OpenAccess

OpenAccess MCP is a policy-driven MCP server that enables secure remote operations through SSH, SFTP, rsync, tunneling, VPN management, and RDP brokering. It provides RBAC, audit trails, and zero-trust controls to let AI assistants, automation tools, and DevOps teams perform remote actions with guardrails and visibility.

How to use

You connect to the OpenAccess MCP server using an MCP client and issue tools that map to remote operations like SSH execution, secure file transfer, and synchronization. Each operation is evaluated against policies, audited, and executed against the target systems. You can start local tunnels, manage VPN peers, and broker RDP sessions as needed, all within policy constraints and with real-time streaming of command output where supported.

How to install

Prerequisites you need before installing: Python 3.12 or newer and Docker for a practical demo environment.

# Clone the MCP server repository
git clone https://github.com/keepithuman/openaccess-mcp.git
cd openaccess-mcp

# Install with development dependencies
pip install -e ".[dev]"

# Optional: using uvx for dev tooling
uv sync --extra dev
uv pip install PyJWT prometheus-client
uv pip install -e .

Local development setup lets you run and test the server in isolation.

# Create and activate a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install in development mode
pip install -e ".[dev]"

# Quick test to ensure core MCP functionality is importable
python -c "from openaccess_mcp.server import OpenAccessMCPServer; print('✅ Installation successful!')"

# Run the MCP server for development
python -m openaccess_mcp serve

Start the MCP server with a predefined profile set to exercise capabilities.

openaccess-mcp start --profiles ./examples/profiles

Verify audit logs after starting the server.

openaccess-audit verify ./audit.jsonl

Docker-based demo environment can quickly bring up a server and SSH target for testing.

# Start demo environment (server + SSH target)
docker compose up -d

# Test the setup with profiles
openaccess-mcp start --profiles ./examples/profiles

If you prefer Kubernetes or cloud deployment, you can adapt the commands for your environment, using the same MCP server start flow with profiles.

Additional content

Security, policies, and operational guidance are built into the server to enforce least privilege, time-bounded sessions, and auditable actions. A comprehensive set of tools is exposed to perform remote operations through the MCP protocol while keeping control points visible and enforceable.

Key usage patterns include executing SSH commands with policy-specified allowlists, transferring files securely with integrity checks, performing safe synchronizations with dry-run support, creating tunnels for service access, managing VPN peers, and brokering RDP connections with signed URLs and TTLs.

Available tools

ssh.exec

Secure command execution on remote hosts with policy allowlists, RBAC, session timeouts, and real-time streaming of output.

sftp.transfer

Secure file transfers with checksum verification, recursive operations, and permission preservation.

rsync.sync

Incremental synchronization with dry-run protection, change tickets, and exclude patterns.

tunnel.create

Local/remote port forwardings and dynamic proxies to access services behind firewalls.

vpn.wireguard/openvpn

Manage VPN interfaces and peers for secure network access.

rdp.launch

Broker secure RDP connections with TTL-managed access and signed URLs.