Cisco Sdwan MCP Server
Cisco Catalyst SD-WAN Manager data for inventory, health, and policy insights in your LLM.
Data last scanned today · Reviewed today
Overview
Cisco Sdwan MCP Server provides a direct interface between AI models and Cisco Catalyst SD-WAN Manager (vManage). It processes fabric data to supply clear answers regarding device health, tunnel statistics, and alarm summaries, moving beyond theoretical responses to evidence-based network status reporting. Designed with safety in mind, the server defaults to a read-only state. Configuration-modifying tools remain unregistered unless explicitly enabled, and even then, every action requires explicit human confirmation before execution. The implementation uses FastMCP and includes specialized prompts and resources for managing inventory, control plane states, and template configurations.
Our verdict
This server carries a high risk level (33/100) and should be used with caution in sensitive production environments. The primary security concerns stem from it being a community-maintained project rather than an official Cisco release and the current lack of a verified audit for its authentication methods or read-only implementation. It is suitable for testing or development contexts, but users should carefully evaluate the implications of enabling optional write-access tools.
- Supports zero direct dependencies for a smaller attack surface
- Provides a read-only default mode for safer fabric inspection
- Requires human approval for all optional configuration-changing tools
- Lacks official vendor maintenance and support
- Has not yet undergone an editorial or security review
- Carries bus-factor risk due to single-contributor status
Tools
| Tool | Description | Risk |
|---|---|---|
| list_devices | Lists devices vManage is currently talking to. | low |
| get_device | Gets one device's full record. | low |
| get_fabric_summary | Returns device counts by type, reachability and version, plus every unreachable device. | low |
| list_inventory | Lists everything provisioned, including devices that never onboarded, have invalid certificates or carry no template. | low |
| check_device_health | Performs triage on a device covering system status, control connections and BFD, with a list of problems. | low |
| get_system_status | Gets device uptime, CPU, memory, disk, and last reboot reason. | low |
| get_control_connections | Gets connections to vSmart, vBond, and vManage. | low |
| get_bfd_sessions | Gets data-plane tunnels to other edges. | low |
| get_omp_peers | Gets OMP peering status. | low |
| get_interfaces | Gets interface status, addressing and error counters. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›Does this server support making changes to my SD-WAN environment?
The server is read-only by default. Configuration-changing tools are only registered if you explicitly enable them, and every such action requires manual human approval.
›What are the core prerequisites to run this server?
You need Python 3.11 or higher, the uv tool or pip for management, and a reachable Cisco Catalyst SD-WAN Manager (vManage) with a dedicated user account.
›How do I configure the server connection?
Copy the provided .env.example file to .env and define the SDWAN_VMANAGE_URL, SDWAN_USERNAME, and SDWAN_PASSWORD variables.
›Will the model be overwhelmed by the large amount of data from vManage?
No, responses are projected to only include relevant fields by default. You can append detailed=true to a tool call if you specifically need the full data record.
›How does the server handle errors during tool execution?
Failures like authentication errors, unreachable controllers, or unknown hostnames are returned as readable messages rather than raising exceptions, allowing the model to correct its input.
Badge
Maintain this server? Add the live badge to your README.