NetBox MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Logging level for the server. | INFO |
| NETBOX_URL | Yes | The base URL of the NetBox instance, e.g. https://netbox.example.com | |
| SENTRY_DSN | No | Sentry DSN for error tracking and performance monitoring. Leave unset to disable Sentry. | |
| DRY_RUN_MODE | No | Set to true to make every write tool only simulate the change and never modify NetBox. | false |
| NETBOX_TOKEN | Yes | NetBox API token. v2 tokens (nbt_<key>.<token>, NetBox 4.5+) are sent as Bearer; legacy v1 tokens as Token. | |
| SSL_CERT_DIR | No | Path to a custom CA certificate directory. Takes precedence over OS trust store when set. | |
| DISABLED_TAGS | No | Comma-separated list of tool tags to disable, e.g. delete,graphql,branching. | |
| MCP_HTTP_HOST | No | Host to bind the HTTP server when using SSE or HTTP transport. | 127.0.0.1 |
| MCP_HTTP_PORT | No | Port to bind the HTTP server when using SSE or HTTP transport. | 8000 |
| MCP_TRANSPORT | No | MCP transport type: stdio, sse, or http. | stdio |
| NETBOX_BRANCH | No | Default branch name or schema ID used by every call; empty means main. Requires NETBOX_BRANCHING_ENABLED=true. | |
| SSL_CERT_FILE | No | Path to a custom CA certificate file. Takes precedence over OS trust store when set. | |
| NETBOX_TIMEOUT | No | Total time allowed for one NetBox request, retries included (seconds). | 30 |
| READ_ONLY_MODE | No | Set to true to hide all write tools (create, update, delete). | false |
| SENTRY_RELEASE | No | Sentry release version. Auto-detected from package if not set. | |
| NETBOX_VERIFY_SSL | No | Enable or disable SSL certificate verification for NetBox requests. | true |
| RESPONSE_MAX_SIZE | No | Maximum tool response size in bytes; larger responses are truncated. Empty means unlimited. | |
| RATE_LIMIT_ENABLED | No | Set to true to enable rate limiting. | false |
| SENTRY_ENABLE_LOGS | No | Enable log capture as Sentry breadcrumbs and events. | true |
| SENTRY_ENVIRONMENT | No | Sentry environment name, e.g. production or staging. | |
| TOOL_SEARCH_ENABLED | No | Set to true to replace full tool listings with search_tools + call_tool. | false |
| TOOL_SEARCH_STRATEGY | No | Search strategy: bm25 (natural language) or regex (pattern match). | bm25 |
| MCP_HTTP_BEARER_TOKEN | No | Optional bearer token for HTTP transport authentication. Leave empty for no auth. | |
| NETBOX_PLUGIN_DISCOVERY | No | Set to true to expose plugin models (e.g. netbox_dns.zone) via object type discovery. | false |
| RATE_LIMIT_MAX_REQUESTS | No | Maximum requests allowed per rate limit window. | 60 |
| SENTRY_SEND_DEFAULT_PII | No | Include personally identifiable information in Sentry events. | true |
| TOOL_SEARCH_MAX_RESULTS | No | Maximum number of tools returned by search_tools. | 5 |
| NETBOX_BRANCHING_ENABLED | No | Set to true to enable netbox-branching plugin support and branch tools/arguments. | false |
| SENTRY_PROFILE_LIFECYCLE | No | Sentry profiling lifecycle mode: all, continuation, or trace. | trace |
| RATE_LIMIT_WINDOW_MINUTES | No | Rate limit window size in minutes. | 1 |
| SENTRY_TRACES_SAMPLE_RATE | No | Sentry performance monitoring sample rate (0.0-1.0). | 1.0 |
| SENTRY_PROFILE_SESSION_SAMPLE_RATE | No | Sentry continuous profiling sample rate (0.0-1.0). | 1.0 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| netbox_list_object_typesA | List the NetBox object types these tools accept, with their API endpoints. Types are named 'app.model' (e.g. 'dcim.device'). Plugin types appear when the server runs with plugin discovery enabled. |
| netbox_get_objectsA | List NetBox objects of one type, with filtering and pagination. Returns 'results' plus 'total' (all matches) and 'has_more'/'next_offset'. Results are paginated - check 'has_more' before concluding. To count objects cheaply use fields=['id'] and limit=1 and read 'total'. Examples: netbox_get_objects('dcim.device', {'site_id': 3, 'status': 'active'}, fields=['id', 'name', 'primary_ip4']) netbox_get_objects('ipam.ipaddress', {'parent': '10.0.0.0/24'}, fields=['address', 'dns_name']) |
| netbox_get_objectC | Get one NetBox object by type and ID. |
