hawkBit MCP server by denislavprinov · Pull Request #2871 · eclipse-hawkbit/hawkbit

denislavprinov · 2026-01-15T16:37:33Z

Introduces a new Model Context Protocol (MCP) server module (hawkbit-mcp) that enables AI assistants to interact with hawkBit
Provides MCP tools for managing all hawkBit entities: Targets, Distribution Sets, Software Modules, Rollouts, Actions, and Target Filters
Includes MCP resources for hawkBit documentation
Exposes predefined prompts
Supports credential pass-through authentication to hawkBit REST API

hawkbit-monolith/hawkbit-update-server/src/main/resources/application.properties

hawkbit-mcp/Dockerfile

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/HawkbitMcpServerApplication.java

...-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/client/HawkBitAuthenticationValidator.java

Signed-off-by: Denislav Prinov <[email protected]>

…er build Signed-off-by: Denislav Prinov <[email protected]>

hawkbit-mcp/README.md

...-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/client/HawkbitAuthenticationValidator.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/HawkbitClientConfiguration.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/HawkbitMcpProperties.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/dto/ManageActionRequest.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/dto/ManageDistributionSetRequest.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/dto/ManageRolloutRequest.java

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/dto/ManageSoftwareModuleRequest.java

… authentication validator conditional, and separate HTTP/STDIO client configurations Signed-off-by: Denislav Prinov <[email protected]>

desislava-marinova · 2026-02-03T12:45:14Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/McpSecurityConfiguration.java

    public static final String AUTH_HEADER_ATTRIBUTE = "hawkbit.mcp.auth.header";

-    private final HawkbitAuthenticationValidator authenticationValidator;
+    private final AuthenticationValidator authenticationValidator;


Why do you need a dummy validator when validation is disabled? Consider making it Optional and just skip the http.addFilterBefore(...);

desislava-marinova · 2026-02-04T11:03:50Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/tools/HawkbitMcpToolProvider.java

-        log.debug("Managing target: operation={}, controllerId={}", request.operation(), request.controllerId());
+                           "DELETE (remove target by controllerId). " +
+                           "Use 'type' field to select operation: " +
+                           "{\"type\":\"Create\",\"body\":{\"controllerId\":\"id\",\"name\":\"name\"}}, " +


Add Note: When creating a target without a specific target type, set \"targetType\": null. to set target type as null if not specified explicitly.

desislava-marinova · 2026-02-04T11:57:54Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/tools/HawkbitMcpToolProvider.java

-        log.debug("Managing rollout: operation={}, rolloutId={}", request.operation(), request.rolloutId());
+                           "Use 'type' field to select operation. " +
+                           "Types: Create, Update, Delete, Start, Pause, Stop, Resume, Approve, Deny, Retry, TriggerNextGroup. " +
+                           "Examples: {\"type\":\"Create\",\"body\":{...}}, " +


It is a good idea to add the knowledge that

for the rollout type, enum names ("soft", "forced", "timeforced", "downloadonly") should be used, not constants ("SOFT", "FORCED", etc.).

if groups property is specified, the amountGroups should be skipped

desislava-marinova · 2026-02-04T12:12:24Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/dto/ActionRequest.java

+     *
+     * @param actionIds list containing the single action ID to delete (use single-element list)
+     */
+    record Delete(List<Long> actionIds) implements ActionRequest {}


Use Long actionId for this request

desislava-marinova · 2026-02-04T12:14:57Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/McpHttpClientConfiguration.java

+    public HawkbitClient hawkbitClient(final HawkbitServer server,
+                                       final Encoder encoder,
+                                       final Decoder decoder,
+                                       final Contract contract) {
+        log.info("Configuring hawkBit client for HTTP mode (per-request authentication)");
+        return HawkbitClient.builder()
+                .hawkBitServer(server)
+                .encoder(encoder)
+                .decoder(decoder)
+                .contract(contract)
+                .requestInterceptorFn(httpRequestInterceptor())
+                .build();
+    }


Consider moving this method to the HawkbitClientConfiguration, providing only the requestInterceptorFn in the dedicated config.

desislava-marinova · 2026-02-04T12:22:31Z

hawkbit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/HawkbitMcpProperties.java

tenant\\username is not supported in hawkbit

desislava-marinova · 2026-02-04T12:46:24Z

hawkbit-mcp/src/main/resources/application.properties

Do you think it is better to annotate the respective properties in HawkbitMcpProperties with

@Value("${HAWKBIT_USERNAME:#{null}}")

@Value("${HAWKBIT_PASSWORD:#{null}}")

and have it null when not set?
This will allow setting an empty string as a valid value?

desislava-marinova · 2026-02-04T12:49:11Z

...bit-mcp/src/main/java/org/eclipse/hawkbit/mcp/server/config/McpStdioClientConfiguration.java

+            log.info("Configured tenant with static credentials for STDIO mode");
+        } else {
+            tenant.setUsername(null);
+            tenant.setPassword(null);


Consider this comment and if the suggested approach is used, there will be no need to check if credentials are set.

Signed-off-by: Denislav Prinov <[email protected]>

sonarqubecloud · 2026-02-04T19:52:10Z

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

denislavprinov force-pushed the feature/hawkbit-mcp-server branch from dc059b7 to b0d48e0 Compare January 15, 2026 16:47

avgustinmm reviewed Jan 16, 2026

View reviewed changes

denislavprinov mentioned this pull request Jan 19, 2026

[mcp] Initial MCP server module for HawkBit #2875

Closed

hawkBit MCP server

3bd09b9

Signed-off-by: Denislav Prinov <[email protected]>

denislavprinov force-pushed the feature/hawkbit-mcp-server branch from f1f3e2d to 1607ecf Compare January 20, 2026 09:52

Fix STDIO authentication support. Change license headers. Inline Dock…

5946a09

…er build Signed-off-by: Denislav Prinov <[email protected]>

denislavprinov force-pushed the feature/hawkbit-mcp-server branch from 1607ecf to 5946a09 Compare January 20, 2026 12:46

desislava-marinova reviewed Jan 30, 2026

View reviewed changes

Address PR review: refactor operation DTOs to sealed interfaces, make…

08473d3

… authentication validator conditional, and separate HTTP/STDIO client configurations Signed-off-by: Denislav Prinov <[email protected]>

desislava-marinova reviewed Feb 4, 2026

View reviewed changes

Address PR review. Provide More context in tools description.

7ef0399

Signed-off-by: Denislav Prinov <[email protected]>

Conversation

denislavprinov commented Jan 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 4, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants