s2-netbox-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NETBOX_API_PATH | No | The NBAPI path appended to NETBOX_BASE_URL. The default is the verified path on NetBox 6.x controllers. Only set this to override the default — e.g. to the legacy, pre-6.x path /goforms/nbapi, which returns HTTP 410 Gone on 6.x controllers. A value without a leading / has one added automatically. | /nbws/goforms/nbapi |
| NETBOX_BASE_URL | Yes | Base URL of the NetBox controller's web interface, e.g. https://netbox.example.internal. No trailing slash or path — the client appends NETBOX_API_PATH itself. | |
| NETBOX_PASSWORD | Yes | NBAPI session-login password. Never logged, never written to any tracked file. | |
| NETBOX_USERNAME | Yes | NBAPI session-login username. | |
| NETBOX_ENABLE_WRITES | No | Set to true/1/yes to register the write tools. Unset (or any other value) leaves the server strictly read-only. | false |
| NETBOX_EVENT_API_PATH | No | Request path used only for trigger_event. Unset/empty tracks whatever NETBOX_API_PATH resolves to; a non-empty override is used verbatim (leading / added if missing) — e.g. the doc's pre-6.x Event API path /appd/nbapi, if your controller serves it separately. | |
| NETBOX_ALLOW_INSECURE_TLS | No | Set to true/1/yes to accept a self-signed/on-prem TLS certificate. Explicit opt-in only — any other value (including unset) keeps normal certificate verification. | false |
| NETBOX_ENABLE_DESTRUCTIVE | No | Set to true/1/yes, together with NETBOX_ENABLE_WRITES, to additionally register the 11 destructive tools. | false |
| NETBOX_UNLOCK_NAME_PREFIX | No | Name prefix of every object the managed unlock window creates: the portal group (<prefix>), the time spec group (<prefix> time specs), and the per-segment holidays/time specs (<prefix> first/middle/last). 1-40 characters so the longest name fits the 64-character NAME limit. | MCP Unlock Window |
| NETBOX_LIVE_TEST_PORTALKEY | No | The PORTALKEY of the one door you designate safe to physically unlock during npm run test:live:write/npm run test:live:write:daily. Read only by those scripts, never by the server itself. | |
| NETBOX_UNLOCK_HOLIDAY_GROUPS | No | The holiday groups reserved for the managed unlock window, in first,middle,last segment order. Must be 1-3 distinct integers in 1..8, comma-separated; reserve groups nothing else on the controller uses. | 8,7,6 |
| NETBOX_DAILY_UNLOCK_NAME_PREFIX | No | Name prefix of every object the managed daily unlock window creates: the portal group (<prefix>), the time spec group (<prefix> time specs), and the one holiday/time spec (<prefix> schedule). 1-40 characters so the longest name fits the 64-character NAME limit. | MCP Daily Unlock Window |
| NETBOX_DAILY_UNLOCK_HOLIDAY_GROUP | No | The single holiday group reserved for the managed daily recurring unlock window. Must be a single integer in 1..8, and must not be a member of NETBOX_UNLOCK_HOLIDAY_GROUPS (the two features' reserved groups can never collide). | 5 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_connectionA | Confirms the server can authenticate to the configured S2 NetBox controller and returns the NBAPI version string (wraps GetAPIVersion). No parameters required. |
| get_personA | Returns the full person record for a given PERSONID (wraps NBAPI GetPerson). |
| search_person_dataC | Searches for person records matching the given criteria (wraps NBAPI SearchPersonData). Every documented SearchPersonData filter field is modeled explicitly; omit all filters to return every record. |
| get_card_access_detailsA | Returns card/credential access details for a given card (wraps NBAPI GetCardAccessDetails). Identifies the card by ENCODEDNUM + CARDFORMAT, not PERSONID — GetCardAccessDetails has no PERSONID parameter. |
| get_card_formatsB | Returns the card formats configured on the NetBox system (wraps NBAPI GetCardFormats). No parameters required. |
| get_access_levelA | Returns the details of a single access level for a given ACCESSLEVELKEY (wraps NBAPI GetAccessLevel). |
| get_access_levelsA | Lists access levels configured on the NetBox system (wraps NBAPI GetAccessLevels). |
| get_access_level_groupA | Returns the details of a single access level group for a given ACCESSLEVELGROUPKEY (wraps NBAPI GetAccessLevelGroup). |
| get_access_level_groupsA | Lists access level groups configured on the NetBox system (wraps NBAPI GetAccessLevelGroups). |
| get_access_level_namesB | Lists access level names configured on the NetBox system (wraps NBAPI GetAccessLevelNames). |
| get_portalsA | Lists portals (doors) configured on the NetBox system, each with its nested readers (wraps NBAPI GetPortals, paginated via STARTFROMKEY/NEXTKEY — there is no single-portal filter). |
| get_readerA | Returns the details of a single reader for a given READERKEY (wraps NBAPI GetReader). |
| get_readersA | Lists readers configured on the NetBox system (wraps NBAPI GetReaders). There is no portal-id filter — use get_portals to see each reader nested under its portal. |
| get_outputsB | Lists auxiliary outputs configured on the NetBox system (wraps NBAPI GetOutputs). |
