Routed Logic Blog

MCP Server Tooling

Wed, 13 Aug 2025 00:00:00 GMT

I've recently decided to buy into the Model Context Protocol (MCP) server hype and started utilizing some MCP tools.

Here's my take on the quickest way to get started with MCP tooling, as well as my thoughts on MCP more generally as I went through the process of setting things up and actually using them.

What is MCP and why should you care?

The Model Context Protocol (MCP) is a standardized way for AI tools to interact with external services, databases, and APIs. Think of it as a universal translator that allows your AI assistant to work with your local development environment, databases, and tools in a secure, controlled manner (in theory).

The concept seems to be that you can provide the context necessary to do things without having to explain it every time as part of the prompt or in other ways that may produce highly variable results.

It was a little surprising to me to find that, under the hood and contrary to some of the hype, there's no Matrix-esque knowledge injection going on; at this point, it's mostly just pretty basic keyword-based cues, guidance on how to run commands, use templates, and talk to API endpoints.

That, however, does appear to be a good thing, as it means using tools in this way can be understood by us mere mortals and that they can be used to get consistently reliable results—something that LLMs are not great at and still struggle with.

MCP is documented at modelcontextprotocol.io.

Running MCP Servers with Docker Desktop

The easiest way to get started with MCP, for most people, is most likely going to be via Docker Desktop's new AI-focused features, in particular via the MCP Toolkit.

Docker's own documentation sums it up nicely: "The Docker MCP Toolkit is a gateway that lets you set up, manage, and run containerized MCP servers and connect them to AI agents. It removes friction from tool usage by offering secure defaults, one-click setup, and support for a growing ecosystem of LLM-based clients. It is the fastest way from MCP tool discovery to local execution."

Not surprisingly, Docker Desktop implements MCP Toolkit using containers, which seems to be a common way of providing and deploying MCP tooling. Depending on your choice of MCP tools, Docker Desktop will run a single container that handles multiple tool calls, or multiple containers proxied via a central MCP server container.

If you're not using Docker Desktop, you can find it here.

Once you've got Docker Desktop running, find your way into the Docker Desktop Settings and enable the following beta features, at a minimum:

You should then get an "MCP Toolkit (BETA)" option in the menu to the left.

Clicking on that will show you that there are no MCP servers installed yet,

Note that you now have links with bracketed numbers next to them, e.g., the "Servers," "Catalog," "Clients," and "OAuth" links.

Clicking on these will show you:

Servers - a list of installed MCP servers.
Catalog - a list of available MCP servers from the Docker-managed catalog.
Clients - a list of local MCP clients that Docker can support, e.g., Cursor, Claude Code, Gemini CLI, etc.
OAuth - if configured, information about a grant that the MCP Toolkit will use to access your GitHub account.

Before doing anything further, you should configure your clients by clicking on "Clients".

Clients

Configuration

If Docker Desktop detects that a supported client is already installed, you'll be offered an immediate "Connect" button.

For instance, I'm using Cursor and the Gemini CLI, hence I have "Connect" available, while the clients I don't have show "Download" buttons.

Most of the time, if the tool is installed, you just click "Connect" and then restart the client if it's already running. That should be all you have to do.

With Cursor or any other VS Code-based client, you can connect only to specific projects if desired; however, by default, the MCP server will be available to all projects.

For as-yet undetected or unsupported clients, you can still very quickly get them up and running using the Docker Desktop instructions that you'll find at the bottom of the Clients page,

For example, to get Warp to use the Docker Desktop MCP server, I configured it as follows:

{
  "Docker Desktop": {
    "command": "docker",
    "args": ["mcp", "gateway", "run"],
    "env": {},
    "working_directory": null
  }
}

Verifying Connection

You can view the logs within Warp to confirm it's all up and running, as well as see a list of MCP tools that are advertised by the MCP server. In this case, I've already added the Git reference server, and you can now see the list of tools available.

This was simply after clicking "Add MCP Server" in Docker Desktop.

Gemini CLI can tell you that it is indeed connected to an MCP server but not much else with the mcp list command on the CLI.

It will also tell you if it is connected to an MCP server with no tools when you first open the CLI (this was prior to installing the Git MCP tools). Note, though, that it considers many of its built-in tooling capabilities to be MCP server tools if asked about what it has.

But to really get any useful info you will want to actually run it and use the Ctrl+T hotkey combo, or /mcp list or /mcp desc commands, to get more info. E.g., after installing the Git MCP tools:

Discovering Available Tools

For clients that don't have some kind of built-in MCP tool listing feature, you can also prompt your clients to tell you what they can currently see and can do. This is also really important so that you're aware of what built-in capabilities currently exist, as they may already have a number of tools available that significantly overlap with the capabilities you already have or are considering adding using MCP.

Once you've added some tools you'll get a better response:

Though it will be formatted differently each time, as LLMs tend to do.

Be aware that some of your clients' features may not be able to use MCP tools. For instance, with Cursor, in Ask mode, it will know nothing about MCP tools, only its built-in tools.

But if you put Cursor back in Agent mode it does know about MCP server tools but won't bother to mention its built-in tools.

While considering what MCP servers to install, you should probably ask the LLM more generically what tools are available to it, rather than asking specifically what MCP tools are available, as the LLM may consider some of its built-in tooling to be something other than an MCP tool.

Cursor, for instance, with only the Git Reference MCP server installed, will respond as below in Ask mode,

And like this in Agent mode,

MCP Server Security and Trust

What tools should you actually install?

