Red Hat Lightspeed MCP

Diagnose a 403 access denial for a specific MCP tool call. Returns only the console role names the caller is missing. Use this instead of guessing permission or role names. The authenticated principal is usually the MCP service account when using client ID/secret in the environment—not the console user in chat.

Return the console role names required for an MCP tool. This reports required roles without checking the authenticated caller's current access. Use ``explain_access_denied`` after a 403 response.

Get RBAC access for the authenticated caller for one application. Returns permissions for the identity used by this MCP server (service account or Bearer token)—not necessarily the human user.

List all RBAC permissions for the authenticated MCP caller (paginated fetch). Permissions apply to the service account or Bearer identity used by MCP—not your console user unless that identity is what MCP uses.

Get the list of activation keys available to the authenticated user. 🟢 CALL IMMEDIATELY - No information gathering required. This endpoint returns activation keys that can be used for RHEL system registration. Activation keys contain subscription and configuration information needed to register systems with Red Hat Subscription Management. If the user has more questions about the activation keys, ask the user to go to https://console.redhat.com/insights/connector/activation-keys Returns: List of activation keys with their details including names, descriptions, and associated subscriptions.

Get a specific activation key by name. 🟢 CALL IMMEDIATELY - No information gathering required. This endpoint returns details for a specific activation key including its name, description, service level, role, usage, release version, and additional repositories. Returns: Activation key details including configuration and subscription information.

Show, list, or display fleet inventory in an interactive dashboard. PREFER this tool over list_hosts whenever the user wants to see, show, list, or display hosts or fleet inventory. Use list_hosts only when you need the raw data for analysis or processing. The dashboard fetches data directly from the server. All filter parameters are optional.

List hosts with filtering and sorting options. CRITICAL: For the 'per_page' parameter, you MUST use a value of 10 on the first call to avoid performance degradation and context overflow. Only use a larger value if the user explicitly requests to see more systems at once.

Get detailed information for specific hosts by their IDs. Returns comprehensive host data including identifiers (insights_id, satellite_id, bios_uuid), display names, network info (IP/MAC addresses), cloud provider details, account/org metadata, timestamps (created, updated, stale_timestamp), reporter info, groups, facts, and basic system_profile data. Args: host_ids: Comma-separated list of host IDs (UUIDs) to retrieve.

Get detailed system profile information for specific hosts. Returns comprehensive hardware and software configuration data including CPU details (model, count, cores per socket), memory info (system_memory_bytes), infrastructure details (type, vendor), network interfaces, disk devices, BIOS information, and various system state data. For RHEL hosts, also includes software information such as enabled repositories, installed packages, and enabled services. This provides the most detailed technical specifications for each host.

Get tags for specific hosts. Args: host_ids: Comma-separated list of host IDs (UUIDs) to get tags for.

Find a host by its hostname/display name. Args: hostname: The hostname or display name to search for.

List Inventory workspaces (console UI name for Inventory groups). Call this tool whenever the user asks to list, show, or get workspaces. Do not invent workspace names such as Ungrouped Hosts without calling this API. Each result includes id, name, ungrouped, and host_count. Prefer workspace IDs in later calls; names can be duplicated. Required permission: inventory:groups:read (Workspace viewer).

Get details for one or more workspaces by ID. Returns id, name, ungrouped, host_count, and timestamps for each workspace. Required permission: inventory:groups:read (Workspace viewer).

List hosts that belong to a workspace. Use list_workspaces first to obtain the workspace ID. Required permission: inventory:hosts:read (Inventory Hosts viewer).

Create remediation playbook for given CVEs on given systems to mitigate vulnerabilities. Don't process the playbook. You MUST return the YAML as is. Args: playbook_name: Name of the playbook. Example: "Remediation Playbook" cves: CVE identifiers. Example: ["CVE-2016-0800", "CVE-2016-0801"] uuids: Systems Inventory UUIDs. Example: [123e4567-e89b-12d3-a456-426614174000]

Get OCP Advisor backend health, deployed OCP rules version, and release metadata. 🟢 CALL IMMEDIATELY - No information gathering required. Returns internal Smart Proxy, Insights Results Aggregator, and Content Service status/build/version metadata from the unauthenticated /info endpoint. This is primarily useful for service diagnostics, release verification, and backend health checks; it does not return Advisor recommendations or cluster findings.

List clusters available to the authenticated user. 🟢 CALL IMMEDIATELY - No information gathering required. Uses the Insights Results Aggregator v2 ``/clusters`` endpoint, which returns clusters visible to the authenticated account along with recommendation hit counts and risk summaries.

Get $container_brand_long Vulnerability OpenAPI specification in JSON format.

