nexterm-mcp

A deliberately bounded Model Context Protocol server for managing Nexterm through its supported REST API.

This community project is not affiliated with or endorsed by the Nexterm project.

Why this exists

Nexterm exposes a broad authenticated API. Agent workflows usually need a much smaller surface: inspect existing entries, folders and identity metadata, then create or update selected server entries without exposing credentials or arbitrary API access.

nexterm-mcp intentionally provides that smaller boundary:

• entry discovery and detail reads;

• folder and identity metadata discovery;

• bounded entry create, update and delete operations;

• API-key authentication from a private file;

• mutations disabled by default;

• defensive credential-field removal from API responses;

• no generic HTTP/request tool;

• no identity credential retrieval or identity mutation;

• no Nexterm API-key management.

The initial contract is tested against Nexterm v1.2.2-BETA API routes.

Related MCP server: MCP Dockerized Server

Tool surface

The last three tools fail closed unless mutations are enabled in the MCP server environment.

Requirements

• Python 3.12+

• Nexterm with API-key support (v1.2.2-BETA or a compatible newer release)

• An MCP client that supports stdio servers

Configuration

Example MCP registration:

{
  "mcpServers": {
    "nexterm": {
      "command": "nexterm-mcp",
      "env": {
        "NEXTERM_BASE_URL": "https://nexterm.example.com",
        "NEXTERM_API_KEY_FILE": "/run/secrets/nexterm-api-key",
        "NEXTERM_MUTATIONS_ENABLED": "false"
      }
    }
  }
}

Entry model

Create and update tools expose a stable subset of Nexterm's server-entry fields:

• name

• protocol: ssh, telnet, rdp, vnc, sftp, ftp, ftps

• ip

• port

• identity_ids

• folder_id

• organization_id

• monitoring_enabled

• icon

The MCP adapter translates these fields to Nexterm's API payload shape. It does not expose an arbitrary config object.

Development

python -m venv .venv
. .venv/bin/activate
pip install -e '.[test]'
pytest

Security

See SECURITY.md. In particular, keep mutation tools behind an administrative MCP policy boundary and treat the Nexterm API key as an administrative credential according to the permissions of its account.

License

MIT