Allows interaction with Cisco network devices (IOS, NX-OS, XR) for configuration management, monitoring, and backup.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@nornir-mcp-server show interfaces on all Cisco devices"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An enterprise-ready Model Context Protocol (MCP) server that brings the power of Nornir to LLMs like Claude. It seamlessly integrates NAPALM for structured data retrieval and Netmiko for flexible CLI execution, enabling natural language orchestration of complex network infrastructure.
The Nornir MCP Server provides a specialized set of tools for network engineers and AI agents to interact with multi-vendor environments safely and efficiently.
Multi-Vendor Support: Standardized interaction for Cisco (IOS, NX-OS, XR), Arista (EOS), Juniper (Junos), and 100+ others.
Dual-Engine Architecture: Combines NAPALM's normalized getters with Netmiko's robust SSH command execution.
Intelligent Filtering: Schema-agnostic device selection by hostname, group, or platform.
Security First: Built-in command blacklisting, input validation (Pydantic), and backup path restrictions.
Per-Call Inventory Reloading: Every MCP tool invocation reloads config.yaml and inventory data from disk.
Production Ready: Comprehensive logging and asynchronous execution.
Related MCP server: Packet Tracer MCP
uv (Recommended)# Install as a global tool
uv tool install git+https://github.com/sydasif/nornir-mcp-server.git
# Upgrade to latest
uv tool upgrade nornir-mcp-serverpippip install git+https://github.com/sydasif/nornir-mcp-server.gitInitialize Configuration:
Create a config.yaml and basic inventory files in your working directory. See Minimal Inventory Example below.
Launch the Server:
nornir-mcp
Verify Inventory:
The server will look for config.yaml in the current directory to load your Nornir inventory.
To get started quickly, create these three files in your project root:
hosts.yaml
R1:
hostname: 192.168.1.1
platform: ios
groups:
- cisco_iosgroups.yaml
cisco_ios:
platform: ios
username: admin
password: passworddefaults.yaml
# Global defaults
data:
site: NYCconfig.yaml
inventory:
plugin: SimpleInventory
options:
host_file: "hosts.yaml"
group_file: "groups.yaml"
defaults_file: "defaults.yaml"For a ready-to-use Containerlab lab with Cisco CSR1000v and Arista cEOS devices, see the companion repository: nornir-mcp-lab
Prerequisites: Containerlab, Docker, Python 3.12+
The server exposes 5 tools categorized by operational intent. All tools support individual filter parameters for device selection.
Filter Parameters:
filter_name: Filter by device name in inventory
filter_hostname: Filter by specific hostname or IP address
filter_group: Filter by group membership (e.g., "cisco", "arista")
filter_platform: Filter by platform (e.g., "eos", "ios", "junos")
All filter parameters are optional. When multiple filters are provided, they are combined with AND logic.
Category | Tool | Description |
Inventory |
| List hosts, groups, and metadata. |
Monitoring |
| Generic access to any NAPALM getter (ARP, VLAN, etc.). |
| Execute arbitrary show commands safely. | |
Management |
| Deploy configuration changes with validation. |
| Securely save configurations to local disk. |
Every MCP tool call reloads config.yaml from the current working directory. The server does not cache a long-lived Nornir instance between requests.
config.yaml)inventory:
plugin: SimpleInventory
options:
host_file: "hosts.yaml"
group_file: "groups.yaml"
defaults_file: "defaults.yaml"
runner:
plugin: threaded
options:
num_workers: 100
logging:
enabled: true
level: INFOThe server includes a built-in security engine that validates all CLI commands against a multi-stage validation system before execution. This prevents accidental or malicious use of destructive commands while minimizing false positives for read-only operations.
Security Features:
Read-Only Enforcement: Tools like show_commands enforce an allowlist prefix (e.g., show, display, get, ping, traceroute).
Smart Denylist: Destructive keywords (erase, format, delete, reload) are blocked only when they appear as the first token of a command. This allows legitimate commands like show reload history while blocking a bare reload.
Chaining & Redirection Protection: Prevents the use of ;, &&, >, and < to ensure single-command integrity.
Path Sandboxing: Configuration backups are protected against directory traversal attacks (..).
