hawkBit MCP server (#2871)

* hawkBit MCP server Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com> * Fix STDIO authentication support. Change license headers. Inline Docker build Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com> * Address PR review: refactor operation DTOs to sealed interfaces, make authentication validator conditional, and separate HTTP/STDIO client configurations Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com> * Address PR review. Provide More context in tools description. Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com> * Address PR Review Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com> --------- Signed-off-by: Denislav Prinov <denislav.prinov@bosch.com>
2026-02-05 16:06:50 +02:00
parent c33156b134
commit 9f7ca0a3ed
30 changed files with 2958 additions and 0 deletions
--- a/hawkbit-mcp/README.md
+++ b/hawkbit-mcp/README.md
@@ -0,0 +1,109 @@
+# hawkBit MCP Server
+
+A standalone [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides AI assistants with tools to interact with [Eclipse hawkBit](https://www.eclipse.org/hawkbit/) for IoT device software update management.
+
+## Building
+
+From the project root directory:
+
+```bash
+mvn clean package -pl hawkbit-mcp -am -DskipTests
+```
+
+The JAR will be created at: `hawkbit-mcp/target/hawkbit-mcp-server-0-SNAPSHOT.jar`
+
+## Configuration
+
+The MCP server supports two transport modes:
+
+| Mode | Use Case | Authentication |
+|------|----------|----------------|
+| **HTTP/SSE** | Remote access, multi-user | Per-request via `Authorization` header |
+| **STDIO** | Local CLI tools (e.g., Claude Code) | Environment variables |
+
+
+### HTTP Transport
+
+Use HTTP transport when running the server as a standalone service:
+
+```json
+{
+  "mcpServers": {
+    "hawkbit-mcp": {
+      "type": "http",
+      "url": "http://localhost:8081/mcp",
+      "headers": {
+        "Authorization": "Basic <BASE64_ENCODED_CREDENTIALS>"
+      }
+    }
+  }
+}
+```
+
+Start the server separately:
+
+```bash
+java -jar hawkbit-mcp-server-0-SNAPSHOT.jar \
+  --hawkbit.mcp.mgmt-url=<HAWKBIT_URL>
+```
+
+**Generating Base64 credentials:**
+
+```bash
+# Linux/Mac
+echo -n "<USERNAME>:<PASSWORD>" | base64
+
+# PowerShell
+[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("<USERNAME>:<PASSWORD>"))
+```
+
+### STDIO Transport
+
+Use STDIO transport for direct integration:
+
+```json
+{
+  "mcpServers": {
+    "hawkbit-mcp": {
+      "command": "java",
+      "args": [
+        "-Dspring.ai.mcp.server.stdio=true",
+        "-Dspring.main.web-application-type=none",
+        "-jar",
+        "/path/to/hawkbit-mcp-server-0-SNAPSHOT.jar"
+      ],
+      "env": {
+        "HAWKBIT_URL": "<HAWKBIT_URL>",
+        "HAWKBIT_USERNAME": "<USERNAME>",
+        "HAWKBIT_PASSWORD": "<PASSWORD>"
+      }
+    }
+  }
+}
+```
+
+## Configuration Properties
+
+| Property | Environment Variable | Description | Default |
+|----------|---------------------|-------------|---------|
+| `hawkbit.mcp.mgmt-url` | `HAWKBIT_URL` | hawkBit Management API URL | `http://localhost:8080` |
+| `hawkbit.mcp.username` | `HAWKBIT_USERNAME` | Username for STDIO mode | - |
+| `hawkbit.mcp.password` | `HAWKBIT_PASSWORD` | Password for STDIO mode | - |
+| `hawkbit.mcp.validation.enabled` | - | Validate credentials against hawkBit | `true` |
+| `hawkbit.mcp.validation.cache-ttl` | - | Cache TTL for auth validation | `600s` |
+
+### Operation Controls
+
+You can enable/disable specific operations globally or per-entity:
+
+```properties
+# Global: disable all deletes
+hawkbit.mcp.operations.delete-enabled=false
+
+# Per-entity: allow delete for targets only
+hawkbit.mcp.operations.targets.delete-enabled=true
+
+# Disable rollout lifecycle operations
+hawkbit.mcp.operations.rollouts.start-enabled=false
+hawkbit.mcp.operations.rollouts.approve-enabled=false
+```