hpe-networking-mcp — HPE Networking MCP toolkit

The banner tracks the current backend catalog: a large tool surface stays available on demand, while the MCP client itself only ever sees three router tools by default.

Low-token Model Context Protocol (MCP) server for HPE Networking automation: Aruba Central, HPE GreenLake Platform (GLP), ClearPass, Juniper Mist, Apstra, ArubaOS 8 migration automation, EdgeConnect, HPE Aruba UXI, and Axis Atmos Cloud.

MCP lets an AI client — Claude Code, Copilot, Cursor, VS Code, or any other MCP-capable host — call into a common toolbox instead of a bespoke plugin per vendor. hpe-networking-mcp is one such server: point any MCP client at it and it exposes a searchable catalog of HPE networking operations behind a small, low-token surface.

hpe-networking-mcp gives MCP-capable AI clients a low-token way to search Aruba/HPE docs, look up exact OpenAPI details, inspect Central health, run troubleshooting workflows, manage configuration, execute guarded ArubaOS 8 migrations, and use guarded GreenLake Platform operations. It is built around direct REST calls with httpx.

For the full visual walkthrough of this same information — audience picker, diagrams, and write-safety flow — see the hpe-networking-mcp GitHub Pages site. This README stays intentionally short; canonical guides live under docs/.

Why the router matters

Point your MCP client at one server: src/hpe_networking_mcp/mcp_servers/tool_router.py. The recommended minimal profile keeps the client-visible tool list at three entries while still reaching the full backend catalog:

1. find_tool — discover the right backend tool.

2. invoke_read_tool — dispatch read-only calls.

3. invoke_tool — dispatch intentional write/destructive calls only.

Who it's for

Five-minute credential-free quickstart

Verify the install and start the MCP HTTP server before adding any Aruba Central or GreenLake Platform credentials.

What each option gives you, before you pick:

Option A — pull the published image (no checkout): one docker run, credential-free, for a look at the tool surface. The command and what it does (and does not) include live in Docker deployment → Kicking the tyres.

For a real containerized deployment — credentials, optional products, write gates — start at Docker deployment; its four steps are git clone, python3 scripts/setup_wizard.py --docker, docker compose ... up -d mcp-router, curl .../livez.

Option B — build from source (adds the setup wizard, doctor diagnostics, and local index tooling):

git clone https://github.com/secure-ssid/hpe-networking-mcp.git
cd hpe-networking-mcp
python3 scripts/setup_wizard.py --yes --skip-credentials
uv run hpe-mcp-doctor
MCP_PORT=8010 bash scripts/run_http_router.sh

Expected outcomes:

• The wizard prints each completed phase and ends with a setup-complete summary; no Central/GLP calls are made. On Windows hosts, build and run from a shell with LF line endings (WSL2 or a configured checkout) — CRLF checkouts break the entry scripts inside Docker builds.

• doctor.py reports local dependency, config-path, and index checks — everything reads OK or lists what to fix, without calling any vendor API.

• The HTTP router prints a Uvicorn running on http://127.0.0.1:8010 line and keeps running in the foreground.

Connect any MCP-capable client to http://127.0.0.1:8010/mcp, then try a credential-free discovery call:

find_tool("list Aruba Central devices")

Expected outcome: ranked matches read straight from the local tool index the wizard just built, each annotated with its capability and write-gate state. No vendor API is contacted.

Connect it in your client

Point any MCP-capable client at http://127.0.0.1:8010/mcp (or a stdio hpe-mcp-router config) and it sees just the three router tools. Copy/paste configs for Claude, Copilot, VS Code, Cursor, and others live in MCP client recipes; the shipped examples are under examples/mcp-clients/.

Documentation search is a separate, local build

ask_docs and the rest of the RAG surface need a prose corpus that this project deliberately does not ship. That corpus is scraped vendor documentation, and republishing it is not ours to do — see ingestion/source_manifest.json, which has always said "Do not commit scraped content". Build it yourself, under your own acceptance of each vendor's terms:

uv run --extra ingestion python ingestion/ingest_docs.py

Budget for it. The crawl is measured in hours, and the first RAG query additionally downloads the ~250 MB nomic-embed-text-v1.5 embedding model into your Hugging Face cache. Credential-free is not the same as offline: the quickstart above needs no vendor credentials, but the corpus build and first query both need network access.

Write safety at a glance

• find_tool only searches the local tool catalog; it never calls a vendor API.

• invoke_read_tool blocks any backend tool that is not annotated read-only.

• invoke_tool is deliberately marked destructive because it can also dispatch write/destructive backend tools — use it only when a write is intended.

• Use dry_run=True first when supported; real execution then requires either confirm=True or MCP elicitation, depending on the tool schema.

• Writes are opt-in on every platform, Central included: under the default HPE_MCP_ACCESS_PROFILE=custom each platform's write gate stays closed until you set it. Use safe-read-only to block every write regardless of the per-platform gates, or full-read-write to enable ordinary writes on every loaded platform.

