---
- name: "🩺 List the MCP tools with the minted bearer"
ansible.builtin.shell:
cmd: | # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ MOODLE_MCP_LOCAL_CID | quote }} \
{{ lookup('timeout', 30) | curl(5, 0) }} -f \
-X POST \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H @- \
--data-binary {{ MOODLE_MCP_TOOLS_LIST_PAYLOAD | to_json | quote }} \
{{ MOODLE_MCP_URL | quote }}
stdin: "Authorization: Bearer {{ moodle_mcp_token }}"
register: moodle_mcp_tools_probe
changed_when: false
retries: 30
delay: 2
until: moodle_mcp_tools_probe.rc == 0 and '"tools"' in moodle_mcp_tools_probe.stdout
delegate_to: "{{ MOODLE_MCP_HOST_NODE }}"
run_once: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
- name: "🛑 Refuse an MCP surface that exposes no tool"
ansible.builtin.assert:
that:
- (moodle_mcp_tools_probe.stdout | from_json).result.tools | length > 0
fail_msg: >-
{{ MOODLE_MCP_URL }} answered the bearer but listed no tool, so every MCP
client would connect to an empty surface.
