Cisco ISE MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| UV_PUBLISH_TOKEN | No | Your token used for publishing. | |
| UV_PUBLISH_PASSWORD | No | Your password for publishing. | |
| UV_PUBLISH_USERNAME | No | Your username for publishing. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| ise_capabilitiesA | Summarize the four Cisco ISE API surfaces (Open API, ERS, Data Connect, Monitor API), their precedence order (Open API > ERS > Data Connect > Monitor API — use the highest that can serve the task, fall back to a lower one only on failure), and the cached catalog version. Call this first when unsure which tool family to use. |
| ise_routeA | Given a natural-language request, recommend which ISE surface and concrete tools to use, honoring surface precedence (Open API > ERS > Data Connect > Monitor API). Current config & state → Open API/ERS; reporting/historical/aggregate/audit only the monitoring DB holds → Data Connect (ise_dc_*); legacy live session/CoA lookups with no higher equivalent → Monitor API (ise_mnt_*). Returns primary_surface plus a fallback_order. |
| ise_catalog_infoA | Show cached catalog provenance: target ISE version, source URLs, generation time, and per-surface entry counts. |
| ise_catalog_diffA | Check the local catalog cache against the current upstream sources (re-scrape Cisco DevNet for Data Connect views; re-parse the ERS spec) and report added/removed/changed entries. Read-only — does NOT modify the cache. 'dc' requires network access to developer.cisco.com. |
| ise_list_deploymentsA | List every configured ISE deployment with its number, name, slug, host, and whether credentials are set. Use the number or name in any tool's 'deployment' argument (e.g. 'List RADIUS policy sets on Deployment 1'). Call this to see what is available. |
| ise_add_deploymentA | Add a new ISE deployment to the registry (non-secret fields only — passwords are NEVER passed here). Returns the exact terminal command(s) to set the password(s) afterwards. Required: name and host (and ers_username for any ERS/Open API use). Reports every missing/invalid field at once. GUIDED FLOW — before calling, gather the optional surfaces by asking the user (do not assume): (1) Is Data Connect reporting needed, or ERS API only? If not needed, set dataconnect_enabled=false. (2) If needed: does Data Connect run on the same node as the admin host, or a separate Monitoring (MnT) node? If separate, set dataconnect_host. (3) Certificate: if the Data Connect cert is SELF-SIGNED, the user must export it and you set dataconnect_cert_path to the saved .pem; if it is CA-SIGNED, either set dataconnect_os_trust=true (validate against the OS CA store, no file needed) or point dataconnect_cert_path at the exported root-CA file. (4) Ask whether to enable the Monitor API (MAPI/MnT) via monitoring_enabled — it needs the ERS account in ISE's 'MnT Admin' group. Data Connect is always preferred over MAPI for reporting. |
| ise_update_deploymentA | Modify an EXISTING deployment's non-secret settings — use this to fix a typo (e.g. wrong host) or add information later (e.g. enable Data Connect and set its certificate). Only the fields you pass change; everything else (including stored passwords) is preserved. Renaming to a name with a DIFFERENT slug changes the deployment's identity and moves its stored credentials, so it requires reslug=true; otherwise the rename is rejected with guidance. Passwords are NEVER set here (use the terminal: uv run cisco-ise-mcp set-credential ). Reports any remaining gaps. |
| ise_remove_deploymentB | Remove a deployment from the registry (and its stored credentials). Requires confirm=true. |
| ise_set_default_deploymentB | Set which deployment is used when a tool call does not name one. |
| ise_test_deploymentA | Check a deployment's configuration and credentials, reporting EVERY missing field/credential at once with the exact fix command. If nothing is missing and probe is true (default), also attempts a read-only live connection (ERS GET + Data Connect 'SELECT 1'). |
| ise_ers_resourcesA | List every available ERS resource with its API path and supported operations (list/get/create/update/patch/delete/get_by_name). |
| ise_ers_listA | List all objects of an ERS resource type (paginated). ERS = live configuration; for reports use ise_dc_* (Data Connect). |
| ise_ers_getC | Retrieve a single ERS object by its ID. |
| ise_ers_get_by_nameA | Retrieve a single ERS object by its name (for resources that support /name/). |
| ise_ers_searchA | Search/filter ERS objects with ERS filter ('field.OP.value') and sort ('+field'/'-field') expressions. |
