Model Context Protocol: Setup MCP Server on Bare Metal

# 1. Install 'uv' globally
curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env

# 2. Create the MCP project directory
mkdir ~/enterprise-mcp && cd ~/enterprise-mcp

# 3. Initialize the project and create a virtual environment
uv init
uv venv
source .venv/bin/activate

# 4. SRE FIX: Install the official FastMCP package explicitly
uv add fastmcp

# server.py
import sys
import logging
import os
from fastmcp import FastMCP

# SRE FIX: Force all logging to stderr to protect the JSON-RPC stdio stream
logging.basicConfig(level=logging.INFO, stream=sys.stderr, format='%(levelname)s: %(message)s')
logger = logging.getLogger(__name__)

# Initialize FastMCP Server
mcp = FastMCP("Enterprise-Data-Gateway")

@mcp.tool()
def get_server_status() -> str:
    """Returns the current operational status of the Bare Metal server."""
    logger.info("Tool called: get_server_status")
    return "ServerMO Bare Metal Node 01: All systems operational. 0% Packet Loss."

if __name__ == "__main__":
    logger.info("Starting MCP Server on stdio transport...")
    mcp.run(transport="stdio")

from pathlib import Path

# Define a strict sandbox directory
ALLOWED_DIR = Path("/home/ubuntu/enterprise-mcp/data").resolve()

@mcp.tool()
def read_secure_file(filename: str) -> str:
    """Reads a text file strictly from the allowed data sandbox."""
    
    # 1. Resolve the requested path securely
    requested_path = (ALLOWED_DIR / filename).resolve()
    
    # 2. SRE FIX: Prevent Sibling Directory Path Traversal Bypass
    if not requested_path.is_relative_to(ALLOWED_DIR):
        logger.error(f"Security Violation: Attempted path traversal to {requested_path}")
        return "ERROR: Access Denied. Path traversal detected."
        
    # 3. Check if file exists
    if not requested_path.is_file():
        return f"ERROR: File '{filename}' not found in the sandbox."
        
    # 4. Safe Read
    try:
        with open(requested_path, 'r', encoding='utf-8') as f:
            return f.read()
    except Exception as e:
        logger.error(f"Read error: {str(e)}")
        return "ERROR: Could not read file due to permissions or locking."

{
  "mcpServers": {
    "enterprise-bare-metal": {
      "command": "ssh",
      "args": [
        "-q",
        "-T",
        "-i",
        "/path/to/your/private_key.pem",
        "ubuntu@YOUR_REMOTE_SERVER_IP",
        "/home/ubuntu/.local/bin/uv",
        "--directory",
        "/home/ubuntu/enterprise-mcp",
        "run",
        "--quiet",
        "server.py"
      ]
    }
  }
}