# Cisco Switch MCP Server

Adapter-driven MCP server for Cisco CBS220 switches, Catalyst Center/DNA Center, and Meraki Dashboard. Callers provide only `device_id`; the adapter is selected from `inventory.yaml`.

Status: initial lab/read-only release. Do not enable write operations in production until they pass review and lab validation.

## Features

- CBS220/no-REST-API path: SSH/CLI through Netmiko
- Catalyst Center and Meraki API adapter structure
- Shared Pydantic schemas for all adapters
- Six read-only MCP tools
- Dry-run and explicit confirmation gate for write tools
- Per-device SSH concurrency limit
- Audit logging for write requests

## Install

```powershell
cd "D:\MCP\mcp cisco"
py -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -e ".[cli,dev]"
Copy-Item inventory.example.yaml inventory.yaml
$env:PYTHONPATH = "D:\MCP\mcp cisco\src"
$env:INVENTORY_FILE = "D:\MCP\mcp cisco\inventory.yaml"
```

## Configure a real CBS220

Create a dedicated least-privilege account for MCP, enable SSH, and restrict access to the management network. Never commit credentials.

```yaml
devices:
  - id: cbs220-office
    host: 10.10.10.20
    vendor: cisco
    model: CBS220-48T-4G
    adapter: cli
    cli:
      device_type: cisco_s300
      username_env: SWITCH_USER
      password_env: SWITCH_PASSWORD
      port: 22
      max_sessions: 2
```

Set credentials only in the process environment:

```powershell
$env:SWITCH_USER = "mcp-readonly"
$env:SWITCH_PASSWORD = "your-secret"
Test-NetConnection 10.10.10.20 -Port 22
ssh mcp-readonly@10.10.10.20
```

`cisco_s300` is the initial Netmiko driver choice and must be verified with the exact CBS220 firmware in a lab. Change `device_type` if required.

## Test Netmiko before MCP

```powershell
python -c "from netmiko import ConnectHandler; import os; c=ConnectHandler(device_type='cisco_s300',host='10.10.10.20',username=os.environ['SWITCH_USER'],password=os.environ['SWITCH_PASSWORD'],port=22); print(c.send_command('show system')); c.disconnect()"
```

The CLI adapter currently uses these CBS220 commands: `show system`, `show interfaces status`, `show vlan`, `show mac address-table`, `show running-config`, and `show interfaces counters`. They are based on the [Cisco 220 Series CLI Reference Guide](https://www.cisco.com/c/en/us/td/docs/switches/lan/csbss/CBS220/CLI-Guide/b_220CLI.html).

## Catalyst Center and Meraki

Use the `catalyst_center` or `meraki` adapter entries in `inventory.example.yaml`. Set the API token through the environment variable named by `token_env`. Update endpoint mappings in `adapters.py` to match the exact OpenAPI/API version deployed by your organization; the example mappings are intentionally generic and must be validated before production use.

## Run the MCP server

```powershell
python -m cisco_switch_mcp.server
```

Run the MCP Inspector against a lab only:

```powershell
npx @modelcontextprotocol/inspector python -m cisco_switch_mcp.server
```

Read-only tools:

```text
get_device_info(device_id="cbs220-office")
get_interface_status(device_id="cbs220-office")
get_vlan_list(device_id="cbs220-office")
get_mac_address_table(device_id="cbs220-office")
get_running_config(device_id="cbs220-office")
get_interface_stats(device_id="cbs220-office")
```

Dry-run example:

```text
set_port_vlan({device_id:"cbs220-office", interface:"Gi1", vlan_id:20, dry_run:true})
```

The v0.1 CLI write path intentionally rejects real apply operations until commands are validated in a lab. Future apply calls must use `dry_run=false` and `confirmation="CONFIRM"`.

## Verification checklist

```powershell
python -m compileall -q src
```

Before production:

1. Test against a lab switch or simulator.
2. Verify Netmiko driver and command output for the exact firmware.
3. Add SNMP polling and parser fixture tests.
4. Align Catalyst Center/Meraki endpoints with official OpenAPI specs.
5. Use a secret manager and least-privilege accounts.
6. Apply TLS/certificate and network access policies.
7. Enable write operations only after code review and change approval.

## Evaluation questions

1. Show model and firmware for `cbs220-lab`.
2. Which ports on `cbs220-lab` are down?
3. List configured VLANs.
4. Find MAC `0011.2233.4455`.
5. Retrieve the running config.
6. Find the interface with the most input errors.
7. Query the Catalyst Center device inventory.
8. Show interface status from Catalyst Center.
9. Query VLANs from Meraki.
10. Preview changing `Gi1/0/10` to VLAN 20 without applying it.

## Security

Do not commit `.env`, `inventory.yaml`, API keys, passwords, production exports, or raw configs. Review audit logs for sensitive data before forwarding them to an LLM. Use lab devices for all write testing.