Most “AI features” you’ll see an MSP ship in 2026 are a chat-bubble around someone else’s hosted LLM. They look nice in a demo. They work great for “what’s the weather in Tacoma.” They’re useless the moment a customer asks “can you restart the docker container on the front-desk laptop” or “which of my backups failed last night.”<\/p>\n\n\n\n
Percival \u2014 the agent we run at agent.rainier-it.com<\/a> \u2014 is the opposite of that. It’s a self-hosted AI operator built around the Model Context Protocol<\/a>, wired into 28 separate tool servers, and tied to every system that runs Rainier IT. It opens tickets, restarts containers, checks backups, runs SSH commands on allowlisted hosts, drafts incident summaries to Discord, and writes its weekly digest itself. It costs about $40 a month to operate. And it does it all on a 4-core LXC with 4 GB of RAM.<\/p>\n\n\n\n This post is the architectural tour I wish someone had written for me before I started building it.<\/p>\n\n\n\n Percival is named after the Arthurian knight who went looking for the Grail and came back with answers. Ours just goes looking for “which of these 47 things is on fire right now.” Same vibe.<\/p>\n\n\n\n The whole thing is one Python FastAPI app, one Postgres database, and a small herd of subprocess MCP servers. No vector databases other than pgvector. No LangChain. No agent framework. Vanilla JS frontend with no build pipeline.<\/p>\n\n\n\n Total host: one Proxmox LXC, 4 GB RAM, 40 GB disk, Ubuntu 24.04. The GPU box that does embeddings is a separate machine that idles most of the day.<\/p>\n\n\n\n This is the part of the architecture that earns its keep. Every external system Percival talks to gets its own MCP server: a small Python process that exposes typed tools over stdio. The agent spawns whichever it needs per session, and tears them down when the session ends.<\/p>\n\n\n\n Here’s the full fleet, grouped by function. Tool counts are real \u2014 I just grepped them out of the source.<\/p>\n\n\n\n This is the bulk of the day-to-day load. The Huntress + Action1 + TacticalRMM is the same stack we deploy at every client. Having all three in one chat window \u2014 “what’s currently isolated, what’s behind on patches, and what just paged”<\/em> \u2014 is genuinely surprising the first time you use it.<\/p>\n\n\n\n The The Uptime Kuma integration is an honest hack. Kuma’s “API” is a socket.io endpoint that won’t talk to anything that isn’t its own dashboard. We SSH into the Kuma container, query its SQLite directly, and call it a day. It works.<\/p>\n\n\n\n Total: 28 MCP servers, 213 tools.<\/strong> Plus a Every server follows the same shape. Here’s an abridged version of the structure (real example, not pseudocode):<\/p>\n\n\n\n
\n\n\n\n\ud83e\udd16 Inside Percival<\/h1>\n\n\n\n
\ud83c\udfd7\ufe0f The stack at a glance<\/h2>\n\n\n\n
Layer<\/th> What<\/th><\/tr><\/thead> Frontend<\/td> Vanilla JS + WebSocket chat UI<\/td><\/tr> Backend<\/td> FastAPI + asyncio + Anthropic SDK<\/td><\/tr> Tool runtime<\/td> 28 MCP servers, stdio-spawned per session<\/td><\/tr> LLM proxy<\/td> LiteLLM on odus:4000 \u2192 Anthropic + Ollama<\/td><\/tr> Local LLM<\/td> Ollama on wodin GPU host (GTX 1660 SUPER)<\/td><\/tr> Memory<\/td> pgvector in Postgres, 768-dim, nomic-embed-text<\/code><\/td><\/tr>Background workers<\/td> 7 asyncio tasks under one scheduler<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n\ud83d\udd0c The 28 MCP Servers (213 Tools)<\/h2>\n\n\n\n
