How do I use MistMind MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MistMind MCP Server List all devices in my Mist organization" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

MistMind MCP Server

Code Mode MCP for the Juniper Mist API — 1,011 endpoints in ~800 tokens.

MistMind makes massive APIs accessible to LLMs without training data. Instead of hardcoding every endpoint, it gives the LLM:

A dynamic index of the API hierarchy (~800 tokens)
A hardened Deno sandbox to search & execute against the full OpenAPI spec
Zero pre-training on the API required

Why MistMind?

Traditional MCP servers face a brutal tradeoff:

Document everything → Token explosion, context limits
Document nothing → LLM can't discover what's available

MistMind solves this with progressive disclosure:

Initial: ~800 tokens for API hierarchy (scopes, categories, counts)
Search: LLM writes JS to explore the 84MB resolved spec
Execute: LLM chains API calls with full OpenAPI context

Architecture

┌─────────────────────────────────────────────────────────────┐
│  Claude Desktop / MCP Client                                │
│  ┌──────────────────────────────────────────────────────┐  │
│  │  LLM (Claude, GPT-4, etc.)                           │  │
│  │  • Sees: "Search API (1011 endpoints) + hierarchy"   │  │
│  │  • Writes: JS code to search/execute                 │  │
│  └──────────────────────────────────────────────────────┘  │
└──────────────────────┬──────────────────────────────────────┘
                       │ MCP Protocol (stdio)
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  MistMind MCP Server (Python)                               │
│  ┌─────────────────┐  ┌──────────────────────────────────┐ │
│  │  Spec Indexer   │  │  Deno Sandbox                    │ │
│  │  • Analyzes     │  │  • --deny-net (search mode)      │ │
│  │    OpenAPI      │  │  • --allow-net=api.mist.com      │ │
│  │  • Generates    │  │  • Rate limiting (30/min)        │ │
│  │    hierarchy    │  │  • Token isolation (IIFE)        │ │
│  │  • ~800 tokens  │  │  • Output scrubbing              │ │
│  └─────────────────┘  └──────────────────────────────────┘ │
└──────────────┬──────────────────────┬───────────────────────┘
               │                      │
               ▼                      ▼
    spec/mist.resolved.json    api.mist.com
         (84MB, local)         (REST API)

How It Works

1. Index Generation (Initialization)

from mistmind.spec_indexer import generate_index_from_file

index = generate_index_from_file("spec/mist.resolved.json")
# → ~800 token summary: scopes, categories, auth, pagination

The indexer auto-detects:

API Hierarchy: Path prefixes + tag patterns → scopes (Orgs, Sites, MSPs, etc.)
Auth Pattern: Finds /self or /me endpoints
Pagination: Detects limit, page, start, end params
Response Patterns: Array vs paginated vs single object

2. Search (Discovery)

LLM writes JavaScript to explore the spec:

async () => {
  const results = [];
  for (const [path, methods] of Object.entries(spec.paths)) {
    if (path.includes('/devices') && methods.get) {
      results.push({
        method: 'GET',
        path,
        summary: methods.get.summary,
        params: methods.get.parameters
      });
    }
  }
  return results;
}

Runs in hardened Deno sandbox with no network access — only reads the local spec file.

3. Execute (Action)

LLM chains API calls:

async () => {
  const self = await mist.request({path: '/api/v1/self'});
  const org_id = self.privileges[0].org_id;
  
  const devices = await mist.request({
    path: `/api/v1/orgs/${org_id}/inventory`
  });
  
  return {
    org_id,
    device_count: devices.length,
    devices: devices.map(d => ({name: d.name, model: d.model, type: d.type}))
  };
}

Quick Start

1. Prerequisites

Python 3.11+
Deno runtime
Mist API token

2. Install

git clone https://github.com/nagarjun226/mistmind.git
cd mistmind
python -m venv venv
source venv/bin/activate
pip install -e .

