hpe-edgeconnect-mcp

An MCP server that exposes an HPE Aruba EdgeConnect Orchestrator as tools an LLM client can call — list appliances, read interface and tunnel state, pull WAN bandwidth time series, and check or change HPE SSE tunnel state.

It speaks MCP over Streamable HTTP, so it runs as its own service on the network rather than as a local subprocess of one client.

Not affiliated with, endorsed by, or supported by Hewlett Packard Enterprise. "HPE," "Aruba," "EdgeConnect," and "Silver Peak" are trademarks of their respective owners and are used here only to describe what this software talks to.

Read this before you point it at production

Two of the eleven tools change state, and this server does not ask before executing them. There is no preview, no confirmation, no dry-run. If a model decides to call one, it happens.

That second one deserves a straight description: disabling SSE for an appliance takes down all of its HPE SSE tunnels together (e.g. an A1 + A2 pair), and bringing them back is not instant — re-enabling kicks off an orchestration cycle, and tunnels have been observed taking 10–15 minutes to come back up. It is not an operation you want a model performing speculatively while it "investigates" something.

Two ways to handle that:

1. Scope the API key read-only. This is the real control, and it lives on the Orchestrator, not in this code. Give the API key a read-only role and the write tools fail at the API no matter what any model decides. Do this unless you specifically intend the writes to work.

2. Gate the writes in your client. Every state-changing tool is prefixed write_. That prefix is a convention of this codebase precisely so a client can match on it and route those calls through a human-approval step before execution. This server deliberately doesn't do that itself — it has no user to ask.

Related MCP server: quads-mcp

The MCP endpoint has no authentication

This server exposes its tools to anyone who can reach its port. There is no token, no client auth, no TLS on the MCP side.

MCP_HOST defaults to 127.0.0.1 for that reason. The container image sets 0.0.0.0 because it has to, which means publishing the container's port puts an unauthenticated control plane for your SD-WAN on that interface. Keep it on an internal network with the client, or terminate TLS and authentication in front of it.

Tools

Reads (9)

Writes (2) — write_set_appliance_location, write_set_appliance_sse_tunnel. See the warning above.

A note on get_appliance_sse_tunnel_status, because it is the one place the API is genuinely confusing: HPE SSE tunnels are pass-through tunnels, not the physical/underlay tunnels get_tunnel_status reports. On a single-appliance deployment get_tunnel_status returns empty regardless of SSE state. Don't infer SSE health from it — that's what this tool is for.

Secret redaction

The Orchestrator returns secrets embedded in otherwise-useful objects — the appliance list, for instance, carries device admin passwords in cleartext. Every tool result is scrubbed before it leaves the server, replacing the value of any sensitive-named field (password, psk, presharedkey, snmpcommunity, token, …) with ***REDACTED***.

It's a denylist by exact field name, kept deliberately narrow to avoid over-redacting benign fields like publicKey. If your Orchestrator version returns a secret under a field name that isn't in _SENSITIVE_FIELDS in server.py, it will pass through to the model. Worth a look before you trust it with a large deployment.

Configuration

All configuration is environment variables.

Auth is stateless: no login call, no session cookie, no CSRF token. The key goes in a header rather than the ?apiKey= query param the Orchestrator also accepts — TLS protects both in transit, but query strings get written to proxy and server access logs in cleartext.

Running it

Directly:

pip install -r requirements.txt
export EDGECONNECT_BASE_URL=https://orchestrator.example.com
export EDGECONNECT_API_KEY=...
python server.py

In Docker:

docker build -t hpe-edgeconnect-mcp .
docker run --rm -p 127.0.0.1:8001:8001 \
    -e EDGECONNECT_BASE_URL=https://orchestrator.example.com \
    -e EDGECONNECT_API_KEY=... \
    hpe-edgeconnect-mcp

The MCP endpoint is at /mcp on that port. Note the 127.0.0.1: in the port publish — see the authentication section above.

Checking it against your Orchestrator

test_client.py is a read-only smoke test that requires a live Orchestrator — not a unit test, and it won't run without real gear. It exercises every read method and prints what comes back:

export EDGECONNECT_BASE_URL=... EDGECONNECT_API_KEY=...
python test_client.py

Any block that prints an HTTP 4xx/5xx line means an endpoint path or the auth constant needs adjusting for your Orchestrator version. It never calls a write method, so it cannot change device state.

Compatibility

Endpoint paths and the nePk identifier were verified live against Orchestrator v9.7.0.43266 and cross-checked against its OpenAPI spec. Other versions will likely need path adjustments — they're all in edgeconnect_client.py, which is a plain REST wrapper with no MCP dependency, so it's straightforward to correct and to reuse outside MCP entirely.

One identifier gotcha that costs people time: the appliance-scoped endpoints want the nePk — the id field from list_appliances, like 2.NE. They reject the numeric applianceId field that appears alongside it.

License

Copyright 2026 Jason Anderson

Licensed under the Apache License, Version 2.0. See LICENSE.