Infrastructure & ops (7 servers, 80 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> proxmox<\/code><\/td>24<\/strong><\/td> VMs, LXCs, nodes, snapshots, create\/destroy\/start\/stop<\/td><\/tr> pbs<\/code><\/td>16<\/strong><\/td> Proxmox Backup Server \u2014 datastores, snapshots, verify\/prune\/GC, restore-list<\/td><\/tr> docker<\/code><\/td>9<\/td> Fleet container ops across 6 hosts (allowlisted, SSH key injection)<\/td><\/tr> nginx<\/code><\/td>9<\/td> Site configs, cert status, reload on spark<\/td><\/tr> monitoring<\/code><\/td>8<\/td> Prometheus, Loki, Grafana composite reads<\/td><\/tr> logs<\/code><\/td>5<\/td> Tail nginx\/docker\/syslog via SSH<\/td><\/tr> ssh-exec<\/code><\/td>3<\/td> Raw shell on allowlisted hosts (approval-gated)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n proxmox<\/code> and pbs<\/code> servers alone are why I built Percival in the first place \u2014 every other monitoring dashboard knows something<\/em> about backups, but only PBS knows whether the snapshot from last night actually verified.<\/p>\n\n\n\nRMM, security, and patching (4 servers, 38 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> huntress<\/code><\/td>14<\/strong><\/td> EDR agents, incidents, malware, isolation actions<\/td><\/tr> action1<\/code><\/td>10<\/strong><\/td> Patch compliance, endpoint inventory, scripts (OAuth2)<\/td><\/tr> ansible<\/code><\/td>8<\/td> Run playbooks against inventory groups<\/td><\/tr> trmm<\/code><\/td>6<\/td> TacticalRMM agents, alerts, commands<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Identity, comms, and tickets (6 servers, 33 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> nextcloud<\/code><\/td>5<\/td> WebDAV search + OCS user management<\/td><\/tr> authentik<\/code><\/td>6<\/td> Users, groups, sessions, audit events<\/td><\/tr> email<\/code><\/td>4<\/td> Gmail IMAP\/SMTP<\/td><\/tr> discord<\/code><\/td>4<\/td> Channels, search, post, attachments<\/td><\/tr> zammad<\/code><\/td>6<\/td> Ticket list, comment, state changes<\/td><\/tr> onboarding<\/code><\/td>6<\/td> Multi-service client provisioning<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n onboarding<\/code> server is special \u2014 it’s a composite<\/em> MCP that uses 5 others (Authentik, Email, Nextcloud, Invoice Ninja, TRMM) to spin up a new MSP client end-to-end. One tool call from chat, one workflow logged to Postgres, one branded welcome email at the end.<\/p>\n\n\n\nBusiness apps & content (5 servers, 36 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> wordpress<\/code><\/td>9<\/td> Posts, pages, comments, media (used to publish this post, actually)<\/td><\/tr> gdrive<\/code><\/td>9<\/td> Drive file ops (OAuth2)<\/td><\/tr> wikijs<\/code><\/td>6<\/td> Dual endpoint \u2014 internal wiki + client KB (GraphQL)<\/td><\/tr> invoiceninja<\/code><\/td>5<\/td> Invoices and clients<\/td><\/tr> cloudflare<\/code><\/td>8<\/td> Zones, DNS, cache purge, firewall rules<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n DevOps & observability (4 servers, 18 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> jenkins<\/code><\/td>6<\/td> Jobs, builds, queue<\/td><\/tr> grafana<\/code><\/td>7<\/td> Dashboards, datasources, alerts<\/td><\/tr> uptime-kuma<\/code><\/td>4<\/td> Monitor status (via SQLite \u2014 Kuma’s REST is socket.io-only)<\/td><\/tr> litellm-stats<\/code><\/td>2<\/td> LLM spend telemetry<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Plumbing (2 servers, 8 tools)<\/h3>\n\n\n\n
Server<\/th> Tools<\/th> Purpose<\/th><\/tr><\/thead> memory<\/code><\/td>9<\/td> Semantic search (pgvector + Ollama embed) over long-term memory<\/td><\/tr> net<\/code><\/td>5<\/td> ping, nslookup, iperf, traceroute<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n shared\/<\/code> directory of base classes (not a server, just a library) that handles things like API-token auth and rate-limiting.<\/p>\n\n\n\n
\n\n\n\n\ud83e\udde9 What an MCP server actually looks like<\/h2>\n\n\n\n