Yapay Zeka

Getting Started with Model Context Protocol (MCP): Automating Terraform Security with Claude Code

yazar


Artificial Intelligence is becoming increasingly useful in DevOps, but most AI tools still rely only on their training data. This means they can suggest solutions, but they often can’t interact with your real infrastructure or validate whether their suggestions actually work.

In this beginner-friendly guide, I’ll walk through my hands-on experience using Model Context Protocol (MCP) with Claude Code to audit, fix, and verify Terraform security issues automatically. By the end, you’ll understand what MCP is, why it matters, and how it enables AI to safely work with real tools like Terraform and AWS.

What is Model Context Protocol (MCP)?

Model Context Protocol (MCP) is a framework that allows AI models to connect to external tools and data sources in a structured and secure way. Instead of relying only on static knowledge from training, MCP lets AI access:

  • Local development tools (like Terraform or Git)
  • Cloud APIs (such as AWS)
  • Project files and configurations

This means the AI can not only suggest changes but also validate and execute them using real software.

Why MCP is Important for DevOps

In traditional AI-assisted development, you might ask a model how to fix a Terraform issue, and it would generate code based on patterns it learned during training. However, it cannot confirm whether:

  • the syntax is correct,
  • the provider version supports the configuration,
  • or the change actually resolves the problem.

With MCP, the AI can:

  1. Analyze your real Terraform files.
  2. Modify them.
  3. Run Terraform commands to validate the changes.

This creates a much safer and more reliable automation loop for infrastructure work.

My Setup: Connecting Claude Code to Terraform and AWS

To enable this workflow, I configured two MCP servers in my project:

  • Terraform MCP server running in Docker
  • AWS API MCP server using Python’s uvx runtime

These were defined in a .mcp.json file at the root of my project. This file tells Claude Code which tools it is allowed to start and how to communicate with them.

Sensitive information such as AWS credentials was stored separately in .claude/settings.local.json to keep secrets out of version control.

Once everything was configured, I ran the /mcp command in Claude Code and confirmed both servers were successfully connected.

Running a Real DevOps Workflow: Audit → Fix → Verify

To test the setup, I ran a simple but realistic workflow on my Terraform project.

Step 1: Auditing Terraform for Security Issues

I asked Claude Code:

Audit my Terraform files for security issues

The security-auditor agent scanned my Terraform configuration and flagged a problem:
My S3 bucket did not have server-side encryption enabled.

This is a common security issue because unencrypted storage can expose sensitive data if accessed improperly.

Step 2: Automatically Fixing the Issue

Next, I asked Claude:

Add S3 server-side encryption to my Terraform code using AES256

The tf-writer agent updated my Terraform configuration by adding a server-side encryption block to the S3 bucket resource. Behind the scenes, it used the Terraform MCP server to ensure the syntax and resource configuration were valid for my environment.

This step was important because it ensured the AI-generated code was not just theoretically correct but actually compatible with the Terraform version and provider I was using.

Step 3: Verifying the Fix

Finally, I ran the audit again:

Audit my Terraform files for security issues

This time, the encryption issue was no longer reported. The system confirmed that the configuration was now compliant with recommended security practices.

This completed the full audit → fix → verify loop without me manually editing a single Terraform file.

Understanding the Role of AI Agents in This Workflow

One of the most interesting lessons from this exercise was how different AI agents used MCP differently.

The Security Auditor Did Not Need MCP

The security-auditor agent only needed to read Terraform files and apply known security best practices. Since Terraform is a text-based configuration language, the AI could analyze it without running any external tools.

The Terraform Writer Did Need MCP

The tf-writer agent, on the other hand, needed MCP because it had to:

  • generate new Terraform code,
  • validate it using the real Terraform binary,
  • and ensure the configuration would not break the infrastructure deployment.

This clearly showed that reasoning tasks can often be done without tool access, while execution and validation tasks require MCP.

Key Takeaways for Beginners

If you’re new to MCP and AI-assisted DevOps, here are the main lessons from this experience:

  • MCP allows AI to work with live tools instead of relying only on training data.
  • This makes AI-generated changes more reliable and safer to apply in real environments.
  • Separating configuration (.mcp.json) from secrets (settings.local.json) is critical for security.
  • Not every AI task needs tool access — but any task that modifies or validates infrastructure usually does.