| ise_ers_createB | Create a new ERS object. Provide the JSON payload matching the resource schema (use ise_ers_get to see an example first). |
| ise_ers_updateB | Full update (PUT) of an existing ERS object by ID. Provide the complete JSON payload. |
| ise_ers_patchA | Partial update (PATCH) of an existing ERS object by ID (ISE 3.x). Provide only the fields to change. |
| ise_ers_deleteA | [DESTRUCTIVE] Delete an ERS object by ID. |
| ise_ers_requestA | [DESTRUCTIVE] Raw ERS passthrough for action sub-paths not covered by a typed tool (e.g. POST ers/config/endpoint/{id}/deregister). Path is relative to the host root. |
| ise_ers_list_endpointA | List all Endpoints. Paginated. |
| ise_ers_get_endpointC | Get a single Endpoints object by ID. |
| ise_ers_search_endpointC | Search/filter Endpoints with ERS filter expressions. |
| ise_ers_list_endpointgroupA | List all Endpoint Identity Groups. Paginated. |
| ise_ers_get_endpointgroupB | Get a single Endpoint Identity Groups object by ID. |
| ise_ers_search_endpointgroupC | Search/filter Endpoint Identity Groups with ERS filter expressions. |
| ise_ers_list_networkdeviceC | List all Network Devices (NADs). Paginated. |
| ise_ers_get_networkdeviceC | Get a single Network Devices (NADs) object by ID. |
| ise_ers_search_networkdeviceC | Search/filter Network Devices (NADs) with ERS filter expressions. |
| ise_ers_list_networkdevicegroupC | List all Network Device Groups. Paginated. |
| ise_ers_get_networkdevicegroupC | Get a single Network Device Groups object by ID. |
| ise_ers_search_networkdevicegroupC | Search/filter Network Device Groups with ERS filter expressions. |
| ise_ers_list_internaluserB | List all Internal Users. Paginated. |
| ise_ers_get_internaluserC | Get a single Internal Users object by ID. |
| ise_ers_search_internaluserC | Search/filter Internal Users with ERS filter expressions. |
| ise_ers_list_identitygroupB | List all Identity Groups. Paginated. |
| ise_ers_get_identitygroupB | Get a single Identity Groups object by ID. |
| ise_ers_search_identitygroupB | Search/filter Identity Groups with ERS filter expressions. |
| ise_ers_list_authorizationprofileC | List all Authorization Profiles. Paginated. |
| ise_ers_get_authorizationprofileA | Get a single Authorization Profiles object by ID. |
| ise_ers_search_authorizationprofileC | Search/filter Authorization Profiles with ERS filter expressions. |
| ise_ers_list_activedirectoryB | List all Active Directory. Paginated. |
| ise_ers_get_activedirectoryA | Get a single Active Directory object by ID. |
| ise_ers_search_activedirectoryC | Search/filter Active Directory with ERS filter expressions. |
| ise_ers_list_downloadableaclB | List all Downloadable ACLs (dACLs). Paginated. |
| ise_ers_get_downloadableaclC | Get a single Downloadable ACLs (dACLs) object by ID. |
| ise_ers_search_downloadableaclC | Search/filter Downloadable ACLs (dACLs) with ERS filter expressions. |
| ise_ers_list_allowedprotocolsB | List all Allowed Protocols. Paginated. |
| ise_ers_get_allowedprotocolsC | Get a single Allowed Protocols object by ID. |
| ise_ers_search_allowedprotocolsB | Search/filter Allowed Protocols with ERS filter expressions. |
| ise_ers_list_nodeB | List all ISE Nodes. Paginated. |
| ise_ers_get_nodeB | Get a single ISE Nodes object by ID. |
| ise_ers_search_nodeB | Search/filter ISE Nodes with ERS filter expressions. |
| ise_ers_list_adminuserC | List all Admin Users. Paginated. |
| ise_ers_get_adminuserA | Get a single Admin Users object by ID. |
| ise_ers_search_adminuserC | Search/filter Admin Users with ERS filter expressions. |
| ise_ers_list_sgtC | List all Security Group Tags (SGTs). Paginated. |
| ise_ers_get_sgtB | Get a single Security Group Tags (SGTs) object by ID. |
| ise_ers_search_sgtC | Search/filter Security Group Tags (SGTs) with ERS filter expressions. |
| ise_ers_list_sgaclB | List all Security Group ACLs (SGACLs). Paginated. |
| ise_ers_get_sgaclB | Get a single Security Group ACLs (SGACLs) object by ID. |
| ise_ers_search_sgaclC | Search/filter Security Group ACLs (SGACLs) with ERS filter expressions. |
| ise_ers_list_tacacscommandsetsC | List all TACACS+ Command Sets. Paginated. |
| ise_ers_get_tacacscommandsetsC | Get a single TACACS+ Command Sets object by ID. |
| ise_ers_search_tacacscommandsetsC | Search/filter TACACS+ Command Sets with ERS filter expressions. |
| ise_ers_list_tacacsprofileC | List all TACACS+ Profiles. Paginated. |
| ise_ers_get_tacacsprofileC | Get a single TACACS+ Profiles object by ID. |
| ise_ers_search_tacacsprofileC | Search/filter TACACS+ Profiles with ERS filter expressions. |
| ise_ers_list_guestuserC | List all Guest Users. Paginated. |
| ise_ers_get_guestuserB | Get a single Guest Users object by ID. |
