Teleport MCP demo server by greedy52 · Pull Request #56637 · gravitational/teleport

greedy52 · 2025-07-09T19:13:45Z

implements #56587

Builtin Demo MCP server #56587

Replaces the in-memory test server with a proper "Teleport Demo" server. This demo server can be started with teleport app start --mcp-demo-server or equivalent config app_service.mcp_demo_server: true.

The demo server allows user to test out MCP access without external MCP server setup.

sample prompts:

can you show my teleport user and session info
tell me more about the teleport demo

demo: https://goteleport.zoom.us/clips/share/PhJBPNVHR_Ke3IZP4CfvVw

greedy52 · 2025-07-09T19:35:58Z

+	}
+}
+
+type inMemoryServerRunner struct {


moved from stdio_test.go with some minor modifications

r0mant

Looks good with a handful of mostly non-blocking comments.

r0mant · 2025-07-09T20:25:37Z

+To run a Teleport demo MCP server for MCP access:
+
+> teleport app start \
+   --token={{.token}} \{{range .ca_pins}}
+   --ca-pin={{.}} \{{end}}
+   --auth-server={{.auth_server}} \
+   --mcp-demo-server


Nit: I would probably not add this here tbh. I think this may confuse people who just want to start a regular app service, MCP seems to be a much more niche use-case for now.

dropped.

52507dc

(add added the flag to teleport configure, which should make the getting started guide super easy)

r0mant · 2025-07-09T20:26:21Z

+
+> teleport app start --token=xyz --auth-server=proxy.example.com:3080 \
+    --mcp-demo-server
+  Runs a Teleport demo MCP server from the app server.


This should probably give a very brief description of what the demo MCP server actually does (functions it provides).

r0mant · 2025-07-09T20:45:48Z

+	}
+}
+
+func makeEnrollMCPGuideToolHandler() mcpserver.ToolHandlerFunc {


It's an interesting idea to have LLM explain to you how to setup its own integration but I'm worried that a) this is basically a less comprehensive copy of the documentation guide and b) it will deviate from the docs very quickly and/or we'd have to remember to keep this updated. In general, keeping the docs in the code I think should be avoided.

I think instead of this we should have:

Clear and easy to follow documentation guide (which we do / will have).

A guided and easily discoverable MCP enrollment flow in Discover similar to those we built for other resources.

That would help most users get started quickly, and for those who want to use LLM to help with configuration, I'm pretty sure LLM will already be able to do that once we have the docs up via web search.

So WDYT about removing this particular tool to simplify things for now?

the mini guide in the binary would match what the current binary supports. but i totally agree this is a gimmick and needs to be maintained.

i have tried to give the AI the web link for it to figure out but it doesn't do a good job atm. well, that will improve eventually and it is not the task for this demo.

i've removed this tool and added a teleport_session_info instead.

7bf4ad3

r0mant

lgtm with one comment

backport-bot-workflows · 2025-07-15T13:39:45Z

@greedy52 See the table below for backport results.

Branch	Result
branch/v18	Failed

* Teleport MCP demo server * replace guide tool with session tool, and switch to resource label * add new flag to teleport configure * replace teleport_session_id with mcp_transport_type