| find_portalsA | Finds portals (doors) by location or name. Portal names are site codes (e.g. 01OF05A), so this also searches each portal's reader names and reader descriptions (e.g. 'WORKSHOP TO MAINTENANCE OFFICE'). Case-insensitive; a portal matches when every whitespace-separated term appears in its name, a reader name, or a reader description. Reads every page of GetPortals and GetReaders and joins them by READERKEY. The result also lists portals with no reader description, which can only match by name. |
| get_event_historyB | Returns historical NetBox events for an optional event name/date range (wraps NBAPI GetEventHistory). |
| list_eventsA | Lists the event types/definitions known to the NetBox system (wraps NBAPI ListEvents). No parameters required. |
| get_access_historyA | Returns historical access (grant/deny) records for optional filters (wraps NBAPI GetAccessHistory). Identifies a person by ENCODEDNUM/HOTSTAMP, not PERSONID — GetAccessHistory has no PERSONID parameter. |
| get_time_specA | Returns the details of a single time spec for a given TIMESPECKEY (wraps NBAPI GetTimeSpec). |
| get_time_specsA | Lists time specs configured on the NetBox system (wraps NBAPI GetTimeSpecs). |
| get_time_spec_groupB | Returns the details of a single time spec group for a given TIMESPECGROUPKEY (wraps NBAPI GetTimeSpecGroup). |
| get_time_spec_groupsA | Lists time spec groups configured on the NetBox system (wraps NBAPI GetTimeSpecGroups). |
| get_holidayA | Returns the details of a single holiday for a given HOLIDAYKEY (wraps NBAPI GetHoliday). |
| get_holidaysA | Lists holiday keys configured on the NetBox system (wraps NBAPI GetHolidays). Returns a comma-separated key string, not a list of records — use get_holiday per key for details. |
| get_portal_groupB | Returns the details of a single portal group for a given PORTALGROUPKEY (wraps NBAPI GetPortalGroup). |
| get_portal_groupsA | Lists portal groups configured on the NetBox system (wraps NBAPI GetPortalGroups). |
| get_reader_groupB | Returns the details of a single reader group for a given READERGROUPKEY (wraps NBAPI GetReaderGroup). |
| get_reader_groupsB | Lists reader groups configured on the NetBox system (wraps NBAPI GetReaderGroups). |
| get_partitionsA | Lists partitions configured on the NetBox system (wraps NBAPI GetPartitions). No parameters required. |
| get_udf_listsB | Lists user-defined field (UDF) lists configured on the NetBox system (wraps NBAPI GetUDFLists). No parameters required. |
| get_udf_list_itemsA | Returns the items of a single UDF list for a given UDFLISTKEY (wraps NBAPI GetUDFListItems). |
| get_elevatorsA | Lists elevators configured on the NetBox system (wraps NBAPI GetElevators). |
| get_floorsA | Lists floors configured on the NetBox system (wraps NBAPI GetFloors). |
| ping_appB | Pings the NetBox NBAPI application to confirm it is responsive (wraps NBAPI PingApp). No parameters required. |
| get_unlock_windowA | Reports the managed unlock window, if any: the managed portal group "MCP Unlock Window" (key, portals, its unlock time spec group and whether that is the managed time spec group "MCP Unlock Window time specs"), that group and its members (read from paginated GetTimeSpecGroups), the managed time specs and holidays, the window derived from them, and whether it is active right now on the host clock. Read-only: issues only Get commands. No parameters required. |
| get_daily_unlock_windowA | Reports the managed daily recurring unlock window, if any: the managed portal group "MCP Daily Unlock Window" (key, portals, its unlock time spec group and whether that is the managed time spec group "MCP Daily Unlock Window time specs"), that group and its members (read from paginated GetTimeSpecGroups), the one managed time spec and holiday, the window derived from them, and whether it is active right now on the host clock. Read-only: issues only Get commands. No parameters required. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 36 tools
Each tool targets a distinct entity or operation (e.g., get_person vs search_person_data, get_portals vs find_portals, get_unlock_window vs get_daily_unlock_window). Descriptions clarify any potential overlap, such as get_readers vs get_portals. No two tools appear to serve the same purpose.
The dominant pattern is get_<entity> for singular and get_<entity>s for plural, with a few exceptions like list_events, check_connection, ping_app, find_portals, and search_person_data. These deviations are minor and do not create confusion, but they break the otherwise uniform get_ convention.
With 36 tools, the server exceeds the typical well-scoped range (3-15) by a wide margin. While the breadth of NetBox entities justifies many getters, the count feels heavy and could overwhelm an agent; a leaner surface with combined or parameterized tools would be more coherent.
The server provides comprehensive read-only coverage of NetBox entities: persons, time specs, groups, holidays, portals, readers, access levels, card formats, events, history, and more. Minor gaps exist (e.g., no single-portal getter, no individual event/access record retrieval), but the core read surface is complete for the apparent purpose.