The most important thing to be aware of here is that a lot of what's in the catalog is going to, originally, be from some random developer on the internet/GitHub, much like myself.

And those tools will be mixed in with some official tooling from the MCP reference repository on GitHub and official servers from vendors such as MongoDB and Elastic.

Docker isn't letting Docker Desktop directly pull random GitHub repo content and build container images from it. They do have documentation and some kind of review process, though I have yet to find a detailed description for what they do beyond the contribution guide.

Be aware that, as stated in the specification (https://modelcontextprotocol.io/specification/2025-06-18/server/prompts),

"The Model Context Protocol (MCP) provides a standardized way for servers to expose prompt templates to clients. Prompts allow servers to provide structured messages and instructions for interacting with language models. Clients can discover available prompts, retrieve their contents, and provide arguments to customize them."

and,

"Implementations MUST carefully validate all prompt inputs and outputs to prevent injection attacks or unauthorized access to resources."

So it should be clear to you that simply installing just any interesting-looking MCP toolkit from a random developer on the internet, even when proxied to you via Docker Hub, is not a good idea unless you have thoroughly vetted the developer(s) and the source code and you have a plan to monitor and continually track and vet that code for changes.

MCP Servers & Tools

I still don't fully understand how MCP server code updates work with Docker Desktop's MCP Catalog, and how things like prompt templates really work, so in the meantime I'm only going to use MCP servers I'm comfortable trusting.

What does appear trustworthy to me are:

MCP Reference tools, e.g., as from https://github.com/modelcontextprotocol/servers, though I'm only seeing utility in the Git tool at present.
The official vendor MCP tools, e.g., Docker, Docker Hub, MongoDB, Elastic, Redis, etc.

But that's it. I won't even consider installing anything else unless I've thoroughly vetted the developer and the code and I know it's not going to change because their GitHub account was compromised and someone pushed a new commit or release.

Right now the reference Git server appears to be a useful addition to help Cursor/Gemini/Warp interact with Git repos locally, as well as the GitHub and Docker Hub servers.

I'm also interested in using the official MongoDB, Redis, and Elastic MCP servers in order to provide my MCP-based access to stored data with minimal prompt engineering.

If you must use community-contributed MCP servers, here's what I'd look for:

Developer reputation - Check their GitHub profile, contributions, and community standing
Code review - Examine the source code for security issues
Update frequency - Regular updates suggest active maintenance
Community feedback - Look for issues, discussions, and reviews
Scope limitation - Prefer servers with minimal required permissions, e.g., path restrictions for file system interactions, API read endpoint access with no write endpoint access.

Also be aware that quite a few of the MCP tools listed in the catalog are still using the official MCP logo while not actually being reference tools from the MCP project.

While this may not be an intentional attempt to make their MCP server code seem more legitimate, it's from a fairly random GitHub account, and you will have little idea what the code is doing in the background. Or at least, even less than you already know about what the LLM is doing...

Observed Issues

MCP Server/Tool Visibility

Most of the clients will be immediately aware of the Docker Desktop MCP gateway becoming unavailable, e.g., if you fully exit Docker Desktop.

However, none of them will be immediately aware if you add new tools or remove existing tools. You will need to restart the client, at a minimum.

With Cursor, I've also noticed that, at times, I've had to disable the Docker Desktop MCP server definition and then re-enable it for it to refresh the list of available tools. It appears to cache what's available and assumes that's still the case for extended periods, even across restarts.

Tool Confusion and Overlap

As above, your clients probably already have a lot of built-in tools and capabilities that overlap significantly with the reference MCP servers, so you probably won't need to install all or possibly even any of them.

I've also experienced confusion from the LLM when multiple overlapping tool capabilities are available.

For instance, when some of the built-in, file-operation-related tools are skipped in favor of the reference MCP server tool definition, which I initially configured with a path-based restriction to /opt/data.

This resulted in Cursor sometimes being able to edit files without issue, but at other times deciding that it didn't have access to what I'd told it to do, so it started creating files under /opt/data. Yet at other times, to access paths it believed it couldn't reach, it tried SSHing into localhost/127.0.0.1.

My pubkey-based auth system prompted me to allow this, otherwise I may not have noticed what was happening.

The point is... don't install more than you need and be very aware of what your clients can already do. If you experience similar behavior, check your MCP server configurations for path restrictions and ensure they don't conflict with your intended workflow.

A quick-and-dirty summary I've created for myself is below. This includes me starting to ask each client what it knows how to do, which is something you should do too.

Most tools and models—except Ask Gordon—seem to understand that, even without a built-in capability, they can use a CLI command to achieve something similar.

For example:

Tools like Warp will try to use the curl or wget CLI command to retrieve a URL and may also try to pipe the page through grep or something else in order to convert some of it to Markdown if instructed to provide Markdown output.

I consider being able to use curl or wget to be an equivalent fetch-URL capability, but not a fetch-and-convert-to-Markdown capability, even if it can output some of the titles or similar elements from a page as Markdown.

Please note that this is hardly comprehensive and probably partially inaccurate as I have not fully validated every capability that the clients claim to have.