Show, list, or display CVEs — account-level or for a specific system — in an interactive dashboard. PREFER this tool over get_cves and get_system_cves whenever the user wants to see, show, list, or display CVEs, whether for the entire account or for a specific system. Use get_cves or get_system_cves only when you need the raw data for analysis or processing. The dashboard fetches data directly from the server. If system_uuid is provided, it fetches system-level CVEs. Otherwise, it fetches account-level CVEs. All filter parameters are optional. Args: system_uuid: System UUID for system-level CVEs. Leave empty for account-level. filter_: Full text filter for CVE name or description. limit: Maximum number of CVEs to fetch. offset: Offset for pagination. sort: Sort field. Use '-' prefix for descending. impact: Comma-separated impact IDs. cvss_from: Minimum CVSS score filter. cvss_to: Maximum CVSS score filter. advisory_available: Filter by advisory availability. known_exploit: Filter by known exploit.

Get list of CVEs affecting the account. This provides an overview of vulnerabilities across your entire system inventory. Use this endpoint to get an overview of which CVEs are affecting your account, including some CVE metadata, how many systems are affected by each CVE, and more. For more info refer to OpenAPI spec Args: filter: Full text filter/search for CVE and it's description text. limit: Pagination - Maximum number of records per page. offset: Pagination - Offset of first record of paginated response. sort: Attribute sorting. Use `-` prefix to sort in descending order. cvss_from: Filter based on cvss score, starting from the value. cvss_to: Filter based on cvss score, up to the value. impact: Comma separated list of CVE Impact IDs. Example : 5,7. impact mapping: (0, 'NotSet'), (1, 'None'), (2, 'Low'), (3, 'Medium'), (4, 'Moderate'), (5, 'Important'), (6, 'High'), (7, 'Critical') rule_presence: Comma seprated string with bools. If true shows only CVEs with security rule associated, if false shows CVEs without rules. true, false shows all. known_exploit: String of booleans (array of booleans), where true shows CVEs with known exploits, false shows CVEs without known exploits. advisory_available: String of booleans (array of booleans), where true shows CVE-system pairs with available advisory, false shows CVE-system pairs without available advisory. affecting_host_type: Comma separated string of values. Controls, whenever CVE has 1 or more affecting systems. Value "edge" returns CVEs with one or more vulnerable immutable systems, value "rpmdnf" returns CVEs with one or more vulnerable conventional systems. Value "none" returns CVEs not affecting systems of any kind. Allowed values: "edge", "rpmdnf", "none".

Get details about specific CVE. This endpoint returns the CVE identification number, description, scores and other metadata. The metadata includes the description, CVSS 2/3 Score, CVSS 2/3 attack vector, severity, public date, modified date, business risk, status, a URL to Red Hat web pages, a list of advisories remediating the CVE, and information regarding known exploits for the CVE. For more info refer to OpenAPI spec Args: cve: CVE identifier. Example : CVE-2016-0800 advisory_available: String of booleans (array of booleans), where true shows CVE-system pairs with available advisory, false shows CVE-system pairs without available advisory.

Get list of systems affected by a given CVE. This is a report of affected systems for a given CVE. Use this tool to obtain list of all affected systems for a given CVE. For more info refer to OpenAPI spec Args: cve: CVE identifier. Example : CVE-2016-0800 (Required) filter_: Full text filter for the display name of system. limit: Pagination - Maximum number of records per page. offset: Pagination - Offset of first record of paginated response. sort: Attribute sorting. Use `-` prefix to sort in descending order. system_uuid: Filter based on Systems Inventory UUID.

Get list of CVEs affecting a given system. IMPORTANT: Prefer `get_cves` as `get_cves` can filter for CVEs with available advisories. This is a report of CVEs affecting a given system. Use this tool to obtain list of all CVEs affecting a given system. For more info refer to OpenAPI spec Args: system_uuid: Systems Inventory UUID. Example : 123e4567-e89b-12d3-a456-426614174000 (Required) filter_: Full text filter for the CVE name. limit: Pagination - Maximum number of records per page. offset: Pagination - Offset of first record of paginated response. sort: Attribute sorting. Use `-` prefix to sort in descending order.

Get list of systems in $container_brand_long Vulnerability inventory. List all systems registered in $container_brand_long Vulnerability service, including information about their last check-in, system name, workspace name, RHEL version, and number of CVEs affecting them. This tool shows both affected and not affected systems. For more info refer to OpenAPI spec Args: filter_: Full text filter for the display name of system. limit: Pagination - Maximum number of records per page. offset: Pagination - Offset of first record of paginated response. sort: Attribute sorting. Use `-` prefix to sort in descending order. group_names: Filter based on workspace names. Comma separated list of workspace names. rhel_versions: Filter based on RHEL versions. Comma separated list of RHEL versions.

Explain why CVEs are affecting my environment. This endpoint returns a detailed explanation of why CVEs are affecting my environment. It uses VMAAS to explain the CVEs, what packages are affected and why. Alongside with the information how this CVE can be fixed. To get the explanation, we need to get the system UUID from the inventory and list of CVEs. 'affected_packages' in 'vmaas' response is a list of packages that are affected by the CVE. To update affected packages, suggest to use Ansible Remediation Playbook via Remediations MCP tool. Args: cves: CVE identifiers. Example: CVE-2016-0800,CVE-2016-0801 system_uuid: System UUID. Example: 123e4567-e89b-12d3-a456-426614174000

Example tool.

Send GET request to Insights API without authentication.

Send GET request to Insights API with authentication.