Installation and Deployment

This chapter describes the requirements and procedures for deploying the SUSE Multi-Linux Manager MCP Server as a client-managed stdio container or a standalone HTTP service.

The MCP Server is available as a container image from the SUSE Container Registry.

1. Requirements

Before deployment, ensure that:

The deployment environment allows outbound HTTPS connections to the SUSE Multi-Linux Manager Server.
The SUSE Multi-Linux Manager account used by the MCP Server has only the permissions required for the intended tools.
A supported MCP client is installed.
The MCP client supports streamable HTTP and OAuth when these features are required.

2. Client-managed container with stdio

In this model, the MCP client starts the container and communicates with it over stdio. No host port is published.

Create a protected environment file for the server configuration:
```
UYUNI_SERVER=https://server.example.com
UYUNI_USER=mcp-reader
UYUNI_PASS=replace-me
UYUNI_MCP_SSL_VERIFY=true
UYUNI_MCP_WRITE_TOOLS_ENABLED=false
```
Restrict access to this file because it contains credentials. See Server Configuration for all settings.
Configure the MCP client to run:
```
podman run -i --rm \
  --env-file /absolute/path/to/mcp.env \
  registry.suse.com/suse/agentic/mcp/multi-linux-manager:<version>
```
Replace <version> with a tested release tag. Pin a release tag instead of using latest in a production configuration.

Continue with stdio client configuration.

3. Standalone HTTP server

Use HTTP mode when a persistent service must support multiple clients.

Create a protected environment file for the server configuration:

UYUNI_SERVER=https://server.example.com
UYUNI_MCP_SSL_VERIFY=true
UYUNI_MCP_WRITE_TOOLS_ENABLED=false
UYUNI_MCP_TRANSPORT=http
UYUNI_MCP_HOST=0.0.0.0
UYUNI_MCP_PORT=8000
UYUNI_MCP_PUBLIC_URL=https://mcp.example.com
UYUNI_AUTH_SERVER=https://idp.example.com/realms/mcp

When UYUNI_AUTH_SERVER is set, the MCP Server uses each client’s OAuth token to authenticate to the SUSE Multi-Linux Manager API. In this configuration, UYUNI_USER and UYUNI_PASS are not required.

Start the container:

podman run --rm \
  --env-file /absolute/path/to/mcp.env \
  -p 8000:8000 \
  registry.suse.com/suse/agentic/mcp/multi-linux-manager:<version>

Configure TLS termination for https://mcp.example.com and route requests to port 8000.
Connect the MCP client to:
```
https://mcp.example.com/mcp
```

The application serves plain HTTP itself. Do not expose it directly to an untrusted network.

If UYUNI_AUTH_SERVER is not set, HTTP requests to the MCP Server are unauthenticated. Only omit authentication for temporary testing on an isolated interface or network.

Complete the OAuth configuration described in OAuth configuration before allowing user access.