first-pass tool surface (read-heavy, safe-by-default):
▎
▎ - list_instances, instance_info, instance_state
▎ - start_instance / stop_instance / restart_instance (explicit, no bulk/destructive ops in v1)
▎ - list_projects, list_networks, list_storage_pools
▎ - exec_in_instance (opt-in, since this is the one genuinely sensitive capability)
▎
▎ Deliberately leaving out instance creation/deletion and cluster-admin operations for a first pass — those need more thought around confirmation/safety before exposing them to an LLM-driven client. Will follow up here once there’s something runnable to look at.

5

First working version is up: GitHub - fredmj/incus-mcp-server: A Model Context Protocol server for Incus · GitHub

Matches what I outlined above:

- list_instances

- instance_info

- instance_state

- list_projects

- list_networks

- list_storage_pools always on, start_instance

- stop_instance

- restart_instance

- exec_in_instance gated behind an explicit --enable-write flag (off by default).

Built on the official Go SDKs on both sides (github.com/lxc/incus/v6 and GitHub - modelcontextprotocol/go-sdk: The official Go SDK for Model Context Protocol servers and clients. Maintained in collaboration with Google. · GitHub ), and reuses the incus CLI’s own config file so there’s no separate credential setup if incus list already works for you.

Tested against a real cluster, not just unit tests - happy to hear about rough edges if anyone tries it.

6

I experimentally vibe coded one, and it was ‘VERY’ secure for lab products, but a bit hard to use. It did do things, but I REALLY don’t trust ‘self hosted’ models on my incus infra! The fronteir models mostly don’t mess it up, but I would be VERY hesitant to use one on prod!

7

@Thomas_Munn , Mostly agree. I don’t plug MCP server in prod for the moment, even with frontier model. I trust them, but not enough to take the risk. Not yet at least.

I actively use mine in lab (and preprod), largely running the Incus cluster containerized in Podman. Thinking about experimenting with a K8s-native IaC setup next. But overall that’s basically why I split the tool surface into tiers rather than shipping one flat set of capabilities:

  • read-only tools (list/info/state) are always on,
  • and everything else is opt-in and additive —
    –enable-write for power state + a single bounded exec_in_instance (no persistent shell, no TTY, 60s timeout, one command per call),
    –enable-create separately,
    –enable-delete separately again, and every delete call has to echo back the resource’s exact name in a confirm_name field or it’s refused before it ever reaches Incus.

So you can hand a model “restart things and run one diagnostic command” without it ever being one flag-flip away from also being able to delete a storage pool.

Curious whether that tiering would’ve addressed what made your version “hard to use,” or if the friction was somewhere else.

8

May I ask who enforces MCP rules?

9

@jochumdev For the moment that’s me and a bunch of friends working with me on another project (IdP).

We all actively use Claude (and sometimes Codex) to find breaches, and are largely inspired by literature on the net.

Maybe I will add them in the repo. But it largely depends on the infrastructure and architectures choice of the running env.