* Initial PostgreSQL MCP support (#54431) * feat(mcp): initial postgres mcp * test(postgres): fix missing mock function * fix(gomod): go mod tidy all * refactor: code review suggestions * fix(tsh): mcp init missing logger * chore(tsh): missing other route to database field * refactor: use in-memory net listener * test(tsh): add mcp db command test * chore: fix license * refactor(tsh): move logger init * test(mcp): sort slices to avoid flakiness * chore: fix lint * test(mcp): sort the resources before assertion * fix(mcp): update error handler for better message * refactor: code review suggestions * feat: add external error retriever for more accurate error messages * refactor: use the same logger init for mcp purposes * refactor: code review suggestions * refactor(tsh): rename command to `tsh mcp db start` * refactor(mcp): protect database resources with rw mutex * chore: update server godocs * chore: go mod tidy * refactor: update command to take list of databases * chore(mcp): license * chore(tsh): remove unused function * refactor: code review suggestions * refactor(tsh): validate duplicated databases in MCP configuration * refactor(tsh): rename files to mcp_db * feat(mcp): add cluster name to the database resource * fix(tsh): update InitLogger return type (#55479) * MCP access part 1: update app definition and config (#54706) * MCP access part 1: update app definition and config * address feedback * make -C integrations/operator crd * MCP access part 2: new role options, access checker, role editor (#54734) * MCP access part 2: new role options, access checker, role editor * catch unsupported mcp fields * simplify mcpToolsToModel * MCP access part 3: audit events and reporting (#54779) * MCP access part 3: audit events and reporting * add new icon, storybook, format * MCP access part 4: mcputils (#54880) * MCP access part 4: mcp helpers * address feedback * address comment, minor edits * update mcp-go * MCP access part 5: Claude desktop config parser (#55179) * claude desktop config * rework * split Config to Config and FileConfig * add a comment on unofficial linux * MCP access part 6: "tsh mcp ls" (#55292) * MCP access part 6: "tsh mcp ls" * address feedback * MCP access part 7: MCP app in Web UI (#55306) * MCP access part 7: MCP app in Web UI * Make spacing in modal closer to what's in database modal * add mcp app to ResourceActionButton.story.tsx * move AppSubKind to shared/services/types. * remove --format claude (not needed see part 8) * add jsdoc --------- Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> * MCP access part 8: tsh mcp config (#55370) * MCP access part 8: tsh mcp login/logout * change to --format and --config-file * switch to config and drop logout * enable debug by default * remove unused ut functions * MCP access part 9: tsh mcp connect, stub server, integration test (#55547) * MCP access part 9: tsh mcp connect, stub server, integration test * fix tests and lint * MCP access part 10: server handler (#55644) * MCP access part 10: server handler * address feedback and fix docker tests * add more comments * minor lint fix * move set logger default after other checks * Implement `tsh mcp db config` (#55781) * feat(tsh): add `tsh mcp db config` subcommand * chore(claude): fix lint * refactor: code review suggestions * refactor: code review suggestions * test(tsh): add missing option on test case * chore(tsh): add message on manually adding database URI * Refactor MCP database access to dial ALPN proxy directly (#55836) * refactor: dial database instead of using local proxy for MCP servers * refactor: review suggestions * manual fixes * tctl users add/update to support mcp tools trait (#56771) * tctl users add/update to support mcp tools trait * revert empty slice capability * Enhances MCP servers usage with Cursor (#56474) * feat(mcp): enhances MCP servers usage with Cursor * refactor: code review suggestions * mcputils refactor and new mcptest package (#56010) * mcp server and mcputils refactor * mcptest package * allow testing in mcptest * Teleport MCP demo server (#56637) * Teleport MCP demo server * replace guide tool with session tool, and switch to resource label * add new flag to teleport configure * replace teleport_session_id with mcp_transport_type * feat(gomod): update mcp-go to v0.32.0 * eslint-disable-next-line (same in master) --------- Co-authored-by: Gabriel Corado <gabriel.oliveira@goteleport.com> Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

Teleport MCP demo server

9a29e6a

greedy52 self-assigned this Jul 9, 2025

greedy52 added no-changelog Indicates that a PR does not require a changelog entry MCP MCP Server related backport/branch/v18 labels Jul 9, 2025

greedy52 commented Jul 9, 2025

View reviewed changes

greedy52 requested review from GavinFrazar, Tener, gabrielcorado and r0mant July 9, 2025 19:38

Merge branch 'master' into STeve/56587_demo_server

614de79

greedy52 marked this pull request as ready for review July 9, 2025 19:38

github-actions Bot requested review from eriktate and fspmarshall July 9, 2025 19:38

github-actions Bot added application-access size/md tctl tctl - Teleport admin tool labels Jul 9, 2025

r0mant reviewed Jul 9, 2025

View reviewed changes

greedy52 removed request for eriktate and fspmarshall July 10, 2025 18:50

replace guide tool with session tool, and switch to resource label

7bf4ad3

greedy52 requested a review from r0mant July 11, 2025 13:51

add new flag to teleport configure

005e390

greedy52 force-pushed the STeve/56587_demo_server branch from 52507dc to 005e390 Compare July 11, 2025 13:55

r0mant approved these changes Jul 11, 2025

View reviewed changes

Comment thread lib/srv/mcp/demo.go Outdated

gabrielcorado approved these changes Jul 11, 2025

View reviewed changes

public-teleport-github-review-bot Bot removed request for GavinFrazar and Tener July 11, 2025 19:15

replace teleport_session_id with mcp_transport_type

1d896bb

greedy52 enabled auto-merge July 14, 2025 19:18

greedy52 added this pull request to the merge queue Jul 15, 2025

Merged via the queue into master with commit 1a9f35e Jul 15, 2025
42 of 44 checks passed

greedy52 deleted the STeve/56587_demo_server branch July 15, 2025 13:38

greedy52 mentioned this pull request Jul 15, 2025

[v18] MCP access #56143

Merged

greedy52 mentioned this pull request Jul 31, 2025

Builtin Demo MCP server #56587

Closed

Conversation

greedy52 commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greedy52 Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

r0mant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

r0mant Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

greedy52 Jul 11, 2025

Choose a reason for hiding this comment

Uh oh!

r0mant Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

r0mant Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

greedy52 Jul 11, 2025

Choose a reason for hiding this comment

Uh oh!

r0mant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Jul 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greedy52 commented Jul 9, 2025 •

edited

Loading