Add the following to your claude config:
{
"mcpServers": {
"nornir": {
"command": "nornir-mcp"
}
}
}Add the following to your opencode config:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"nornir": {
"type": "local",
"command": ["nornir-mcp"]
}
}
}Try these prompts:
"Show me all core routers in the US-West region."
"Are there any BGP neighbors down on R1?"
"Backup the running configuration of all Arista switches."
"Check if there are any errors on the interfaces of the edge-group."
Command Validation: All CLI inputs pass through a multi-stage built-in denylist filter (Keywords and Patterns).
Path Sandboxing: Configuration backups are restricted to the defined root directory to prevent traversal.
# Clone and setup
git clone https://github.com/sydasif/nornir-mcp-server.git
cd nornir-mcp-server
uv sync
# Run tests
uv run pytest
# Lint and Format
uv run ruff check . --fix
uv run ruff format .If uv run is unstable in the local environment, use .venv/bin/pytest and .venv/bin/ruff directly.
Relevant internal paths:
src/nornir_mcp/services/runner.py: shared async task execution. Mandatory entry point for all network tasks; accepts filter kwargs (name, hostname, group, platform).
src/nornir_mcp/services/inventory.py: shared inventory loading and filtering helper. Reloads config.yaml from disk on every call. Accepts filter kwargs directly.
src/nornir_mcp/services/napalm.py: shared NAPALM getter execution helper used by monitoring and backup tools. Accepts filter kwargs directly.
src/nornir_mcp/tools/monitoring.py: monitoring tools for NAPALM getters and Netmiko show commands.
src/nornir_mcp/tools/management.py: management tools for configuration deployment and backups.
The repository includes a pytest suite under tests/ covering filters, inventory loading, inventory tools, monitoring tools, NAPALM helper behavior, security validation, runner error handling, and backup behavior.
# Run the full test suite
uv run pytest
# Fallback if uv run is unstable
.venv/bin/pytestThis project is licensed under the MIT License. See LICENSE for details.
Send configuration commands to network devices.
Args: commands: List of configuration commands filter_name: Filter by device name in inventory filter_hostname: Filter by specific hostname or IP filter_group: Filter by group membership filter_platform: Filter by platform (e.g., 'cisco_ios', 'arista_eos')
Returns: Dictionary with 'hosts' key mapping hostname -> task result (success or error).
| Name | Required | Description | Default |
|---|---|---|---|
| commands | Yes | Configuration commands to apply (e.g., ['int lo0', 'ip addr 10.0.0.1/24']) | |
| filter_name | No | Filter by device name in inventory | |
| filter_group | No | Filter by group membership | |
| filter_hostname | No | Filter by specific hostname or IP | |
| filter_platform | No | Filter by platform (e.g., 'cisco_ios', 'arista_eos') |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the description adds value by disclosing the return format (dict mapping hostname to success/error). It does not contradict annotations, and it provides a concrete behavioral detail beyond the schema and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, with a clear Args/Returns structure. The Args list is somewhat redundant with the schema, but the overall format is efficient and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists and the input schema covers all 5 parameters with descriptions, the description is complete enough for basic usage. It covers the main command and filter options, though it does not explain how multiple filters combine or mention potential non-deterministic behavior (openWorldHint).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description's Args section mostly repeats the schema's parameter descriptions. No additional semantic meaning is added beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Send configuration commands to network devices' with a specific verb and resource, clearly distinguishing it from read-only siblings like show_commands and backup_configs. The Args and Returns sections further clarify that this applies configuration changes and returns per-host results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for applying configuration commands versus alternatives like show_commands, but it does not explicitly state when to use this tool or when to prefer a sibling. No exclusions or alternative recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Save device configuration to the local disk.
