Orchardcore AI MCP Resources

Orchard Core MCP FTP and SFTP Resources

Configure file-transfer MCP resources

You are an Orchard Core expert. Configure remote file content as MCP resources using the CrestApps FTP/FTPS and SFTP modules. Use the built-in source registrations, connection metadata, deployment-safe credential handling, and URI patterns.

Guidelines

• Enable CrestApps.OrchardCore.AI.Mcp.Resources.Ftp for FTP and FTPS resources.
• Enable CrestApps.OrchardCore.AI.Mcp.Resources.Sftp for SSH File Transfer Protocol resources.
• Both exact feature IDs depend on the MCP server feature McpPermissions.Feature.Server; enable the MCP server before configuring resources.
• The FTP module registers the source through AddCoreAIFtpMcpResources; the SFTP module uses AddCoreAISftpMcpResources.
• Both sources support one URI variable named path, which is the remote file path.
• Configure resources through Artificial Intelligence → MCP Resources or the McpResource recipe step.
• The modules expose remote file content as resources. They do not provide arbitrary command execution on remote hosts.
• Install the selected package or packages in the web or startup project.
• Save credentials only in protected resource metadata, use deployment-safe secrets for imports, and do not commit private keys or passwords.

Protocol comparison

FTP/FTPS uses FluentFTP. SFTP uses SSH.NET. SFTP is SSH-based and is not FTP with a different port; choose the module matching the server protocol.

Enable both resource types

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "CrestApps.OrchardCore.AI.Mcp.Server",
        "CrestApps.OrchardCore.AI.Mcp.Resources.Ftp",
        "CrestApps.OrchardCore.AI.Mcp.Resources.Sftp"
      ],
      "disable": []
    }
  ]
}

CrestApps.OrchardCore.AI.Mcp.Server is the server dependency declared by both resource feature manifests. The two resource feature IDs above are also their exact manifest IDs.

FTP and FTPS resources

The FTP source is displayed as FTP/FTPS and supports ftp:// resource URIs. FtpConnectionMetadata contains:

Prefer explicit or implicit FTPS over plaintext FTP. Set ValidateAnyCertificate to false in production unless there is a deliberately managed certificate-validation exception.

SFTP resources

The SFTP source is displayed as SFTP and supports sftp:// resource URIs. SftpConnectionMetadata contains:

Prefer a restricted, passphrase-protected private key over password authentication when the remote server supports it. Grant the remote identity read access only to approved resource paths.

Create an FTP resource recipe

{
  "steps": [
    {
      "name": "McpResource",
      "Resources": [
        {
          "Source": "ftp",
          "DisplayText": "Remote configuration",
          "Resource": {
            "Uri": "ftp://resource-id/config/settings.json",
            "Name": "remote-configuration",
            "Description": "Approved remote configuration file",
            "MimeType": "application/json"
          },
          "Properties": {
            "FtpConnectionMetadata": {
              "Host": "ftp.example.com",
              "Port": 21,
              "Username": "resource-reader",
              "Password": "",
              "EncryptionMode": "Explicit",
              "DataConnectionType": "AutoPassive",
              "ValidateAnyCertificate": false
            }
          }
        }
      ]
    }
  ]
}

Set the password after import through a protected operational configuration path. The resource URI item ID identifies the Orchard Core MCP resource; the path portion identifies the remote file.

Create an SFTP resource recipe

{
  "steps": [
    {
      "name": "McpResource",
      "Resources": [
        {
          "Source": "sftp",
          "DisplayText": "Remote application log",
          "Resource": {
            "Uri": "sftp://resource-id/var/log/app.log",
            "Name": "remote-application-log",
            "Description": "Approved application log file",
            "MimeType": "text/plain"
          },
          "Properties": {
            "SftpConnectionMetadata": {
              "Host": "sftp.example.com",
              "Port": 22,
              "Username": "resource-reader",
              "Password": "",
              "PrivateKey": "",
              "Passphrase": ""
            }
          }
        }
      ]
    }
  ]
}

Populate one supported authentication method securely after deployment. Do not include private key material, passphrases, or passwords in recipes.

Registration and export behavior

Each module adds an editor display driver for McpResource and an IMcpResourceHandler:

The platform protects credentials at rest through Data Protection. Export clearing is defense in depth, not a substitute for secret-management procedures. Imported resources need credentials re-entered or injected through an approved secure channel.

Resource flow

1. An administrator creates an MCP resource with source ftp or sftp.
2. The selected module provides the source definition and connection editor.
3. An MCP client resolves a resource URI and supplies its path variable.
4. FluentFTP or SSH.NET authenticates to the configured server and reads file content.
5. The resource response carries detected MIME type based on file extension.

Keep resource names, descriptions, and allowed remote paths narrowly focused. An MCP resource may expose content to AI clients, so it must not point at credentials, unfiltered logs, or tenant data outside the intended authorization boundary.

Troubleshooting

Security checklist

• Prefer SFTP or FTPS over plaintext FTP.
• Use least-privilege remote accounts restricted to explicit read-only directories.
• Use host key and certificate validation in production.
• Keep passwords, private keys, passphrases, and proxy credentials out of recipes, logs, and source control.
• Limit MCP resource access through Orchard Core permissions and validate the data classification of every exposed path.