Why This Matters for the Future of DevOps

As infrastructure becomes more complex, the ability to automate not just code generation but also validation and compliance checks will be a major advantage. MCP represents a step toward AI systems that can act as true assistants in DevOps pipelines, capable of performing real tasks while still operating within controlled and secure boundaries.

For beginners, learning MCP now provides a strong foundation for understanding how AI will integrate into future cloud and platform engineering workflows.

If you’re exploring Terraform, cloud security, or AI-assisted development, experimenting with MCP is a great way to see how these technologies can work together in practical, real-world scenarios.

Till next time, always stay positive 👍

Shout out to Pravin Mishra, Lead Co-Mentor: Praveen Pandey
🤝 Co-Mentors: Egwu Oko, Tanisha Borana, Ranbir Kaur

P.S. This post is part of the DevOps Micro Internship (DMI) Cohort-2 by Pravin Mishra. You can start your DevOps journey by joining this
Discord community ( https://lnkd.in/e4wTfknn ).

Building Personal AI-Powered Tools with OpenClaw: A Developer’s Journe

yazar

Building Personal AI-Powered Tools with OpenClaw: A Developer’s Journey

As developers, we often find ourselves needing quick utilities—image processors, text converters, API wrappers—but don’t want the overhead of managing servers or complex deployments. What if you could build these tools conversationally with an AI agent that handles the entire stack?

Enter OpenClaw: an open-source AI agent framework that lets you build, deploy, and manage web tools through natural conversation.

What is OpenClaw?

OpenClaw is more than a chatbot—it’s an autonomous AI assistant that can:

  • 🛠️ Write and deploy full-stack applications
  • 🌐 Manage cloud infrastructure (Cloudflare, AWS, etc.)
  • 🔄 Handle CI/CD pipelines
  • 📦 Integrate with external APIs
  • 🧠 Remember context across sessions

Think of it as having a senior developer on call 24/7, except it never gets tired and works at the speed of thought.

Real-World Example: Building an AI Background Remover

Let me show you how I built a production-ready image background removal tool in under an hour using OpenClaw.

The Problem

I needed a simple web app where users could:

  • Upload images
  • Remove backgrounds using AI
  • Download processed results
  • No signup required for basic use
    ### The Solution

Instead of scaffolding a React app, configuring build tools, and wrestling with deployment configs, I just told OpenClaw:

“Build me an image background remover using Remove.bg API, deploy it to Cloudflare Pages”

OpenClaw handled:

  1. Frontend: Clean React UI with drag-and-drop upload
  2. Backend: Cloudflare Pages Functions for API proxying
  3. Authentication: Optional Google OAuth for power users
  4. Storage: Cloudflare KV for user data
  5. Deployment: Automated GitHub → Cloudflare Pages pipeline

Result: https://image-background-remover-baq.pages.dev/

Try it yourself—upload any image and watch the AI strip the background in seconds. No watermarks, no signup walls (for basic use).

How OpenClaw Works

1. Conversational Development

2. Infrastructure as Conversation

No YAML files. No Terraform. Just:

3. Persistent Memory

OpenClaw maintains context in markdown files:

  • MEMORY.md – Long-term project knowledge
  • memory/YYYY-MM-DD.md – Daily logs
  • TOOLS.md – Your specific configurations
    It remembers your API keys, deployment preferences, and coding style across sessions.
    ## Getting Started

Installation


bash
npm install -g openclaw
openclaw gateway start
You: "I want to build a tool that converts images to WebP format"
OpenClaw: "I'll create a web app with drag-and-drop upload, 
          conversion using sharp library, and deploy to Cloudflare Pages.
          Should I use React or vanilla JS?"

Your AI Agent Has No Tests — Here’s How to Fix That in 5 Minutes

yazar

You test your UI. You test your API. You write integration tests, unit tests, E2E tests.

But your AI agent? It picks tools, handles failures, processes PII, makes autonomous decisions — and you’re running it in production with zero tests.