Args: path: Directory path to save backup files filter_name: Filter by device name in inventory filter_hostname: Filter by specific hostname or IP filter_group: Filter by group membership filter_platform: Filter by platform (e.g., 'cisco_ios', 'arista_eos')
Returns: Summary of saved file paths.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory path to save backup files | ./backups |
| filter_name | No | Filter by device name in inventory | |
| filter_group | No | Filter by group membership | |
| filter_hostname | No | Filter by specific hostname or IP | |
| filter_platform | No | Filter by platform (e.g., 'cisco_ios', 'arista_eos') |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-destructive behavior (destructiveHint=false). The description adds that it writes to local disk and filters by inventory attributes, which is valuable context. Yet it does not clarify overwrite behavior, file naming, or whether authentication/network access is needed, so the disclosure is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with a front-loaded one-line purpose followed by a compact parameter list and return note. Every sentence earns its place, and there is no fluff or repetition of schema details beyond what is necessary for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema, annotations, and full parameter descriptions, the tool is well-specified for a straightforward backup operation. However, it does not explain how multiple filters combine (e.g., AND vs OR) or specify whether filters are case-sensitive, which could affect invocation. Still, the essential context is present, so it is slightly above minimum viability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, with each parameter already described clearly (e.g., filter_name as 'Filter by device name'). The description merely restates the parameter names and one example for filter_platform without adding new syntax, precedence, or combination semantics. Baseline 3 applies because the schema fully documents the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Save') with a clear resource ('device configuration') and destination ('local disk'). It distinguishes itself from sibling tools like apply_config, which pushes configurations rather than saving them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the tool is for backing up device configurations to local disk, which signals appropriate use cases. However, it does not explicitly mention when not to use it or contrast it with alternatives like fetch_data or show_commands, so it stops short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute one or more NAPALM getters to retrieve structured data from network devices.
Common available getters:
"facts": Basic device information (vendor, model, uptime).
"interfaces": Interface status, speed, and error statistics.
"interfaces_ip": IP address assignments per interface.
"bgp_neighbors": BGP session states and neighbors.
"config": Retrieve Running/Startup/Candidate configs.
Args: getters: List of NAPALM getter names (e.g., ['facts', 'interfaces']) getters_options: Optional getter-specific options filter_name: Filter by device name in inventory filter_hostname: Filter by specific hostname or IP filter_group: Filter by group membership filter_platform: Filter by platform (e.g., 'cisco_ios', 'arista_eos')
Returns: Structured data per host mapping hostname -> result
| Name | Required | Description | Default |
|---|---|---|---|
| getters | Yes | NAPALM getter names (e.g., ['facts', 'interfaces', 'bgp_neighbors']) | |
| filter_name | No | Filter by device name in inventory | |
| filter_group | No | Filter by group membership | |
| filter_hostname | No | Filter by specific hostname or IP | |
| filter_platform | No | Filter by platform (e.g., 'cisco_ios', 'arista_eos') | |
| getters_options | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds useful behavioral context by enumerating available getters and stating the return format ('Structured data per host mapping hostname -> result'). It does not disclose caveats like credential requirements or performance implications, but given the annotations, this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured: a one-sentence purpose, a bulleted list of common getters, a labeled Args section, and a Returns section. Everything earns its place, and the most important information is front-loaded. It is detailed yet not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, output schema present, read-only annotations), the description is largely complete: it explains what the getters return, lists parameters, and describes the output mapping. The only gap is the lack of detail on getters_options, but the presence of an output schema and annotations reduces the burden.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 83%, the baseline is 3. The description enhances parameter understanding by giving concrete examples of valid getter names (e.g., 'facts', 'interfaces') and noting that getters_options is optional, although it remains vague about its structure. This adds value beyond the schema's generic parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb-resource pair: 'Execute one or more NAPALM getters to retrieve structured data from network devices.' This strongly distinguishes it from siblings like apply_config (write) and list_devices (inventory listing). The list of common getters further clarifies its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states the tool's function and provides a list of common getters, which implies when to use it (e.g., when you need facts, interfaces, BGP state). However, it does not explicitly name alternatives or exclusions (e.g., 'use show_commands for raw CLI output'), so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List network devices and inventory information.
Consolidated tool that provides flexible access to inventory data including devices, groups, or both. Use 'details=true' for full device attributes.