Built-in Functionality	Cursor (Ask Mode)	Cursor (Agent Mode)	Gemini CLI	Warp	Ask Gordon	MCP Server Option
Sequential Thinking	❓	❓	❓	❓	❌	https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking
Run Shell Commands	❓	❌	✅	✅	✅	No additional capability required?
Parallel Orchestration	❓	✅	❓	❌	❌	TBC
Basic File Operations	✅	✅	✅	✅	✅	No additional capability required?
File Patch	🟡	✅	✅	✅	❌	No additional capability required?
Memory - save/retrieve	🟡	✅	✅	❌	❌	https://github.com/modelcontextprotocol/servers/tree/main/src/memory
Jupyter Notebooks	❓	❓	❓	❓	❌	TBC
Image Analysis	✅	❌	❌	❌	❌	TBC
Fetch URL as Markdown	✅	✅	✅	❌	✅	https://github.com/modelcontextprotocol/servers/tree/main/src/fetch
Web Search	✅	✅	✅	❌	❌	https://github.com/brave/brave-search-mcp-server ?
Diagrams (Mermaid)	❓	✅	❓	❓	❌	TBC
Git (local)	❓	✅	✅	❓	✅	https://github.com/modelcontextprotocol/servers/tree/main/src/git
GitHub	❓	🟡	❌	❌	❌	https://github.com/github/github-mcp-server
Docker CLI	❓	❓	❓	❓	✅	TBC
Docker Model Runner	❌	❌	❌	❌	✅	TBC
Kubernetes	❌	❌	❌	❌	✅	TBC
Docker Builds	❌	❌	❌	❌	✅	TBC
Docker Scout	❌	❌	❌	❌	✅	TBC
Docker Hub	❌	❌	❌	❌	❌	https://github.com/docker/hub-mcp
Redis	❌	❌	❌	❌	❌	https://github.com/redis/mcp-redis
MongoDB	❌	❌	❌	❌	❌	https://github.com/mongodb-js/mongodb-mcp-server
Elasticsearch	❌	❌	❌	❌	❌	https://github.com/elastic/mcp-server-elasticsearch

✅ Supported · ❌ Not supported · 🟡 Partial support · ❓ Unclear capability

Reference sources:

Summary

MCP reminds me a little of REST API documentation and specification formats like OpenAPI, Swagger, etc. It extends to other "things" that software tools can interact with, such as CLI commands and code snippets.

Overall it feels like kludgy glue that has to be put in place to help LLMs work out how to do things that you're asking them to do, even though, in theory, they should really be able to leverage their existing "knowledge" (as derived from their training data) and just... be able to work stuff out.

But then again, humans are supposed to be able to just work stuff out, and a hell of a lot of us can't do so; and so we simply resort to getting another human to tell us what to do...

creating-custom-mmdb-files

Sat, 15 Feb 2025 00:00:00 GMT

Prompt: How can I create dummy MaxMind GeoLite2 .mmdb files that will respond to ALL IP lookups with the same information? For example these these would be .mmdb files that will have entries for 0.0.0.0/0 and ::/0 that will cover all possible IP lookups?

Gemini 2.0 Flash will actually provide a moderately useful response, albeit one based on the legacy MaxMind perl based code available from MaxMind-DB-Writer-perl. It also correctly recommends using the mmdbinspect tool to test the .mmdb files that have been produced.

ChatGPT (free not Plus) also provides a fairly useful response, albeit one based on python code. It doesn't seem to know about mmdbinspect and does produced .mmdb file testing using python code instead.

Claude.ai provides something similar to ChatGPT's solution.

The Better Solution

However, unsurprisingly, while all of these solutions appear valid, they're based on outdated information and are incomplete if you want detailed GeoIP lookup data to be returned. To really get the solution you want, even if you were to stick with their perl/python code (assuming it actually works out of the paste...), will require a deep dive on what fields can/should exist.

MaxMind also replaced their Perl code with Go quite a few years ago, completely deprecating the Perl code at least 2 years ago. The replacement is mmdbwriter.

However this new Go package is simply something that can work with .mmdb files, and while there are some example commands included they're not immediately usable.

A more useful repo exists in the form of MaxMind-DB. This repo includes a heap of raw test data and test cases so it has everything we need to work out how to create some raw GeoLite2 source data as .json files, and a tool to convert those .json files to .mmdb files.

The included write-test-data command can, with some minor modifications, be used to accept 0.0.0.0/0 and ::/0 to cover all possible IPv4 and IPv6 lookups.

Modifications

Having cloned MaxMind-DB I've only had to make one modification to the current content.

I've modified pkg/writer/geoip2.go and inserted IncludeReservedNetworks: true as an argument within mmdbwriter.Options as that's provided to the mmdbwriter constructor mmdbwriter.New().

I found this was necessary to allow acceptance of 0.0.0.0/0 and ::/0.

Without this additional option the produced files would contain no entries and the fact that these entries were dropped will not be reported at all. You'll just have .mmdb files that won't provide anything for any IP.