That’s wild. Let’s fix it.

The Problem Nobody Talks About

AI agents are not just LLMs with a nice wrapper. They:

  • Call tools — and sometimes call the wrong one
  • Make decisions — routing, retries, fallbacks
  • Handle errors — or silently swallow them
  • Process sensitive data — PII, credentials, financial info

Existing testing tools don’t cover this. Promptfoo tests prompts. DeepEval tests outputs. But nothing tests agent behavior — the decisions your agent makes between receiving a request and returning a response.

What happens when your tool times out? When the LLM hallucinates a function name? When two agents in a pipeline disagree? You don’t know, because you’ve never tested it.

AgentProbe: Playwright for AI Agents

AgentProbe brings the same test-driven discipline you use for web apps to AI agents. Define tests in YAML. Run them in CI. Get deterministic results.

Here’s what a test case looks like: 

name: weather-tool-selection
description: Agent should pick the weather tool for forecast queries

steps:
  - send:
      message: "What's the weather in Tokyo tomorrow?"
    assert:
      - tool_called: get_weather
      - tool_args:
          location: "Tokyo"
      - response_contains: "forecast"
      - no_pii_leaked: true

That’s it. No SDK to learn, no test framework to fight. Write YAML, run tests, ship with confidence.

What Makes AgentProbe Different

Chaos Testing — Inject tool failures, slow responses, malformed outputs. See how your agent handles the real world, not just the happy path. 

chaos:
  - tool: get_weather
    failure: timeout
    after: 2 calls

Contract Testing — Verify that your agent’s tool calls match the expected schema. Catch breaking changes before they hit production.

Multi-Agent Testing — Test pipelines where multiple agents collaborate. Assert on handoffs, message passing, and coordination failures.

Record & Replay — Record a live agent session, then replay it as a regression test. No mocking required.

Battle-Tested

AgentProbe isn’t a weekend project. The framework runs 2,907 passing tests against itself. We test the testing framework — because we actually believe in testing.

Get Started in 5 Minutes

npm install @neuzhou/agentprobe

Create a test file agent.test.yaml: 

name: basic-agent-test
agent:
  entrypoint: ./my-agent

tests:
  - name: tool-selection
    send: "Search for recent news about AI"
    assert:
      - tool_called: web_search
      - response_not_empty: true

  - name: error-handling
    send: "Search for news"
    chaos:
      - tool: web_search
        failure: error
    assert:
      - graceful_fallback: true
      - no_raw_error_in_response: true

Run it: 

npx agentprobe run agent.test.yaml

Done. Your agent now has tests.

Why This Matters

Every month, another story drops about an AI agent going rogue in production — leaking data, calling wrong APIs, running up bills on infinite retry loops. The fix isn’t better prompts. It’s tests.

You wouldn’t deploy a web app without tests. Stop deploying agents without them.

⭐ GitHub: NeuZhou/agentprobe

MIT Licensed. PRs welcome.

8 Free Web Tools I Built — No Ads, No Signup, No Tracking

yazar

Over the past few weeks I’ve been building small, free web tools — the kind of thing I always wished existed without the signup wall, the ads, or the tracking.

They’re all vanilla HTML/CSS/JS. No frameworks, no accounts, no data collection. Everything runs in your browser.

Here’s the full collection:

The Tools

Word Counter — Paste text, get word count, character count, sentence count, and estimated reading time.

JSON Formatter — Paste JSON, get it pretty-printed with syntax highlighting. Shows you exactly where the error is if it’s invalid.

Base64 Encoder/Decoder — Encode text, decode strings, handle files and JWTs. Supports URL-safe mode.

QR Code Generator — Paste any text or URL, download the QR code as PNG. No watermarks.

Unit Converter — Length, weight, temperature, speed, area, volume. Instant conversion.

Reaction Time Test — Test your reflexes. Average is 250ms. Can you break 200? Challenge your friends with a shareable link.

Typing Speed Test — How fast can you type? Get your WPM score and challenge friends to beat it.

Color Personality Quiz — 5 quick questions to find out your personality color. Surprisingly addictive.