| ise_ers_search_guestuserC | Search/filter Guest Users with ERS filter expressions. |
| ise_ers_list_guesttypeC | List all Guest Types. Paginated. |
| ise_ers_get_guesttypeC | Get a single Guest Types object by ID. |
| ise_ers_search_guesttypeC | Search/filter Guest Types with ERS filter expressions. |
| ise_ers_list_ancpolicyB | List all ANC Policies. Paginated. |
| ise_ers_get_ancpolicyB | Get a single ANC Policies object by ID. |
| ise_ers_search_ancpolicyB | Search/filter ANC Policies with ERS filter expressions. |
| ise_ers_list_ancendpointC | List all ANC Endpoints. Paginated. |
| ise_ers_get_ancendpointB | Get a single ANC Endpoints object by ID. |
| ise_ers_search_ancendpointC | Search/filter ANC Endpoints with ERS filter expressions. |
| ise_ers_list_profilerprofileB | List all Profiler Profiles. Paginated. |
| ise_ers_get_profilerprofileC | Get a single Profiler Profiles object by ID. |
| ise_ers_search_profilerprofileC | Search/filter Profiler Profiles with ERS filter expressions. |
| ise_ers_list_portalB | List all Portals. Paginated. |
| ise_ers_get_portalC | Get a single Portals object by ID. |
| ise_ers_search_portalC | Search/filter Portals with ERS filter expressions. |
| ise_ers_list_ldapA | List all LDAP Identity Sources. Paginated. |
| ise_ers_get_ldapB | Get a single LDAP Identity Sources object by ID. |
| ise_ers_search_ldapC | Search/filter LDAP Identity Sources with ERS filter expressions. |
| ise_ers_list_restidstoreB | List all REST ID Stores. Paginated. |
| ise_ers_get_restidstoreC | Get a single REST ID Stores object by ID. |
| ise_ers_search_restidstoreB | Search/filter REST ID Stores with ERS filter expressions. |
| ise_openapi_repo_listB | [Repository] Get list of repositories (GET /api/v1/repository) |
| ise_openapi_repo_getB | [Repository] Get a specific repository (GET /api/v1/repository/{name}) |
| ise_openapi_repo_createC | [Repository] Create a new repository (POST /api/v1/repository) |
| ise_openapi_repo_updateB | [Repository] Update the definition of a specific repository (PUT /api/v1/repository/{name}) |
| ise_openapi_repo_deleteA | [DESTRUCTIVE] [Repository] Delete a specific repository (DELETE /api/v1/repository/{name}) |
| ise_openapi_repo_list_filesC | [Repository] Get list of files in a repository (GET /api/v1/repository/{name}/files) |
| ise_openapi_backup_createB | [Backup & Restore] Take the config DB backup now by providing the name of the backup,repository name and encryption key. The API returns the task ID. Use the Task Service status API to get the status of the backup job (POST /api/v1/backup-restore/config/backup) |
| ise_openapi_backup_cancelB | [Backup & Restore] Cancel the running backup (POST /api/v1/backup-restore/config/cancel-backup) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 201 tools
The four surface prefixes (ers/openapi/mnt/dc) plus routing guidance (ise_route, ise_capabilities) make the tool families distinguishable, and typed tools name their resources clearly. However, generic tools (ise_ers_list, ise_dc_view, ise_openapi_request, ise_mnt_request) overlap substantially with the typed wrappers they subsume, and pairs like ise_mnt_session_by_ip vs ise_mnt_session_by_endpoint_ip or the three RADIUS authentication DC views require careful reading to disambiguate.
Tool names follow a systematic family-prefix scheme (ise_ers_, ise_openapi_, ise_mnt_, ise_dc_) with mostly consistent verb_noun structure within each family. Minor deviations exist: OpenAPI mixes ordering (ise_openapi_radius_dictionary_list vs ise_openapi_radius_policy_set_list), MNT session tools use irregular forms (session_by_mac vs active_session_list), and DC view suffixes (_week, _summary) are not uniform.
At 201 tools this is far beyond the 'too many' threshold and will heavily burden an agent's context window and selection speed. The count is inflated by redundancy: generic tools (ise_ers_list/get/create/update/delete, ise_dc_view, ise_dc_query, raw passthroughs) already subsume most of the ~60 typed ERS wrappers and ~15 typed DC view wrappers. The breadth is genuine — four API surfaces, dozens of resource types — which keeps it from a 1, but the surface is clearly over-tooled.
The server covers all four Cisco ISE API surfaces with near-complete lifecycle coverage for ERS resources, broad Open API coverage (policy, certs, backup, licensing, patches, deployment), and rich Data Connect/Monitor reporting. Minor gaps exist — no typed update/delete for RADIUS/TACACS authentication/authorization rules, and some operations reachable only via raw passthrough — but the generic CRUD/request/query tools and deployment-registry tools make workarounds straightforward.