Using MCP to patch RHEL CVEs without leaving your IDE

Get Help Guides, FAQs & Howtos
, , ,
1

Hey all, wanted to share something I’ve been working on that I think is pretty cool from a workflow perspective.

I’ve been experimenting with connecting Red Hat Lightspeed and Ansible Automation Platform to an AI coding assistant via MCP (Model Context Protocol). The idea is simple: instead of bouncing between the Insights console, errata pages, and AAP to patch a CVE, you just ask the assistant to do it in natural language.

Here’s what the workflow looks like in practice:

  1. You tell the assistant “patch CVE-2024-6174 on my RHEL fleet”
  2. It calls the Lightspeed MCP server to check which systems are affected and pulls the advisory details
  3. It calls the AAP MCP server to find the right job template and launches the patch
  4. You review the AAP job output to confirm it worked

The whole thing took about 2 minutes for what would normally be 15-20 minutes of clicking around multiple consoles. The human stays in the loop – you approve the execution before anything runs – but all the toil of looking up advisories, cross-referencing systems, and finding the right playbook is handled for you.

I put together a short demo video if anyone wants to see it in action: https://youtu.be/VFR7j_pgKCg?si=2urS1qukh8HYQjX1

Curious if anyone else is using MCP servers for ops workflows like this. The pattern feels like it generalizes well beyond just patching – anything where you’re gathering context from one system and taking action in another seems like a good fit.

What’s your experience been with MCP for day 2 operations?

2

How is this better compared to “create playbook to fix CVE-xxx”? Playbook is testable, distributable to isolated environments. Maybe some other benefits. What are benefits here?

I do not use MCPs in that way, curious to know more.

3

Good question. One of the pieces of feedback I am getting from users is that they don’t trust the playbooks that are created from AI. If you are able to understand the playbook, and you can review it, and you trust it, then that is fine.

In this case the playbook itself is not AI generated. Red Hat will provide these playbooks “pre-approved” for certain CVEs that have been tested through Red Hat Lightspeed on console.redhat.com.

I am simply using AI to “drive” through human language different tools, but you could set this same workflow without AI. You could have EDA (event-driven automation) trigger the playbook automatically when CVEs are found and just run it verbatim.