Why?

Every time I needed a QR code or wanted to format some JSON, I’d land on a site that wanted my email or was plastered with ads. These tools cost nothing to host (Cloudflare Pages free tier) and nothing to use.

Browse them all: billion-hub.pages.dev

Is There a Microsoft Copilot API? How It Connects with Dynamics 365 and Microsoft 365

yazar

Developers exploring Microsoft’s AI ecosystem often ask a straightforward question:

Is there a Microsoft Copilot API we can directly use?

The short answer is: not exactly.

But the real answer is more interesting.

This post breaks down how Microsoft Copilot actually works under the hood, and how it connects with Dynamics 365 and Microsoft 365 from a developer’s perspective.

⚙️ What Microsoft Copilot Really Is (From a Dev Lens)

Copilot is not a standalone API like typical AI services.

Instead, it’s an AI orchestration layer that sits across Microsoft’s ecosystem and combines:

Context (your business data)
APIs (Microsoft services)
AI models (LLMs via Azure)

Think of it as:

“An intelligent layer that connects your data to AI using Microsoft’s platform.”

There is no single public “Copilot API” you can call like a REST endpoint.

Instead, Copilot is powered by a combination of:

Microsoft Graph API
Azure OpenAI Service
Internal connectors and plugins

So when you interact with Copilot:

Your request is interpreted
Relevant data is fetched via APIs
AI processes it
A contextual response is generated

👉 You don’t integrate with Copilot directly
👉 You integrate into the ecosystem Copilot uses

🏗️ High-Level Architecture Overview

Let’s break it into layers:

1. Data Layer

This is where context comes from:

Emails (Outlook)
Documents (SharePoint, OneDrive)
Business data (Dynamics 365)

2. API Layer

This is the access layer:

Microsoft Graph API
Dynamics 365 APIs
Other service endpoints

3. AI Processing Layer

Handled via:

Azure OpenAI (LLMs)
Prompt orchestration
Context grounding

4. Application Layer

Where users interact:

Copilot in Word, Excel, Teams
Copilot in Dynamics 365 apps
🔗 How Copilot Connects with Dynamics 365

In Dynamics 365, Copilot works with structured business data like:

Customers
Transactions
Sales pipelines
Example:

A user asks:

“Summarize this customer’s current status”

Behind the scenes:

Data is fetched from D365
Context is passed to the AI model
Copilot generates a summary

This enables:

Automated insights
Email drafting
Forecast suggestions

👉 Key idea: Copilot is grounded in your CRM/ERP data

📊 How Copilot Connects with Microsoft 365

In Microsoft 365, Copilot works with unstructured and communication data:

Emails (Outlook)
Meetings (Teams)
Documents (Word, Excel)
Examples:
Drafting emails in Outlook
Summarizing Teams meetings
Analyzing spreadsheets in Excel

All powered through:
👉 Microsoft Graph + AI + user context

🔧 Can Developers Build on This?

Yes. But not by calling “Copilot API”.

Instead, you build using:

  1. Microsoft Graph API
    Access user and organizational data
  2. Azure OpenAI Service
    Build custom AI logic
  3. Plugins / Extensions
    Extend Copilot capabilities
    Add domain-specific functionality

User asks:

“Generate a follow-up email based on last meeting”

Flow:

Input captured
Graph API retrieves meeting data
Azure OpenAI processes context
Copilot generates response
⚠️ Key Considerations for Developers

When working in this ecosystem:

Data access matters more than prompts
Permissions & security are critical
Context quality determines output quality
Integration complexity increases with scale
💡 Where This Gets Interesting (Real-World Extension)

In enterprise scenarios, generic AI is not enough.

The real value comes from:

Connecting domain-specific data
Extending workflows
Customizing business logic

For example, integrating industry-specific systems into Dynamics 365 can significantly improve how Copilot understands and responds to business context.

🚀 Final Thoughts

Microsoft Copilot is not just an AI feature.
It’s an architecture built on APIs, data, and AI working together.

If you’re a developer:

Don’t look for a single API
Learn the ecosystem
Build where the data lives

Because that’s where Copilot gets its power.