This appears to be because the code in mmdbwriter will filter any IP or IP network that is in or overlaps within various reserved blocks, e.g. refer to mmdbwriter/blob/main/reserved.go for what this includes.

user@box MaxMind-DB % git diff pkg/writer/geoip2.go
diff --git a/pkg/writer/geoip2.go b/pkg/writer/geoip2.go
index a95c0af..e8e1b8d 100644
--- a/pkg/writer/geoip2.go
+++ b/pkg/writer/geoip2.go
@@ -50,6 +50,7 @@ func (w *Writer) WriteGeoIP2TestDB() error {
                                DatabaseType:        dbType,
                                Description:         description,
                                DisableIPv4Aliasing: false,
+                               IncludeReservedNetworks: true,
                                IPVersion:           6,
                                Languages:           languages,
                                RecordSize:          28,
user@box %

You'll need to build the write-test-data command similar to the below, and understand how to use the arguments it accepts.

user@box MaxMind-DB % cd cmd/write-test-data
user@box write-test-data % ls -alF
total 8
drwxr-xr-x  3 user  staff    96 15 Feb 11:48 ./
drwxr-xr-x  3 user  staff    96 15 Feb 09:17 ../
-rw-r--r--  1 user  staff  1569 15 Feb 11:46 main.go
user@box write-test-data % go build
user@box write-test-data % ls -alF
total 7568
drwxr-xr-x  4 user  staff      128 15 Feb 11:48 ./
drwxr-xr-x  3 user  staff       96 15 Feb 09:17 ../
-rw-r--r--  1 user  staff     1569 15 Feb 11:46 main.go
-rwxr-xr-x  1 user  staff  3870210 15 Feb 11:48 write-test-data*
user@box write-test-data % ./write-test-data -h
Usage of ./write-test-data:
  -source string
        Source data directory
  -target string
        Destination directory for the generated mmdb files
user@box write-test-data %

You can now clone the default source-data files in order to modify them. You could of course also modify these in place if you'd prefer.

user@box MaxMind-DB % cp -Rpv source-data source-data-test
source-data -> source-data-test
source-data/GeoIP2-Precision-Enterprise-Test.json -> source-data-test/GeoIP2-Precision-Enterprise-Test.json
source-data/GeoIP2-Enterprise-Test.json -> source-data-test/GeoIP2-Enterprise-Test.json
source-data/GeoIP2-Precision-Enterprise-Sandbox-Test.json -> source-data-test/GeoIP2-Precision-Enterprise-Sandbox-Test.json
source-data/GeoIP2-Country-Test.json -> source-data-test/GeoIP2-Country-Test.json
source-data/GeoIP2-Domain-Test.json -> source-data-test/GeoIP2-Domain-Test.json
source-data/GeoLite2-City-Test.json -> source-data-test/GeoLite2-City-Test.json
source-data/GeoIP2-Anonymous-IP-Test.json -> source-data-test/GeoIP2-Anonymous-IP-Test.json
source-data/GeoIP2-Static-IP-Score-Test.json -> source-data-test/GeoIP2-Static-IP-Score-Test.json
source-data/GeoIP2-Connection-Type-Test.json -> source-data-test/GeoIP2-Connection-Type-Test.json
source-data/GeoIP2-IP-Risk-Test.json -> source-data-test/GeoIP2-IP-Risk-Test.json
source-data/GeoLite2-Country-Test.json -> source-data-test/GeoLite2-Country-Test.json
source-data/GeoIP2-City-Test.json -> source-data-test/GeoIP2-City-Test.json
source-data/GeoIP2-ISP-Test.json -> source-data-test/GeoIP2-ISP-Test.json
source-data/GeoIP2-DensityIncome-Test.json -> source-data-test/GeoIP2-DensityIncome-Test.json
source-data/GeoLite2-ASN-Test.json -> source-data-test/GeoLite2-ASN-Test.json
source-data/GeoIP2-User-Count-Test.json -> source-data-test/GeoIP2-User-Count-Test.json
user@box MaxMind-DB %

If you don't also copy the GeoIP2-*-Test.json files you'll get errors when running the command, you can make further code modifications to pkg/writer/geoip2.go if you don't want to have these generated at all.

Now modify the files as needed.

In my case I just want to modify the GeoLite2 .json files, and I'm going to ensure all ASN's returned are 64496 which is a documentation specific ASN defined by RFC-5398 and that all location data is for Greenwich UK and more specifically the location coordinates are for the Royal Greenwich Observatory. I've picked Greenwich as I couldn't think of a more appropriate real world location. You can, almost certainly, inject your own descriptions and even using 0/0 for lat/long though that would place the IP as in the ocean off the coast of Ghana.

GeoLite2-ASN-Test.json

[
   {
      "0.0.0.0/0" : {
         "autonomous_system_number" : 64496,
         "autonomous_system_organization" : "Documentation ASN"
      }
   },
   {
      "0000:0000:0000:0000:0000:0000:0000:0000/0" : {
         "autonomous_system_number" : 64496,
         "autonomous_system_organization" : "Documentation ASN"
      }
   }
]

GeoLite2-City-Test.json

[
   {
      "0.0.0.0/0" : {
         "city" : {
            "geoname_id" : 2647937,
            "names" : {
               "en" : "Greenwich"
            }
         },
         "continent" : {
            "code" : "EU",
            "geoname_id" : 6255148,
            "names" : {
               "en" : "Europe"
            }
         },
         "country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "location" : {
            "accuracy_radius" : 0,
            "latitude" : 51.47687,
            "longitude" : -0.00041,
            "time_zone" : "Europe/London"
         },
         "registered_country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "subdivisions" : [
            {
               "geoname_id" : 6269131,
               "iso_code" : "ENG",
               "names" : {
                  "en" : "England"
               }
            }
         ]
      }
   },
   {
      "0000:0000:0000:0000:0000:0000:0000:0000/0" : {
         "city" : {
            "geoname_id" : 2647937,
            "names" : {
               "en" : "Greenwich"
            }
         },
         "continent" : {
            "code" : "EU",
            "geoname_id" : 6255148,
            "names" : {
               "en" : "Europe"
            }
         },
         "country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "location" : {
            "accuracy_radius" : 0,
            "latitude" : 51.47687,
            "longitude" : -0.00041,
            "time_zone" : "Europe/London"
         },
         "registered_country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "subdivisions" : [
            {
               "geoname_id" : 6269131,
               "iso_code" : "ENG",
               "names" : {
                  "en" : "England"
               }
            }
         ]
      }
   }
]

