# PiLAB MCP for AI Agents MCP > PiLAB lets you manage your virtual machines, security certificates, and OAuth clients directly through your AI agent. It connects your PiVirt, PiTrust, and 3SO environments into a single conversational interface for faster infrastructure updates and security audits. ## Overview - **Category:** infrastructure - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_iVEAhkTURIdQXYKBTK9hoOvL4teobdypKfkwNzpe/mcp - **Tags:** infrastructure-management, virtualization, zero-trust-security, oauth2, certificate-management, kvm-virtualization ## Description This MCP lets you take control of your infrastructure and security operations through a simple conversation. Imagine you're in the middle of a production incident and need to know if a VM is running, check the status of a specific SSL certificate, and see which OAuth clients have access to a service. Usually, that's three different browser tabs and a lot of manual cross-referencing. With this connector, you just ask your agent. It pulls the data from your various environment accounts instantly. You can start or stop machines, check certificate expiry dates, and audit active user sessions without ever leaving your chat window. It turns your AI into a hands-on operations assistant that knows your specific infrastructure layout. Because it's hosted on Vinkius, you get a reliable way to bridge these complex security tools into your daily workflow. Instead of hunting for logs or clicking through nested menus, you get direct answers and actions in one place. It cuts out the friction of manual infrastructure management so you can focus on actually solving problems. You can verify that your security policies are actually in place or see which hosts are over-provisioned without having to login to multiple separate management consoles. It brings everything into a single, unified flow. ## Tools ### control_vm Start, stop, restart, pause, or resume a virtual machine. Use this to manage VM lifecycles quickly. ### get_certificate_details Get the metadata and rotation status for a specific certificate. This helps you track security credentials in one place. ### get_host_details Retrieve the configuration and status of a specific host. Use this to check the health of your virtualization hardware. ### list_virtual_machines List all VMs across your hosts with optional host filtering. This gives you a complete overview of your running infrastructure. ### get_oauth_client View the configuration, scopes, and grant types for a specific OAuth client. Use this to audit your application permissions. ### get_vm_details Get specific hardware and status details for a single virtual machine. This is useful for troubleshooting specific resource issues. ### introspect_token Validate an OAuth 2.0 access token to check its validity, scopes, and expiry. Use this to verify security credentials before trusting them. ### list_certificates View all TLS and SSL certificates currently managed in your environment. This helps you identify which certificates need rotation. ### list_hosts See all available virtualization hosts in your environment. Use this to get a quick count of your active hardware. ### list_oauth_clients List every registered OAuth 2.0 application in your identity system. Use this to see all third-party integrations in one list. ### list_access_policies View all ZeroTrust access policies and RBAC rules. This allows you to audit your security posture without opening a separate console. ### list_active_sessions List current user sessions to audit who is currently in your system and what permissions they are using. Use this for real-time security monitoring. ## Prompt Examples **Prompt:** ``` Can you show me all the VMs running on my PiVirt hosts? ``` **Response:** ``` I've found 12 virtual machines across 4 hosts. Here's a summary: | VM Name | Status | Host | CPU | Memory | | :--- | :--- | :--- | :--- | :--- | | web-prod-01 | Running | node-01 | 4 vCPUs | 16 GB | | db-replica-02 | Running | node-02 | 8 vCPUs | 32 GB | | staging-api | Stopped | node-03 | 2 vCPUs | 8 GB | Would you like to see details for any specific one? ``` **Prompt:** ``` Check if my TLS certificates are expiring soon. ``` **Response:** ``` I've scanned your PiTrust certificates. ⚠️ **Two require attention:** * `*.pilab.hu` expires in 14 days (rotation pending) * `api.internal.pilab.hu` expires in 22 days The remaining 4 certificates are valid for at least 60 days. Would you like the full details on the expiring ones? ``` **Prompt:** ``` Is this access token still valid? ``` **Response:** ``` I've introspected that token. It is currently **Active**. * **Expiry:** 4 hours remaining * **Scopes:** `read:users`, `write:orders` * **Associated Client:** Admin-Portal It is safe to use for the next few hours. ``` ## Capabilities ### Control VM lifecycles Start, stop, restart, pause, or resume virtual machines from your chat. ### View TLS and SSL certificate metadata Inspect certificate details and rotation status across your environment. ### Manage ZeroTrust access policies List and review RBAC rules and access grants in your security stack. ### Inspect OAuth 2.0 client configurations View scopes, grant types, and