Summarize the four Cisco ISE API surfaces (Open API, ERS, Data Connect, Monitor API), their precedence order (Open API > ERS > Data Connect > Monitor API — use the highest that can serve the task, fall back to a lower one only on failure), and the cached catalog version. Call this first when unsure which tool family to use.

Given a natural-language request, recommend which ISE surface and concrete tools to use, honoring surface precedence (Open API > ERS > Data Connect > Monitor API). Current config & state → Open API/ERS; reporting/historical/aggregate/audit only the monitoring DB holds → Data Connect (ise_dc_*); legacy live session/CoA lookups with no higher equivalent → Monitor API (ise_mnt_*). Returns primary_surface plus a fallback_order.

Show cached catalog provenance: target ISE version, source URLs, generation time, and per-surface entry counts.

Check the local catalog cache against the current upstream sources (re-scrape Cisco DevNet for Data Connect views; re-parse the ERS spec) and report added/removed/changed entries. Read-only — does NOT modify the cache. 'dc' requires network access to developer.cisco.com.

List every configured ISE deployment with its number, name, slug, host, and whether credentials are set. Use the number or name in any tool's 'deployment' argument (e.g. 'List RADIUS policy sets on Deployment 1'). Call this to see what is available.

Add a new ISE deployment to the registry (non-secret fields only — passwords are NEVER passed here). Returns the exact terminal command(s) to set the password(s) afterwards. Required: name and host (and ers_username for any ERS/Open API use). Reports every missing/invalid field at once. GUIDED FLOW — before calling, gather the optional surfaces by asking the user (do not assume): (1) Is Data Connect reporting needed, or ERS API only? If not needed, set dataconnect_enabled=false. (2) If needed: does Data Connect run on the same node as the admin host, or a separate Monitoring (MnT) node? If separate, set dataconnect_host. (3) Certificate: if the Data Connect cert is SELF-SIGNED, the user must export it and you set dataconnect_cert_path to the saved .pem; if it is CA-SIGNED, either set dataconnect_os_trust=true (validate against the OS CA store, no file needed) or point dataconnect_cert_path at the exported root-CA file. (4) Ask whether to enable the Monitor API (MAPI/MnT) via monitoring_enabled — it needs the ERS account in ISE's 'MnT Admin' group. Data Connect is always preferred over MAPI for reporting.

Modify an EXISTING deployment's non-secret settings — use this to fix a typo (e.g. wrong host) or add information later (e.g. enable Data Connect and set its certificate). Only the fields you pass change; everything else (including stored passwords) is preserved. Renaming to a name with a DIFFERENT slug changes the deployment's identity and moves its stored credentials, so it requires reslug=true; otherwise the rename is rejected with guidance. Passwords are NEVER set here (use the terminal: uv run cisco-ise-mcp set-credential ). Reports any remaining gaps.

Remove a deployment from the registry (and its stored credentials). Requires confirm=true.

Set which deployment is used when a tool call does not name one.

Check a deployment's configuration and credentials, reporting EVERY missing field/credential at once with the exact fix command. If nothing is missing and probe is true (default), also attempts a read-only live connection (ERS GET + Data Connect 'SELECT 1').

List every available ERS resource with its API path and supported operations (list/get/create/update/patch/delete/get_by_name).

List all objects of an ERS resource type (paginated). ERS = live configuration; for reports use ise_dc_* (Data Connect).

Retrieve a single ERS object by its ID.

Retrieve a single ERS object by its name (for resources that support /name/).

Search/filter ERS objects with ERS filter ('field.OP.value') and sort ('+field'/'-field') expressions.

Create a new ERS object. Provide the JSON payload matching the resource schema (use ise_ers_get to see an example first).

Full update (PUT) of an existing ERS object by ID. Provide the complete JSON payload.

Partial update (PATCH) of an existing ERS object by ID (ISE 3.x). Provide only the fields to change.

[DESTRUCTIVE] Delete an ERS object by ID.

[DESTRUCTIVE] Raw ERS passthrough for action sub-paths not covered by a typed tool (e.g. POST ers/config/endpoint/{id}/deregister). Path is relative to the host root.

List all Endpoints. Paginated.

Get a single Endpoints object by ID.

Search/filter Endpoints with ERS filter expressions.