GeoLite2-Country-Test.json

[
   {
      "0.0.0.0/0" : {
         "continent" : {
            "code" : "EU",
            "geoname_id" : 6255148,
            "names" : {
               "en" : "Europe"
            }
         },
         "country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "registered_country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         }
      }
   },
   {
      "0000:0000:0000:0000:0000:0000:0000:0000/0" : {
         "continent" : {
            "code" : "EU",
            "geoname_id" : 6255148,
            "names" : {
               "en" : "Europe"
            }
         },
         "country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         },
         "registered_country" : {
            "geoname_id" : 2635167,
            "iso_code" : "GB",
            "names" : {
               "en" : "United Kingdom"
            }
         }
      }
   }
]

Now run write-test-data to build the .mmdb files. Note that the target directory does not need to exist already, write-test-data will create it if it doesn't exist.

user@box MaxMind-DB % ./cmd/write-test-data/write-test-data -source source-data-test -target test-data-test
user@box MaxMind-DB % ls -ld test-data-test/*
-rw-r--r--  1 user  staff   3289 15 Feb 12:07 test-data-test/GeoIP2-Anonymous-IP-Test.mmdb
-rw-r--r--  1 user  staff  21096 15 Feb 12:07 test-data-test/GeoIP2-City-Test.mmdb
-rw-r--r--  1 user  staff   3228 15 Feb 12:07 test-data-test/GeoIP2-Connection-Type-Test.mmdb
-rw-r--r--  1 user  staff  18176 15 Feb 12:07 test-data-test/GeoIP2-Country-Test.mmdb
-rw-r--r--  1 user  staff   1649 15 Feb 12:07 test-data-test/GeoIP2-DensityIncome-Test.mmdb
-rw-r--r--  1 user  staff   5077 15 Feb 12:07 test-data-test/GeoIP2-Domain-Test.mmdb
-rw-r--r--  1 user  staff   8571 15 Feb 12:07 test-data-test/GeoIP2-Enterprise-Test.mmdb
-rw-r--r--  1 user  staff   1651 15 Feb 12:07 test-data-test/GeoIP2-IP-Risk-Test.mmdb
-rw-r--r--  1 user  staff  74019 15 Feb 12:07 test-data-test/GeoIP2-ISP-Test.mmdb
-rw-r--r--  1 user  staff  18675 15 Feb 12:07 test-data-test/GeoIP2-Precision-Enterprise-Test.mmdb
-rw-r--r--  1 user  staff   9938 15 Feb 12:07 test-data-test/GeoIP2-Static-IP-Score-Test.mmdb
-rw-r--r--  1 user  staff   5006 15 Feb 12:07 test-data-test/GeoIP2-User-Count-Test.mmdb
-rw-r--r--  1 user  staff   1352 15 Feb 12:07 test-data-test/GeoLite2-ASN-Test.mmdb
-rw-r--r--  1 user  staff   1551 15 Feb 12:07 test-data-test/GeoLite2-City-Test.mmdb
-rw-r--r--  1 user  staff   1401 15 Feb 12:07 test-data-test/GeoLite2-Country-Test.mmdb
-rw-r--r--  1 user  staff    616 15 Feb 12:07 test-data-test/MaxMind-DB-no-ipv4-search-tree.mmdb
-rw-r--r--  1 user  staff   1334 15 Feb 12:07 test-data-test/MaxMind-DB-string-value-entries.mmdb
-rw-r--r--  1 user  staff   3188 15 Feb 12:07 test-data-test/MaxMind-DB-test-decoder.mmdb
-rw-r--r--  1 user  staff   1285 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv4-24.mmdb
-rw-r--r--  1 user  staff   1448 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv4-28.mmdb
-rw-r--r--  1 user  staff   1611 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv4-32.mmdb
-rw-r--r--  1 user  staff   2794 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv6-24.mmdb
-rw-r--r--  1 user  staff   3209 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv6-28.mmdb
-rw-r--r--  1 user  staff   3624 15 Feb 12:07 test-data-test/MaxMind-DB-test-ipv6-32.mmdb
-rw-r--r--  1 user  staff   2249 15 Feb 12:07 test-data-test/MaxMind-DB-test-metadata-pointers.mmdb
-rw-r--r--  1 user  staff   3048 15 Feb 12:07 test-data-test/MaxMind-DB-test-mixed-24.mmdb
-rw-r--r--  1 user  staff   3492 15 Feb 12:07 test-data-test/MaxMind-DB-test-mixed-28.mmdb
-rw-r--r--  1 user  staff   3936 15 Feb 12:07 test-data-test/MaxMind-DB-test-mixed-32.mmdb
-rw-r--r--  1 user  staff   2589 15 Feb 12:07 test-data-test/MaxMind-DB-test-nested.mmdb
user@box MaxMind-DB %

