# Sapcc Baremetal

> Bare metal node operations via Ironic. Triggers: baremetal, bare metal, ironic, node, provision state, hardware, physical server. NOT for: virtual servers (use sapcc-compute/Nova).

- Skill: `notque/sapcc-baremetal` (Agent Skill)
- Install (CLI): `npx skillmds@latest add notque/sapcc-baremetal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/notque/sapcc-baremetal/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: notque (https://skillmd.com/u/notque)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/notque/sapcc-baremetal

---


# SAP CC Bare Metal (Ironic)

Inspect baremetal nodes: list nodes, check provision/power states, understand maintenance status and driver configuration.

## MCP Tools

### Read Tools

| Tool | Purpose | Key Parameters |
|------|---------|----------------|
| `ironic_list_nodes` | List baremetal nodes | `provision_state`, `maintenance` (true/false), `driver`, `resource_class`, `instance_uuid`, `fault`, `owner` |
| `ironic_get_node` | Full node detail (sensitive fields excluded) | `node_id` (**required**, UUID or name) |
| `ironic_list_node_ports` | List NICs for a node | `node_id` (**required**) |
| `ironic_list_allocations` | List node allocations | `node_id`, `resource_class` |
| `ironic_list_portgroups` | List port groups (bonded NICs) | `node_id` |

### Admin Tools (requires MCP_ADMIN_TOOLS=true)

| Tool | Purpose | Key Parameters |
|------|---------|----------------|
| `ironic_list_chassis`† | List baremetal chassis | (none) |
| `ironic_node_power_state`†* | Change node power state | `node_id` (**required**), `target` (**required**: `power on`/`power off`/`rebooting`), `confirmed` |

### Security: Credential Isolation

- **DriverInfo excluded**: Node detail NEVER exposes BMC credentials (IPMI passwords, Redfish creds, iDRAC secrets)
- **DriverInternalInfo excluded**: Internal provisioning state with potential secrets omitted
- **InstanceInfo excluded**: Nova instance provisioning details omitted
- **Properties excluded**: Hardware properties that may contain sensitive deployment info

### Guardrails

- **Path segment validation**: `node_id` accepts both UUID and human-readable names safely
- **Power state allowlist**: Only `power on`, `power off`, `rebooting` accepted as targets
- **Confirmation required**: Power state changes return preview unless `confirmed=true`
- **Destructive action gate**: The `destructive-action-gate` hook blocks `ironic_node_power_state` until user approves

## Gotchas

1. **Sensitive fields are redacted.** The MCP tool intentionally omits `driver_info`, `driver_internal_info`, `instance_info`, and `properties` from `ironic_get_node` responses. These may contain BMC credentials (IPMI passwords, Redfish secrets). Do not tell users these fields are accessible.

2. **maintenance filter is a string "true", not a boolean.** Pass `maintenance="true"` as a string value. There is no `"false"` filter — omit the parameter to see all nodes regardless of maintenance status.

3. **provision_state vs power_state.** `provision_state` is the lifecycle state (available, deploying, active, error). `power_state` is the physical state (power on, power off). A node can be `active` provision but `power off` if manually shut down.

4. **"available" means ready for deployment.** In Ironic, `available` does not mean "has capacity" — it means the node is enrolled, inspected, cleaned, and ready to receive a workload. `active` means already deployed.

5. **instance_uuid links to Nova.** When a node is in `active` state, `instance_uuid` shows which Nova server is running on it. Use this to cross-reference with `nova_get_server`.

6. **node_id accepts UUID or name.** Unlike most OpenStack tools that require UUIDs, `ironic_get_node` accepts either the node UUID or its human-readable name.

7. **last_error contains deployment failure details.** When `provision_state=error`, the `last_error` field in the get response describes what went wrong (e.g., timeout during deploy, cleaning failure, network boot failure).

## Common Workflows

### List Nodes Available for Deployment

1. `ironic_list_nodes` with `provision_state=available` — show nodes ready for workloads.
2. Filter by `resource_class` if you need a specific hardware profile.
3. Verify `maintenance=false` in results — maintenance nodes cannot be deployed to.

### Diagnose a Node in Error State

1. `ironic_list_nodes` with `provision_state=error` — find all error nodes.
2. `ironic_get_node` with `node_id=<uuid>` — check `last_error` for the failure reason.
3. Check `maintenance` and `maintenance_reason` — the node may have been put in maintenance due to the error.
4. Check `fault` field for categorized fault information.

### Find the Physical Node Running a VM

1. Start with the Nova server UUID.
2. `ironic_list_nodes` — scan results for `instance_uuid` matching your server UUID.
3. Or if you know the node: `ironic_get_node` and check `instance_uuid`.

## Cross-Service References

| Need | Service | Tool |
|------|---------|------|
| VM running on this node | Nova | `nova_get_server(<instance_uuid>)` |
| Who modified node state | Hermes | `hermes_list_events(target_type=node)` |
| Compute quota (includes baremetal flavors) | Limes | `limes_get_project_quota(service=compute)` |
| Network ports attached to node | Neutron | `neutron_list_ports` |