VyOS MCP Server

An MCP (Model Context Protocol) server for managing VyOS routers via the VyOS HTTP API. Gives any MCP-compatible AI assistant full control over your VyOS router — from reading config to setting up interfaces, firewall rules, VPNs, and more.

Requirements

Python 3.10+
A VyOS router (1.4+ or rolling) with the HTTP API enabled

Enable the VyOS HTTP API

On your VyOS router:

configure
set service https api keys id my-app key 'YOUR_API_KEY'
set service https api rest
commit
save

Installation

git clone https://github.com/openclaw/vyos-mcp.git
cd vyos-mcp
python -m venv .venv
source .venv/bin/activate
pip install -e .

Configuration

Claude Code

Add to your ~/.claude.json (or project .mcp.json):

{
  "mcpServers": {
    "vyos": {
      "command": "/path/to/vyos-mcp/.venv/bin/python",
      "args": ["-m", "vyos_mcp.server"],
      "env": {
        "VYOS_URL": "https://10.0.0.1",
        "VYOS_API_KEY": "YOUR_API_KEY",
        "VYOS_VERIFY_SSL": "false"
      }
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "vyos": {
      "command": "/path/to/vyos-mcp/.venv/bin/python",
      "args": ["-m", "vyos_mcp.server"],
      "env": {
        "VYOS_URL": "https://10.0.0.1",
        "VYOS_API_KEY": "YOUR_API_KEY",
        "VYOS_VERIFY_SSL": "false"
      }
    }
  }
}

Environment Variables

Variable	Required	Description
`VYOS_URL`	Yes	Base URL of your VyOS router (e.g. `https://10.0.0.1`)
`VYOS_API_KEY`	Yes	API key configured on the router
`VYOS_VERIFY_SSL`	No	Set to `false` to skip TLS verification (default: `true`)

Tools

Read-Only

Tool	Description
`vyos_info`	Get system version, hostname, and banner (no auth required)
`vyos_show`	Run operational-mode `show` commands (interfaces, routes, BGP, etc.)
`vyos_show_config`	Retrieve running configuration (full or partial subtree)
`vyos_exists`	Check whether a configuration path exists
`vyos_return_values`	Return values of a multi-valued config node (e.g. DNS servers)

Configuration

Tool	Description
`vyos_set`	Set a single configuration path
`vyos_delete`	Delete a configuration path and its children
`vyos_comment`	Add a comment to a configuration node
`vyos_configure_batch`	Apply multiple set/delete/comment operations in a single atomic commit

All configuration tools automatically save to /config/config.boot after a successful commit, so changes persist across reboots.

Use confirm_time (1-60 minutes) on any config tool for safe rollback — changes auto-revert unless confirmed with vyos_confirm_commit.

Config File Management

Tool	Description
`vyos_save_config`	Save running config to disk (default or custom path)
`vyos_load_config`	Load a config file, replacing the running configuration
`vyos_merge_config`	Merge config from a file or inline string into running config
`vyos_confirm_commit`	Confirm a pending commit-confirm timer

System

Tool	Description
`vyos_generate`	Run generate commands (WireGuard keys, certificates, etc.)
`vyos_reset`	Reset protocol sessions, counters, or runtime state
`vyos_image`	Add (download) or delete system images
`vyos_system_control`	Reboot or power off the router (requires explicit confirmation)

Examples

Once configured, you can ask your AI assistant things like:

"Show me the current interface status"
"Set up eth0 as WAN with DHCP and eth1 as LAN with a DHCP server on 192.168.1.0/24"
"Add a firewall rule to block incoming traffic on port 22 from WAN"
"Set up a WireGuard VPN tunnel to 203.0.113.1"
"Show me the routing table"
"What DHCP leases are active?"
"Generate a new WireGuard key pair"

License

MIT

vyos-mcp

VyOS MCP Server

Requirements

Enable the VyOS HTTP API

Installation

Configuration

Claude Code

Claude Desktop

Environment Variables

Tools

Read-Only

Configuration

Config File Management

System

Examples

License

Latest Blog Posts

MCP directory API