Test the produced .mmdb files,

GeoLite2-ASN.mmdb

user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-ASN-Test.mmdb 203.0.113.0
[
    {
        "Database": "./test-data-test/GeoLite2-ASN-Test.mmdb",
        "Records": [
            {
                "Network": "203.0.113.0/1",
                "Record": {
                    "autonomous_system_number": 64496,
                    "autonomous_system_organization": "Documentation ASN"
                }
            }
        ],
        "Lookup": "203.0.113.0"
    }
]

user@box MaxMind-DB %
user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-ASN-Test.mmdb 8.8.8.8
[
    {
        "Database": "./test-data-test/GeoLite2-ASN-Test.mmdb",
        "Records": [
            {
                "Network": "8.8.8.8/1",
                "Record": {
                    "autonomous_system_number": 64496,
                    "autonomous_system_organization": "Documentation ASN"
                }
            }
        ],
        "Lookup": "8.8.8.8"
    }
]

user@box MaxMind-DB %

GeoLite2-City.mmdb

user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-City-Test.mmdb 203.0.113.0
[
    {
        "Database": "./test-data-test/GeoLite2-City-Test.mmdb",
        "Records": [
            {
                "Network": "203.0.113.0/1",
                "Record": {
                    "city": {
                        "geoname_id": 2647937,
                        "names": {
                            "en": "Greenwich"
                        }
                    },
                    "continent": {
                        "code": "EU",
                        "geoname_id": 6255148,
                        "names": {
                            "en": "Europe"
                        }
                    },
                    "country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "location": {
                        "accuracy_radius": 0,
                        "latitude": 51.47687,
                        "longitude": -0.00041,
                        "time_zone": "Europe/London"
                    },
                    "registered_country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "subdivisions": [
                        {
                            "geoname_id": 6269131,
                            "iso_code": "ENG",
                            "names": {
                                "en": "England"
                            }
                        }
                    ]
                }
            }
        ],
        "Lookup": "203.0.113.0"
    }
]

user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-City-Test.mmdb 8.8.8.8
[
    {
        "Database": "./test-data-test/GeoLite2-City-Test.mmdb",
        "Records": [
            {
                "Network": "8.8.8.8/1",
                "Record": {
                    "city": {
                        "geoname_id": 2647937,
                        "names": {
                            "en": "Greenwich"
                        }
                    },
                    "continent": {
                        "code": "EU",
                        "geoname_id": 6255148,
                        "names": {
                            "en": "Europe"
                        }
                    },
                    "country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "location": {
                        "accuracy_radius": 0,
                        "latitude": 51.47687,
                        "longitude": -0.00041,
                        "time_zone": "Europe/London"
                    },
                    "registered_country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "subdivisions": [
                        {
                            "geoname_id": 6269131,
                            "iso_code": "ENG",
                            "names": {
                                "en": "England"
                            }
                        }
                    ]
                }
            }
        ],
        "Lookup": "8.8.8.8"
    }
]

user@box MaxMind-DB %

GeoLite2-Country.mmdb

user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-Country-Test.mmdb 203.0.113.0
[
    {
        "Database": "./test-data-test/GeoLite2-Country-Test.mmdb",
        "Records": [
            {
                "Network": "203.0.113.0/1",
                "Record": {
                    "continent": {
                        "code": "EU",
                        "geoname_id": 6255148,
                        "names": {
                            "en": "Europe"
                        }
                    },
                    "country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "registered_country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    }
                }
            }
        ],
        "Lookup": "203.0.113.0"
    }
]

user@box MaxMind-DB % mmdbinspect -db ./test-data-test/GeoLite2-Country-Test.mmdb 8.8.8.8
[
    {
        "Database": "./test-data-test/GeoLite2-Country-Test.mmdb",
        "Records": [
            {
                "Network": "8.8.8.8/1",
                "Record": {
                    "continent": {
                        "code": "EU",
                        "geoname_id": 6255148,
                        "names": {
                            "en": "Europe"
                        }
                    },
                    "country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    },
                    "registered_country": {
                        "geoname_id": 2635167,
                        "iso_code": "GB",
                        "names": {
                            "en": "United Kingdom"
                        }
                    }
                }
            }
        ],
        "Lookup": "8.8.8.8"
    }
]

user@box MaxMind-DB %

Congratulations you now have GeoLite2 database files that will respond to any query against them.

To use these within your elastic-package managed Elastic stack, simply overwrite the files in the appropriate profile under ~/.elastic-package.

user@box MaxMind-DB % find ~/.elastic-package -name \*.mmdb
/Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-City.mmdb
/Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-Country.mmdb
/Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-ASN.mmdb
user@box MaxMind-DB %
user@box MaxMind-DB % for i in ASN City Country ; do cp -v test-data-test/GeoLite2-${i}-Test.mmdb ~/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-${i}.mmdb ; done
test-data-test/GeoLite2-ASN-Test.mmdb -> /Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-ASN.mmdb
test-data-test/GeoLite2-City-Test.mmdb -> /Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-City.mmdb
test-data-test/GeoLite2-Country-Test.mmdb -> /Users/user/.elastic-package/profiles/default/stack/ingest-geoip/GeoLite2-Country.mmdb
user@box MaxMind-DB %

After doing this, and a restart of the elastic-package managed stack isn't really necessary, you should see your dummy GeoIP data appearing on test events, e.g.

user@box beelzebub % elastic-package test pipeline
2025/02/15 11:02:30  INFO New version is available - v0.109.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.109.1
Run pipeline tests for the package

