Installing the AI assistant

Overview

The AI assistant backend consists of two services:

Component	Purpose
SM-AI	Connects a language model to Smart Monitor. The AI assistant and the ai command use this service
SM-MCP	Receives questions from the interface, calls the model through SM-AI, performs data operations under the user's account, and stores chat history

Install or connect the model separately. It is not included in the service distributions. The chat interface is part of Smart Monitor Web.

The services are installed from archives that include setup.sh. For detailed steps, see SM-AI settings and SM-MCP settings.

Requirements

• Linux x86_64 servers with systemd, bash, curl, and openssl
• root privileges or the ability to run commands with sudo
• access to a model with an OpenAI-compatible /v1/chat/completions API and tool-call support (tools, tool_calls)
• a platform administrator account for configuration
• a regular account to check access to data, the knowledge corpus, and skills
• a cluster CA certificate and service certificates and keys
• a maintenance window to restart storage nodes one at a time when enabling history protection

We recommend installing SM-MCP on a separate server. Store the history encryption key separately from cluster backups and restrict access to it. You can place SM-AI on the same server as SM-MCP or on another server with network access to the model.

Model server resource requirements depend on the selected model and the number of concurrent requests.

Network connections

The ports below are the installer defaults. Adjust network access rules if you change them.

Source	Destination	Default port
Smart Monitor Web	SM-MCP chat API over HTTPS	8088
SM-MCP	SM-AI over HTTPS	8010
Search engine nodes	SM-AI for the ai command over HTTPS	8010
SM-AI and SM-MCP	Smart Monitor storage API over HTTPS	9200
SM-AI	Model API	Set by the model provider

Grant Smart Monitor Web servers access to the SM-MCP chat API. The /mcp route is available on the same port as the chat API, so the network restriction also applies to it. You can configure an additional MCP port for external clients.

If the services use a proxy, add internal service addresses to NO_PROXY exceptions.

Preparing certificates

1. Prepare the cluster CA certificate in PEM format
2. Prepare separate SM-AI and SM-MCP server certificates and keys in PEM format. The names used by other components to access the services must be included in the certificates' SANs
3. Use a certificate issued by the cluster CA for SM-AI: both SM-MCP and the search engine verify it
4. For SM-MCP, use a certificate issued by the CA specified in opensearch.ssl.certificateAuthorities in opensearch_dashboards.yml on Smart Monitor Web servers

Instead of an existing certificate and key pair, you can provide a CA certificate and key to the installer so it can issue a service certificate. The CA key is needed only to issue the certificate; store it according to your organization's policies.

Service certificates

Do not use storage node private keys for the services. SM-AI and SM-MCP certificates must have the serverAuth purpose; their DNs must not match the plugins.security.nodes_dn patterns.

Installation order

1. Prepare the model API address, provider model ID, and access key if required
2. Install SM-AI and add the model to its registry
3. Check access to SM-AI from the SM-MCP server and a search engine node. If you use the ai command, configure its connection
4. Install SM-MCP, specifying the SM-AI address and the model registry entry name
5. Upload the knowledge corpus and skills, and prepare history. You can do this during SM-MCP installation
6. Enable history protection and storage: change the settings on all storage nodes, restart them one at a time, and run enable-history
7. Connect Smart Monitor Web to SM-MCP

info

Creating files and starting the SM-MCP service do not automatically enable history storage. The installer gives the technical account password to the service only after verifying index protection.

Verifying the installation

1. Check the services and diagnostic responses using the SM-AI and SM-MCP instructions
2. Under a regular account, ask a question in chat about an accessible source, such as the number of events in the last day. Specify your source name and time period
3. Wait for the answer and check the source, period, and reported value
4. Open another chat and return to the test chat: its messages should be restored from history
5. Repeat the question under a user without access to the test data: the answer must not contain that data

A successful /health or /healthz response confirms that the service has started. To verify the complete connection, ask a chat question that uses the model and data.