MCP server that turns environment intents into whitelisted Qubes OS orchestration actions.

Part of Qubes Genie — a system that lets you describe the environment you want in plain language and have it built for you:

you speak → qubes-genie (model) → qubes-mcp (this repo) → dom0 whitelist → Salt

qubes-mcp is the executor: the one component allowed to act on Qubes. It receives a structured intent (never a shell command), maps it to a concrete tool call, and drives the orchestration through the existing remote-debug qrexec whitelist. A compromised or hallucinating upstream can at most produce an invalid intent — it cannot write arbitrary commands to dom0.

Deliberately narrow — every tool maps to one state in qubes-salt-config:

• list_templates — enumerate available environment templates
• create_env — build a template's qubes (templates.<name>.create)
• describe_env — report a qube's state
• teardown_env — remove an environment (guarded)

Each call is executed via the qubes.RemoteDebug whitelist; this server never assembles arbitrary shell.

Python · MCP SDK · qrexec · runs in tpl-mcp.

🚧 Skeleton. See the architecture blueprint for the full design.

MIT