--- Test results for package: beelzebub - START ---
FAILURE DETAILS:
beelzebub/logs test-beelzebub-logs-ndjson.log:
--- want
+++ got
@@ -206,6 +206,24 @@
                 ]
             },
             "source": {
+                "as": {
+                    "number": 64496,
+                    "organization": {
+                        "name": "Documentation ASN"
+                    }
+                },
+                "geo": {
+                    "city_name": "Greenwich",
+                    "continent_name": "Europe",
+                    "country_iso_code": "GB",
+                    "country_name": "United Kingdom",
+                    "location": {
+                        "lat": 51.47687,
+                        "lon": -4.1E-4
+                    },
+                    "region_iso_code": "GB-ENG",
+                    "region_name": "England"
+                },
                 "ip": "203.0.113.133",
                 "port": 60748
             },
@@ -257,6 +275,24 @@
%{BREVITY}%
@@ -54798,6 +66498,24 @@
                 ]
             },
             "source": {
+                "as": {
+                    "number": 64496,
+                    "organization": {
+                        "name": "Documentation ASN"
+                    }
+                },
+                "geo": {
+                    "city_name": "Greenwich",
+                    "continent_name": "Europe",
+                    "country_iso_code": "GB",
+                    "country_name": "United Kingdom",
+                    "location": {
+                        "lat": 51.47687,
+                        "lon": -4.1E-4
+                    },
+                    "region_iso_code": "GB-ENG",
+                    "region_name": "England"
+                },
                 "ip": "203.0.113.53",
                 "port": 40742
             },



╭───────────┬─────────────┬───────────┬───────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────┬──────────────╮
│ PACKAGE   │ DATA STREAM │ TEST TYPE │ TEST NAME                                                 │ RESULT                                                                  │ TIME ELAPSED │
├───────────┼─────────────┼───────────┼───────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────┼──────────────┤
│ beelzebub │ logs        │ pipeline  │ (ingest pipeline warnings test-beelzebub-logs-ndjson.log) │ PASS                                                                    │ 359.849459ms │
│ beelzebub │ logs        │ pipeline  │ test-beelzebub-logs-ndjson.log                            │ FAIL: test case failed: Expected results are different from actual ones │  42.7460275s │
╰───────────┴─────────────┴───────────┴───────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────┴──────────────╯
--- Test results for package: beelzebub - END   ---
Done
Error: one or more test cases failed
user@box beelzebub %

elastic-package-replaceips-sh

Fri, 14 Feb 2025 00:00:00 GMT

When you're building packages for Elastic Fleet/Agent, if you're providing sample logs to test pipeline and system processes with it's not uncommon to have elastic-package whinge about non-approved IP's being there similar to the below.

Elastic's rationale is, presumably, that sensitive IP information may be leaked if it's not replaced with IP's from an approved set. To a lesser extent I believe they're trying to force the use of real IP's that will have actual GeoIP information associated with them so that if a geoip processor is used in an ingest pipeline it will actually return geoip data that will be inserted into documents.

Frustratingly this also means that elastic-package will not accept RFC defined documentation network IP's, e.g. 192.0.2.0/24, 203.0.113.0/24, 2001:db8::/something etc.

user@box beelzebub % elastic-package test pipeline --generate
Run pipeline tests for the package
--- Test results for package: beelzebub - START ---
FAILURE DETAILS:
beelzebub/logs test-beelzebub-logs-ndjson.log:
[0] parsing field value failed: the IP "103.100.225.133" is not one of the allowed test IPs (see: https://github.com/elastic/elastic-package/blob/main/internal/fields/_static/allowed_geo_ips.txt)
%{BREVITY}%
[44] parsing field value failed: the IP "92.255.57.58" is not one of the allowed test IPs (see: https://github.com/elastic/elastic-package/blob/main/internal/fields/_static/allowed_geo_ips.txt)


╭───────────┬─────────────┬───────────┬───────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────────┬──────────────╮
│ PACKAGE   │ DATA STREAM │ TEST TYPE │ TEST NAME                                                 │ RESULT                                                                      │ TIME ELAPSED │
├───────────┼─────────────┼───────────┼───────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────────┼──────────────┤
│ beelzebub │ logs        │ pipeline  │ (ingest pipeline warnings test-beelzebub-logs-ndjson.log) │ PASS                                                                        │ 321.152166ms │
│ beelzebub │ logs        │ pipeline  │ test-beelzebub-logs-ndjson.log                            │ FAIL: test case failed: one or more problems with fields found in documents │ 1.868443625s │
╰───────────┴─────────────┴───────────┴───────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────────┴──────────────╯
--- Test results for package: beelzebub - END   ---
Done
Error: one or more test cases failed
user@box beelzebub % cd ../..

I wound up creating the following script, which I keep in the top of my integrations fork, which makes quick work of replacing IP's with those that will be accepted. I've now published this on GitHub as a gist for future modification tracking.