configurations for all registered applications. ### Validate OAuth 2.0 access tokens Verify token validity, expiry, and associated scopes in real-time. ### Monitor active user sessions Audit who is currently authenticated and what permissions they hold. ### List all virtual machines Get a complete overview of your VMs across all virtualization hosts. ## Use Cases ### Scaling a staging environment A developer needs to scale a staging environment. They ask the agent to list_virtual_machines and then use control_vm to start three new instances. ### Identifying expiring certificates A security lead wants to check for expiring certs. They ask the agent to list_certificates and identify any that expire in under 30 days. ### Verifying user permissions An admin needs to verify a user's permissions. They use introspect_token to check a provided access token's scopes and validity. ### Auditing active user sessions An IT manager wants to see who is logged in. They use list_active_sessions to audit the current identity landscape. ### Reviewing OAuth configurations A platform architect wants to see all OAuth clients. They use list_oauth_clients to review the configurations and grant types for all registered apps. ## Benefits - Stop switching tabs. Use list_hosts and list_virtual_machines to see your entire VM landscape in one chat. This saves you from jumping between different consoles just to check on your hardware status. - Audit security faster. Use list_certificates and get_certificate_details to spot expiring TLS certs before they cause downtime. This helps you keep your security posture updated without manual tracking. - Secure your access. Use list_access_policies to review ZeroTrust rules and RBAC configurations without manual lookups. This makes it much easier to ensure that only the right people have the right permissions. - Verify identity instantly. Use introspect_token to check if an OAuth token is still valid and what scopes it holds. This is a huge time saver for security teams who need to verify credentials on the fly. - Control infrastructure on demand. Use control_vm to start, stop, or restart machines using simple natural language commands. This lets you manage your VM lifecycles without having to navigate complex menus. - Monitor active users. Use list_active_sessions to see who is currently in your system and what permissions they are using. This provides real-time visibility into your identity landscape. ## How It Works The bottom line is you get a single conversational interface for your entire virtualization and security stack. 1. Register an OAuth 2.0 application in your PiLAB SSO admin console. 2. Enter your Client ID and Client Secret in your AI client. 3. Authorize the connection and start managing your infrastructure. ## Frequently Asked Questions **How do I connect my PiLAB account?** After subscribing, the setup wizard will guide you through 3 simple steps: 1) Enter your PiLAB Instance Base URL. 2) Enter the Client ID and Client Secret from your PiLAB SSO (3SO) application. 3) Click the **Connect with PiLAB** button — a popup will open where you approve access via the Shadow SSO authorization flow. That's it! No manual token exchange or curl commands required. **Where do I find the Redirect URI for my PiLAB SSO application?** When registering your application in the PiLAB SSO admin console, set the **Redirect URI** to: `https://api.vinkius.com/marketplace/oauth/callback`. This is the platform's secure callback endpoint that completes the OAuth authorization automatically. **How do I get my Client ID and Client Secret?** Sign in to your PiLAB SSO admin console at `https://sso.pilab.hu/primary/` and navigate to **Client Management**. Click **New Application**, give it a name, and set the **Redirect URI** to `https://api.vinkius.com/marketplace/oauth/callback`. Save the app and copy the **Client ID** and **Client Secret** (the secret is shown only once — copy it immediately). **Can my AI control virtual machines on PiVirt?** Yes! Use `list_virtual_machines` to see all VMs, `get_vm_details` to inspect a specific VM's resources, and `control_vm` with actions like start, stop, restart, pause, or resume. Your AI can manage the full VM lifecycle from the conversation. **How do I check if a TLS certificate is about to expire?** Use the `list_certificates` tool to see all certificates managed by PiTrust with their expiry dates and rotation status. For a specific certificate, use `get_certificate_details` with the certificate ID to see the full chain and rotation policy. **Do I need to refresh my tokens manually?** No. The platform automatically refreshes your access token in the background using the 3SO (Shadow SSO) refresh token flow. You only need to click **Connect with PiLAB** once during setup, and the integration will keep working indefinitely. **What PiLAB products are supported?** This MCP covers three PiLAB products: **PiVirt** (KVM virtualization — hosts, VMs, lifecycle control), **PiTrust** (ZeroTrust — certificates, access policies), and **3SO / Shadow SSO** (OAuth 2.0 — clients, token introspection, active sessions). The PiLAB platform also includes Hackergate (WAF), which is not yet exposed via this MCP.