HashiConf 2025 Don't miss the live stream of HashiConf Day 2 happening now View live stream
Boundary Home

Boundary MCP server overview

The Boundary Model Context Protocol (MCP) server connects AI assistants to your Boundary cluster so that you can inspect and manage Boundary resources, such as targets, sessions, users, and roles, using natural language.

Public preview

Public preview functionality is stable, but possibly incomplete and subject to change. We strongly discourage using preview features in production deployments of Boundary.

MCP is an open standard that lets AI applications call external tools and read data from external systems. Any MCP client that supports the Streamable HTTP transport can connect to the Boundary MCP server. For example, you can use Visual Studio Code, Cursor, Claude Desktop, Amazon Q Developer, or IBM Bob.

The Boundary MCP server supports two use cases:

  • Administration: You can use natural language in an MCP client to inspect and manage Boundary resources, such as targets, sessions, users, and roles.
  • Agent access to targets: An AI agent can use the connect toolset to establish a Boundary session to an SSH or RDP target. The connect tool opens a local proxy to the target. The agent connects to the proxy with its own SSH or RDP client to run commands. The agent doesn't need Boundary logic in its code or the Boundary CLI installed. Because the target uses credential injection, the credentials never reach the agent or the model.

How the Boundary MCP server works

The MCP server sits between your MCP client and a Boundary controller. When you enter a prompt, the AI model selects the appropriate MCP tool, and the client sends a request to invoke it on the server. The server calls the Boundary API on your behalf and returns the result to the client, which passes it back to the model.

The server does not hold its own permissions. Each user supplies a Boundary token, and the Boundary controller authorizes every API operation against that user's roles and grants. An assistant can only do what the token's owner can do. In remote mode, the Boundary controller address is fixed at startup and cannot be overridden by a client request. Refer to the Boundary MCP server security model for details.

Disclaimer

Depending on the query, the MCP server may expose Boundary resource data to the MCP client and the large language model (LLM). Do not use the MCP server with untrusted MCP clients or LLMs.

Your use of a third-party MCP client or LLM is subject solely to the terms of use for that client or LLM. IBM is not responsible for the performance of third-party tools. IBM expressly disclaims any and all warranties and liability for third-party MCP clients and LLMs, and may not be able to provide support to resolve issues that third-party tools cause.

The MCP server generates outputs and recommendations dynamically, so they vary based on the query, the model, and the connected MCP client. Review all outputs and recommendations to confirm that they align with your organization's security best practices and compliance requirements before you implement them.

Supported resources and toolsets

The server groups its tools into toolsets. A toolset is a set of related tools for one Boundary resource type. Most resource types have a read toolset that lists and reads resources, and an admin toolset that creates, updates, and deletes them.

The server provides toolsets for the following resource types:

  • Targets
  • Sessions
  • Users, groups, managed groups, and roles
  • Accounts and auth methods
  • Scopes
  • Workers
  • Host catalogs, host sets, and hosts
  • Credential stores, credential libraries, and credentials
  • Storage buckets and session recordings
  • Aliases
  • Policies

By default, the server enables only the targets and sessions toolsets. You choose which toolsets to enable when you start the server, which lets you limit an assistant to read-only inspection or grant it administrative access.

In local mode, the server also provides a connect toolset, which starts a local proxy session to a target on your local machine. The connect toolset supports SSH and RDP targets only. AI assistants cannot connect to targets that use other protocols, such as TCP targets.

Unsupported operations

The Boundary MCP server does not support any Boundary API endpoint that handles secrets. AI assistants must not read secrets, so the server does not accept or return them.

For example, the server does not support the following operations:

  • Creating static credentials
  • Creating Vault credential stores
  • Setting a password when you create or update an account

The server can still read, list, update, and delete the non-secret values of a resource. For example, you can change the name or description of a static credential.

The server also does not support credential brokering, because brokering returns credentials to the requester. To use the connect toolset, configure the target for credential injection, so that Boundary supplies credentials to the session and never to the assistant or the model. Credential injection is supported for SSH and RDP targets only. TCP targets are not supported.

The server accepts only Boundary auth tokens. It does not support app tokens. The server also does not run an authentication flow, such as an OpenID Connect (OIDC) login, so you must authenticate with Boundary first and then supply the resulting auth token.

More information

Next steps

Edit this page on GitHub