#!/bin/bash

function usage() {
  echo "Usage: ${0} package_name"
  exit 1
}

PACKAGE=${1}

IPv4_LEAD="1.128.0."
IPv6_LEAD="2a02:cf40:"
#IPv4_LEAD="203.0.113." # RFC 5737 - TEST-NET-3
#IPv6_LEAD="2001:db8:" # RFC 3849

test -z "${1}" && echo "ERROR: package name not provided" && usage
test ! -d "./packages/${PACKAGE}" && echo "ERROR: folder does not exist at ./packages/${PACKAGE}" && usage

for FILE in ./packages/${PACKAGE}/data_stream/*/_dev/test/pipeline/test-*.log ./packages/${PACKAGE}/data_stream/*/_dev/test/pipeline/test-*.json ; do
  echo "### Fixing IP's in ${FILE}"
  sed -r -i.backup "s/\"[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.([0-9]{1,3})/\"${IPv4_LEAD}\1/g" "${FILE}" && rm -f "${FILE}.backup"
  sed -r -i.backup "s/\"(([A-F0-9]{1,4}:){2,2})((:|:[A-F0-9]{1,4}){1,5}|([A-F0-9]{1,4}:){1,5}:|([A-F0-9]{1,4}:){1,4}:([A-F0-9]{1,4})|([A-F0-9]{1,4}:){5,6}([A-F0-9]{1,4}))/\"${IPv6_LEAD}\3/gi" "${FILE}" && rm -f "${FILE}.backup"
  sleep 1
done

# EOF

Example,

user@box integrations % ./replaceips.sh beelzebub
### Fixing IP's in ./packages/beelzebub/data_stream/logs/_dev/test/pipeline/test-beelzebub-logs-ndjson.log
### Fixing IP's in ./packages/beelzebub/data_stream/logs/_dev/test/pipeline/test-beelzebub-logs-ndjson.log-expected.json
user@box integrations % cd packages/beelzebub
user@box beelzebub % ls
_dev            changelog.yml   data_stream     docs            img             manifest.yml
user@box beelzebub % elastic-package test pipeline --generate
Run pipeline tests for the package
--- Test results for package: beelzebub - START ---
╭───────────┬─────────────┬───────────┬───────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE   │ DATA STREAM │ TEST TYPE │ TEST NAME                                                 │ RESULT │ TIME ELAPSED │
├───────────┼─────────────┼───────────┼───────────────────────────────────────────────────────────┼────────┼──────────────┤
│ beelzebub │ logs        │ pipeline  │ (ingest pipeline warnings test-beelzebub-logs-ndjson.log) │ PASS   │ 341.923375ms │
│ beelzebub │ logs        │ pipeline  │ test-beelzebub-logs-ndjson.log                            │ PASS   │ 2.992818916s │
╰───────────┴─────────────┴───────────┴───────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: beelzebub - END   ---
Done
user@box beelzebub %

xquartz-window-resize

Thu, 04 Jul 2024 00:00:00 GMT

If you're running MacOS and using XQuartz in order to transport app GUI display over SSH from a remote system you may run into an issue with XQuartz displayed window sizes not being adjustable beyond maximising it to the fill the screen or returning it to the initial size.

Normally each window is resized via the very bottom right corner however the initial display of the app may result in that corner being outside the size of your actually display.

After a little bit of time on Google I came across a script that uses xwininfo to identify the window to resize and then xdotool to actually resize it.

Unfortunately that script didn't work straight out of the box.

Some slight modifications led me to creating a working version as below.

Here it is in action,

user@mbp ~ % x11_resize 1920 1080
Click on the target window
info_id='xwininfo: Window id: 0x600003 "New Tab - Chromium"'
id=0x600003
title=New Tab - Chromium
Resize "New Tab - Chromium" (1905 x 2114) to 1920 x 1080? [y / n] y
Warning: XTEST extension unavailable on '(null)'. Some functionality may be disabled; See 'man xdotool' for more info.
user@mbp ~ %

Once adjusted to the size you want maximising it to your full display size will still work, and unmaximising it will return it to your custom adjusted size.

Post adjustment each XQuartz displayed app appears to retain the custom sizing.

The script itself,

#!/bin/bash

# Use xwininfo to get the id (and name) of a window (click to select)
# Use xdotool to resize the window to a specific size

if [[ $# -ne 2 ]]; then
    echo "Usage $0 width height"
    exit 0
fi

w=$1
h=$2

echo "Click on the target window"

info=$(xwininfo)

info_id=`echo "$info" | grep 'Window id:'`
info_w=`echo "$info" | grep 'Width:'`
info_h=`echo "$info" | grep 'Height:'`

echo "info_id='${info_id}'"

if [[ "$info_id" =~ ^.+Window\ id:\ (.+)\ \"(.+)\"$ ]]; then
    id="${BASH_REMATCH[1]}"
    title="${BASH_REMATCH[2]}"
fi

echo "id=${id}"
echo "title=${title}"

if [[ "$info_w" =~ "Width: "(.+) ]]; then
    window_w=${BASH_REMATCH[1]}
fi
if [[ "$info_h" =~ "Height: "(.+) ]]; then
    window_h=${BASH_REMATCH[1]}
fi

read -p "Resize \"$title\" ($window_w x $window_h) to $w x $h? [y / n] " answer

if ! [[ "$answer" == "" || "${answer}" == "y" ]]; then
    exit 0
fi

xdotool windowsize $id $w $h

# EOF

Welcome

Sat, 23 Mar 2024 00:00:00 GMT

This is a new site and a new attempt to invigorate what was once a passion for blogging and sharing solutions to technology problems.

Routed Logic Blog

MCP Server Tooling

What is MCP and why should you care?​

Running MCP Servers with Docker Desktop​

Clients​

Configuration​

Verifying Connection​

Discovering Available Tools​

MCP Server Security and Trust​

What tools should you actually install?​

MCP Servers & Tools​

Observed Issues​

MCP Server/Tool Visibility​

Tool Confusion and Overlap​

Summary​