| netbox_search_objectsA | Search several NetBox object types at once with NetBox's 'q' filter. Returns results keyed by object type. A '_meta' key appears when some types failed ('errors' - treat as unknown, NOT as "no match") or had more matches than 'limit' ('truncated' - the full count per type). |
| netbox_describe_object_typeA | Describe the writable fields of an object type: type, required, choices. Call this before creating or updating an object to build a valid payload. Foreign keys take the related object's numeric ID. |
| netbox_get_changelogsA | List change log entries (who changed what and when), newest first. Each entry has action (create/update/delete), user_name, time, changed_object_type/id and object_repr. Entries of one request share a request_id. Set include_data to see what exactly changed. |
| netbox_get_statusA | Get NetBox version, installed plugins and apps, worker status and the authenticated user. Also reports this server's read-only/dry-run modes. |
| netbox_graphql_queryA | Run a read-only GraphQL query against NetBox's /graphql/ endpoint. Use it to fetch nested data that would otherwise need many REST calls. Mutations and subscriptions are rejected. Always paginate large lists, e.g. device_list(pagination: {limit: 50}). |
| netbox_get_availableA | List free IPs, child prefixes, VLAN IDs or ASNs in a pool. Examples: free IPs in prefix 12 -> ('ipam.prefix', 12, 'ips'); free /24s in a prefix -> ('ipam.prefix', 12, 'prefixes'); free VLAN IDs in group 3 -> ('ipam.vlangroup', 3, 'vlans'). |
| netbox_trace_cableA | Trace cable paths from a port through patch panels and circuits. For an interface, console, power port/outlet or power feed: the path from it to the far end, one hop (near end, cable, far end) per segment. For a pass-through port (front/rear port, circuit termination): every cable path running through it, each as its list of nodes. |
| netbox_render_configA | Render the configuration of a device or VM from its assigned config template (NetBox config templates + config context). Changes nothing, but NetBox only allows it for API tokens with write enabled. |
| netbox_create_objectA | Create one NetBox object. Returns the created object. Look up related objects first (netbox_get_objects) and pass their IDs. |
| netbox_update_objectA | Update fields of one NetBox object (partial update). Returns the updated object. |
| netbox_bulk_create_objectsA | Create many objects of one type in a single transaction (all or nothing). Returns the IDs of the created objects. |
| netbox_bulk_update_objectsB | Update many objects of one type in a single transaction (all or nothing). |
| netbox_allocate_availableA | Allocate the next free IP, prefix, VLAN or ASN from a pool and create it. NetBox picks the value atomically, so concurrent callers never get the same one. |
| netbox_delete_objectA | Permanently delete one NetBox object. Dependent objects may be deleted with it (e.g. a device's interfaces). Confirm with the user first. |
| netbox_bulk_delete_objectsA | Permanently delete many objects of one type in a single transaction. Confirm with the user first. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 18 tools
Each tool has a fairly distinct purpose, and descriptions clarify boundaries well (e.g. netbox_get_objects filters one type while netbox_search_objects queries multiple types with the 'q' filter). Minor overlap exists between the several read paths (get_objects, search_objects, graphql_query) and between get_available vs allocate_available, but the docs disambiguate them adequately.
Every tool uses the same netbox_ prefix followed by a consistent verb_noun pattern (netbox_get_object(s), netbox_create_object, netbox_bulk_update_objects, netbox_delete_object). No mixing of conventions.
18 tools is on the heavier side but earns its place given NetBox's breadth: single + bulk CRUD, discovery, search, GraphQL, cable tracing, config rendering, and IPAM allocation. The set is well-scoped with little redundancy.
Full lifecycle coverage is present: read (get/list/search/graphql), create/update/delete singles, bulk variants of each, plus discovery (list/describe types, status), changelogs, pool inspection/allocation, cable tracing and config rendering. No obvious dead ends.