• Full read/write mode does not bypass dry-run, confirmation, elicitation, or dedicated safeguards such as the separate AOS8 rollback gate.

• Credentials stay in config/credentials.yaml or environment variables and are never committed.

Destructive operations (reboot_device, disconnect_client) are gated by the same flag as writes — there is no separate "operational" tier that bypasses it.

See Tool router for the complete discovery/dispatch/write-safety model.

Project snapshot

Full per-backend counts live in Tool catalog. The latest published (tagged) release is 0.8.0. 0.10.0 notes describe in-tree main; 0.9.0 is archived. See the capability gap matrix for reproducible tool/benchmark comparisons.

Task-oriented guides

Local setup essentials

The default MCP client profile stays lean:

HPE_MCP_ROUTER_MODE=minimal
HPE_MCP_TOOLSETS=central,glp,rag

Enable optional products only when needed:

HPE_MCP_ACCESS_PROFILE=custom
HPE_MCP_PRODUCTS=clearpass,mist,apstra,aos8,edgeconnect,uxi,axis,design
HPE_MCP_PRODUCT_ACCESS=read-only

See the optional product matrix for the full setup and safety model.

For a trusted, fully write-capable session, use python3 scripts/setup_wizard.py --access-profile full-read-write so all legacy gates are aligned, or use the self-contained examples/mcp-clients/stdio/full-read-write.mcp.json.

.claude/launch.json ships a matching minimal hpe-networking-mcp launch profile for daily use. find_tool omits full JSON schemas by default; request include_schema=true only when a client needs the full parameter shape.

Build or refresh the router tool index and the API-spec database. Both are derived from the OpenAPI specs committed to this repository, so they rebuild deterministically and need no scraping:

uv run python scripts/ingest_tools.py --products all

The RAG prose corpus is built separately by ingestion/ingest_docs.py, as described in the quickstart above. It is not distributed as a release asset.

See Getting started for credentials, region selection, optional-product env vars, and the full ingestion/refresh path.

Streamable HTTP mode

MCP_PORT=8010 bash scripts/run_http_router.sh

Then point any MCP-capable client at http://127.0.0.1:8010/mcp. The server also exposes /livez, /readyz, and /healthz. Non-loopback binds require explicit MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINS and can be protected with MCP_HTTP_BEARER_TOKEN. See MCP client recipes for copy/paste stdio and HTTP configs.

Project layout

src/hpe_networking_mcp/mcp_servers/     Low-token router + Central/GLP/RAG/optional-product servers
src/hpe_networking_mcp/pipeline/        httpx clients, 8-stage migration pipeline, SSID helpers
ingestion/       Docs/API scraping and LanceDB + SQLite index builders
docs/            Setup, router, architecture, product, and release guides
scripts/         Setup wizard, doctor wrapper, HTTP router helper, release validation
tests/           Unit, integration, and RAG eval coverage
config/          Credentials template; real credentials stay git-ignored
examples/        Tested, non-secret MCP client/prompt/runbook configuration examples
run_pipeline.py  Checkout wrapper for `hpe-mcp-run-pipeline`
run_ssid.py      Checkout wrapper for `hpe-mcp-run-ssid`

The full repository map, including generated/git-ignored paths, lives in System overview.

Validation

uv run pytest tests/unit -q
uv run python scripts/validate_release.py --catalog-products all --strict-tool-index --min-tools 6712

--min-tools 6712 is the platform API compatibility floor (the 6,712 vendor-facing platform API tools), not the complete registered backend total of 6,729, which also includes the protocol-only Central Streaming tool, the cross-platform site-health aggregator, the local GLP preflight diagnostic, and credential-free local tools — validation passes at or above the floor. See Tool catalog for both totals.

The release helper runs unit tests, optional RAG/API eval when indexes exist, tool catalog floor checks, and local tool-index freshness checks. Unit tests also include static guards for the active MCP/pipeline code, committed low-token MCP config examples, local-only config files, router product/toolset docs, bounded generic read-only GET tools, MCP list default bounds, RAG/search top_k bounds, public tool-count claims, tool-count docstrings, rendered RAG/index doc-fact claims, tracked Markdown local links and images, Pages sitemap and robots metadata, documented router example arguments, product workflow tool-name tables, and wizard optional-product env tables.

Related projects and thanks

hpe-networking-mcp is an independent HPE Networking MCP toolkit, improved by watching the official MCP ecosystem and community work:

• HewlettPackard/gl-mcp - official GreenLake Platform MCP server

• modelcontextprotocol/python-sdk - MCP Python SDK

• KarthikSKumar98/central-mcp-server - community Aruba Central MCP server

• nowireless4u/hpe-networking-mcp - unified HPE networking MCP reference

Disclaimer

hpe-networking-mcp is an independent community project. It is not an official HPE or HPE Aruba Networking product and is not endorsed by or supported by HPE.

License

MIT - see the repository license. Generated API metadata and upstream implementation references are documented in THIRD_PARTY_NOTICES.md.