Cisco Switch MCP Server

Adapter-driven MCP server for Cisco CBS220 switches, Catalyst Center/DNA Center, and Meraki Dashboard. Callers provide only device_id; the adapter is selected from inventory.yaml.

Status: initial lab/read-only release. Do not enable write operations in production until they pass review and lab validation.

Features

• CBS220/no-REST-API path: SSH/CLI through Netmiko

• Catalyst Center and Meraki API adapter structure

• Shared Pydantic schemas for all adapters

• Six read-only MCP tools

• Dry-run and explicit confirmation gate for write tools

• Per-device SSH concurrency limit

• Audit logging for write requests

Related MCP server: Meraki MCP Server

Install

cd "D:\MCP\mcp cisco"
py -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -e ".[cli,dev]"
Copy-Item inventory.example.yaml inventory.yaml
$env:PYTHONPATH = "D:\MCP\mcp cisco\src"
$env:INVENTORY_FILE = "D:\MCP\mcp cisco\inventory.yaml"

Configure a real CBS220

Create a dedicated least-privilege account for MCP, enable SSH, and restrict access to the management network. Never commit credentials.

devices:
  - id: cbs220-office
    host: 10.10.10.20
    vendor: cisco
    model: CBS220-48T-4G
    adapter: cli
    cli:
      device_type: cisco_s300
      username_env: SWITCH_USER
      password_env: SWITCH_PASSWORD
      port: 22
      max_sessions: 2

Set credentials only in the process environment:

$env:SWITCH_USER = "mcp-readonly"
$env:SWITCH_PASSWORD = "your-secret"
Test-NetConnection 10.10.10.20 -Port 22
ssh mcp-readonly@10.10.10.20

cisco_s300 is the initial Netmiko driver choice and must be verified with the exact CBS220 firmware in a lab. Change device_type if required.

Test Netmiko before MCP

python -c "from netmiko import ConnectHandler; import os; c=ConnectHandler(device_type='cisco_s300',host='10.10.10.20',username=os.environ['SWITCH_USER'],password=os.environ['SWITCH_PASSWORD'],port=22); print(c.send_command('show system')); c.disconnect()"

The CLI adapter currently uses these CBS220 commands: show system, show interfaces status, show vlan, show mac address-table, show running-config, and show interfaces counters. They are based on the Cisco 220 Series CLI Reference Guide.

Catalyst Center and Meraki

Use the catalyst_center or meraki adapter entries in inventory.example.yaml. Set the API token through the environment variable named by token_env. Update endpoint mappings in adapters.py to match the exact OpenAPI/API version deployed by your organization; the example mappings are intentionally generic and must be validated before production use.

Run the MCP server

python -m cisco_switch_mcp.server

Run the MCP Inspector against a lab only:

npx @modelcontextprotocol/inspector python -m cisco_switch_mcp.server

Read-only tools:

get_device_info(device_id="cbs220-office")
get_interface_status(device_id="cbs220-office")
get_vlan_list(device_id="cbs220-office")
get_mac_address_table(device_id="cbs220-office")
get_running_config(device_id="cbs220-office")
get_interface_stats(device_id="cbs220-office")

Dry-run example:

set_port_vlan({device_id:"cbs220-office", interface:"Gi1", vlan_id:20, dry_run:true})

The v0.1 CLI write path intentionally rejects real apply operations until commands are validated in a lab. Future apply calls must use dry_run=false and confirmation="CONFIRM".

Verification checklist

python -m compileall -q src

Before production:

1. Test against a lab switch or simulator.

2. Verify Netmiko driver and command output for the exact firmware.

3. Add SNMP polling and parser fixture tests.

4. Align Catalyst Center/Meraki endpoints with official OpenAPI specs.

5. Use a secret manager and least-privilege accounts.

6. Apply TLS/certificate and network access policies.

7. Enable write operations only after code review and change approval.

Evaluation questions

1. Show model and firmware for cbs220-lab.

2. Which ports on cbs220-lab are down?

3. List configured VLANs.

4. Find MAC 0011.2233.4455.

5. Retrieve the running config.

6. Find the interface with the most input errors.

7. Query the Catalyst Center device inventory.

8. Show interface status from Catalyst Center.

9. Query VLANs from Meraki.

10. Preview changing Gi1/0/10 to VLAN 20 without applying it.

Security

Do not commit .env, inventory.yaml, API keys, passwords, production exports, or raw configs. Review audit logs for sensitive data before forwarding them to an LLM. Use lab devices for all write testing.