Args: query_type: Type of inventory data to return ("devices", "groups", "all") details: Whether to return full inventory attributes (for devices query) filter_name: Filter by device name in inventory filter_hostname: Filter by specific hostname or IP filter_group: Filter by group membership filter_platform: Filter by platform (e.g., 'cisco_ios', 'arista_eos')
Returns: Dictionary containing inventory data based on query_type
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Whether to return full inventory attributes (for devices query) | |
| query_type | No | Type of inventory data to return ('devices', 'groups', 'all') | all |
| filter_name | No | Filter by device name in inventory | |
| filter_group | No | Filter by group membership | |
| filter_hostname | No | Filter by specific hostname or IP | |
| filter_platform | No | Filter by platform (e.g., 'cisco_ios', 'arista_eos') |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, and the description's 'List' verb is consistent with these. The description adds the ability to choose query_type and the details flag, plus a return type statement, but does not disclose additional behavioral traits such as pagination, error handling, or filter semantics. It is not contradictory, but could be richer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with a short intro, a consolidated note, and an Args/Returns section. However, the Args list repeats schema content, making it more verbose than necessary. It is not overly long, but not as concise as it could be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the read-only nature, six optional parameters, and the existence of an output schema, the description covers the core functionality, query modes, and filter options well. It explains the return type and the details flag, but lacks explicit guidance on when to prefer this over sibling tools or how filters interact. Overall, it is sufficiently complete for a listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters are already well-documented in the input schema. The description's Args list largely duplicates this information, adding no new meaning beyond examples like 'cisco_ios' and 'arista_eos' that already appear in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List network devices and inventory information' with a specific verb and resource, and further explains the consolidated access to devices, groups, or all. While it does not explicitly contrast with sibling tools, the purpose is unambiguous and matches the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives some usage context ('Consolidated tool', 'Use details=true for full device attributes') but does not explicitly state when to use this tool versus alternatives like show_commands or fetch_data. No exclusions or alternative tool references are provided, so guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute raw CLI show commands via SSH.
Args: commands: List of show commands to execute filter_name: Filter by device name in inventory filter_hostname: Filter by specific hostname or IP filter_group: Filter by group membership filter_platform: Filter by platform (e.g., 'cisco_ios', 'arista_eos')
Returns: Dictionary with 'hosts' key mapping hostname -> task result (success or error).
| Name | Required | Description | Default |
|---|---|---|---|
| commands | Yes | Show commands to execute (e.g., ['show version', 'show ip interface brief']) | |
| filter_name | No | Filter by device name in inventory | |
| filter_group | No | Filter by group membership | |
| filter_hostname | No | Filter by specific hostname or IP | |
| filter_platform | No | Filter by platform (e.g., 'cisco_ios', 'arista_eos') |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, lowering the burden. The description adds that execution happens via SSH and describes the return structure as a dictionary mapping hosts to success/error results, providing useful behavior beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with an Args section and a Returns section. Every sentence adds relevant information without redundancy, and the main purpose is front-loaded in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the moderate complexity (multiple filters, raw command execution), the description covers all necessary aspects: purpose, parameters, execution method, and return format. The output schema already provides structure, and the description fills in the behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the parameters, so the description need not repeat them. It adds no extra semantic detail beyond what the schema already provides, but the schema descriptions are sufficient. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes raw CLI show commands via SSH, combining a specific verb ('execute') with a concrete resource ('raw CLI show commands'). It distinguishes itself from siblings like apply_config (config changes) and backup_configs (backups) by emphasizing the read-only 'show' nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly establishes the intended context: raw CLI show commands over SSH. It does not explicitly mention when not to use it or name alternatives, but the 'show' scope and SSH method provide clear contextual guidance for when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
The tools are mostly distinct: list_devices handles inventory, apply_config pushes configs, backup_configs saves configs, while fetch_data and show_commands both retrieve device data but via different methods (structured NAPALM getters vs raw CLI). This slight overlap prevented a perfect score, but descriptions clarify the distinction.
All tool names follow a consistent verb_noun pattern (list_devices, apply_config, backup_configs, fetch_data, show_commands) using snake_case and imperative verbs. There are no naming deviations or mixed conventions.
The server provides 5 tools, which is well-scaled for a network automation MCP server. Each tool covers a core function—inventory, config push, backup, data collection, and CLI commands—without unnecessary bloat.
The tool surface covers the primary network operations: inventory access, configuration management (apply and backup), structured data retrieval, and raw command execution. Minor gaps exist (e.g., no explicit config comparison or device reboot), but most workflows can be accomplished via the existing tools, such as using fetch_data with the 'config' getter.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server connecting AI agents to non-custodial staking data across 130+ networks.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/sydasif/nornir-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