List all Endpoint Identity Groups. Paginated.

Get a single Endpoint Identity Groups object by ID.

Search/filter Endpoint Identity Groups with ERS filter expressions.

List all Network Devices (NADs). Paginated.

Get a single Network Devices (NADs) object by ID.

Search/filter Network Devices (NADs) with ERS filter expressions.

List all Network Device Groups. Paginated.

Get a single Network Device Groups object by ID.

Search/filter Network Device Groups with ERS filter expressions.

List all Internal Users. Paginated.

Get a single Internal Users object by ID.

Search/filter Internal Users with ERS filter expressions.

List all Identity Groups. Paginated.

Get a single Identity Groups object by ID.

Search/filter Identity Groups with ERS filter expressions.

List all Authorization Profiles. Paginated.

Get a single Authorization Profiles object by ID.

Search/filter Authorization Profiles with ERS filter expressions.

List all Active Directory. Paginated.

Get a single Active Directory object by ID.

Search/filter Active Directory with ERS filter expressions.

List all Downloadable ACLs (dACLs). Paginated.

Get a single Downloadable ACLs (dACLs) object by ID.

Search/filter Downloadable ACLs (dACLs) with ERS filter expressions.

List all Allowed Protocols. Paginated.

Get a single Allowed Protocols object by ID.

Search/filter Allowed Protocols with ERS filter expressions.

List all ISE Nodes. Paginated.

Get a single ISE Nodes object by ID.

Search/filter ISE Nodes with ERS filter expressions.

List all Admin Users. Paginated.

Get a single Admin Users object by ID.

Search/filter Admin Users with ERS filter expressions.

List all Security Group Tags (SGTs). Paginated.

Get a single Security Group Tags (SGTs) object by ID.

Search/filter Security Group Tags (SGTs) with ERS filter expressions.

List all Security Group ACLs (SGACLs). Paginated.

Get a single Security Group ACLs (SGACLs) object by ID.

Search/filter Security Group ACLs (SGACLs) with ERS filter expressions.

List all TACACS+ Command Sets. Paginated.

Get a single TACACS+ Command Sets object by ID.

Search/filter TACACS+ Command Sets with ERS filter expressions.

List all TACACS+ Profiles. Paginated.

Get a single TACACS+ Profiles object by ID.

Search/filter TACACS+ Profiles with ERS filter expressions.

List all Guest Users. Paginated.

Get a single Guest Users object by ID.

Search/filter Guest Users with ERS filter expressions.

List all Guest Types. Paginated.

Get a single Guest Types object by ID.

Search/filter Guest Types with ERS filter expressions.

List all ANC Policies. Paginated.

Get a single ANC Policies object by ID.

Search/filter ANC Policies with ERS filter expressions.

List all ANC Endpoints. Paginated.

Get a single ANC Endpoints object by ID.

Search/filter ANC Endpoints with ERS filter expressions.

List all Profiler Profiles. Paginated.

Get a single Profiler Profiles object by ID.

Search/filter Profiler Profiles with ERS filter expressions.

List all Portals. Paginated.

Get a single Portals object by ID.

Search/filter Portals with ERS filter expressions.

List all LDAP Identity Sources. Paginated.

Get a single LDAP Identity Sources object by ID.

Search/filter LDAP Identity Sources with ERS filter expressions.

List all REST ID Stores. Paginated.

Get a single REST ID Stores object by ID.

Search/filter REST ID Stores with ERS filter expressions.

[Repository] Get list of repositories (GET /api/v1/repository)

[Repository] Get a specific repository (GET /api/v1/repository/{name})

[Repository] Create a new repository (POST /api/v1/repository)

[Repository] Update the definition of a specific repository (PUT /api/v1/repository/{name})

[DESTRUCTIVE] [Repository] Delete a specific repository (DELETE /api/v1/repository/{name})

[Repository] Get list of files in a repository (GET /api/v1/repository/{name}/files)

[Backup & Restore] Take the config DB backup now by providing the name of the backup,repository name and encryption key. The API returns the task ID. Use the Task Service status API to get the status of the backup job (POST /api/v1/backup-restore/config/backup)

[Backup & Restore] Cancel the running backup (POST /api/v1/backup-restore/config/cancel-backup)