3. Configure

cp .env.example .env
# Edit .env with your Mist API token

4. Add to Claude Desktop

{
  "mcpServers": {
    "mistmind": {
      "command": "python",
      "args": ["-m", "mistmind"],
      "env": {
        "MIST_APITOKEN": "your-token-here",
        "MIST_HOST": "api.mist.com",
        "MISTMIND_API_MODE": "readonly"
      }
    }
  }
}

See claude_desktop_config.example.json for a full example.

Comparison: MistMind vs Traditional MCP

Aspect	Traditional MCP	MistMind
Initial tokens	~5,000-20,000	~800
API coverage	Partial (popular endpoints)	Complete (1,011 endpoints)
Round trips	1 (direct call)	2-3 (search → execute)
Maintenance	Manual sync with API	Auto-generates from spec
Private APIs	Requires training data	Works with any OpenAPI spec

Security

MistMind is built with defense-in-depth:

Deno sandbox isolation — Each execution is a fresh process
IIFE token closure — API token lives in closure scope, unreachable by user code
stdin token passing — Token never written to disk or source files
Network allowlist — Execute mode only reaches api.mist.com
API mode enforcement — readonly blocks all writes (server-side, not bypassable)
Rate limiting — 30 req/min, max 5 concurrent (configurable)
Output scrubbing — Token removed from all stdout/stderr/errors
Temp file hardening — 0o600 permissions, atomic writes

191 security tests including red team attack vectors: token exfiltration, sandbox escape, timing side-channels, DNS rebinding, Unicode normalization, regex DoS, and more. See docs/security/ for audit reports.

The "Private API" Proof

The spec indexer has zero Mist-specific knowledge. It works on any OpenAPI 3.x spec.

Proof: The obfuscation test (tests/test_obfuscation.py) renames all Mist-specific terms:

orgs → entities, sites → locations, devices → nodes

MistMind still discovers and searches correctly. This proves it works on private/unknown APIs without training data.

Configuration

Variable	Description	Default
`MIST_APITOKEN`	Mist API token	(required)
`MIST_HOST`	Mist API host	`api.mist.com`
`MISTMIND_API_MODE`	`readonly` / `readwrite` / `all`	`readonly`
`MISTMIND_RATE_LIMIT`	Requests per minute (0=unlimited)	`30`
`MISTMIND_MAX_CONCURRENT`	Max parallel sandbox processes	`5`
`MISTMIND_SPEC_PATH`	Custom OpenAPI spec path	`spec/mist.resolved.json`

Development

source venv/bin/activate
python -m pytest tests/ -v --cov     # Run tests with coverage
ruff check src/ tests/               # Lint
ruff format src/ tests/              # Format

Project Structure

mistmind/
├── src/mistmind/          # Source code
│   ├── __main__.py        # CLI entry point
│   ├── config.py          # Pydantic settings
│   ├── sandbox.py         # Deno sandbox (search + execute)
│   ├── server.py          # MCP server handlers
│   ├── spec_indexer.py    # OpenAPI → ~800 token index
│   └── spec_resolver.py   # $ref resolver
├── tests/                 # 191 tests (86% coverage)
├── spec/                  # OpenAPI spec + resolver
├── docs/                  # Architecture, benchmarks, security audits
├── pyproject.toml
└── README.md

License

MIT

Credits

Built by Nagarjun Srinivasan. Inspired by the Code Mode MCP pattern for progressive API disclosure.

MistMind MCP Server

MistMind MCP Server

Why MistMind?

Architecture

How It Works

1. Index Generation (Initialization)

2. Search (Discovery)

3. Execute (Action)

Quick Start

1. Prerequisites

2. Install

3. Configure

4. Add to Claude Desktop

Comparison: MistMind vs Traditional MCP

Security

The "Private API" Proof

Configuration

Development

Project Structure

License

Credits

Resources

Looking for Admin?

Latest Blog Posts

MCP directory API