hpe-networking-mcp — HPE Networking MCP toolkit

Low-token Model Context Protocol tooling for HPE Aruba Central, HPE GreenLake Platform, embedded docs/API lookup, and optional ClearPass, Mist, Apstra, ArubaOS 8, EdgeConnect, UXI, and Axis backends. This page is a task-based front door for three audiences: people trying MCP for the first time, Aruba network operators, and hpe-networking-mcp developers.

hpe-networking-mcp banner showing 6,144 generated operations, 6,715 backend tools, 3 minimal router tools, and nine platform surfaces with embedded RAG

Whatever backend does the work, an MCP client sees only three router tools under the recommended minimal profile — the banner’s “3 minimal router tools” figure is the number that matters most for context budget.

Who it’s for

First-time MCP users

New to hpe-networking-mcp or to MCP itself. Start with the five-minute credential-free quickstart below, then Getting started for credentials and a real MCP client connection.

Aruba network operators

Already run Aruba Central or GreenLake Platform day to day. Jump to Example prompts for ready-made call patterns, or the typed product workflow roadmap for ClearPass, Mist, Apstra, AOS8, EdgeConnect, and UXI tasks.

hpe-networking-mcp developers

Extending a backend, adding a tool, or reviewing the router internals. Start with System overview and Tool router.

Five-minute credential-free quickstart

You can verify the install, build the router catalog, and start the MCP HTTP server before adding any Aruba Central or GreenLake Platform credentials. API-backed tools need credentials later, but this path is safe to try first with fake or no account details at all.

Six steps from cloning hpe-networking-mcp through setup, doctor checks, MCP connection, tool discovery, and a safe read-only call
The same six steps — clone, run the wizard, check the doctor, connect, discover, and call safely — are the checkpoints below.
1

Clone hpe-networking-mcp.

git clone https://github.com/secure-ssid/hpe-networking-mcp.git
cd hpe-networking-mcp

Expected outcome: a local hpe-networking-mcp/ working copy with no network calls beyond the clone itself.

2

Run the wizard without credentials.

python3 scripts/setup_wizard.py --yes --skip-credentials

Expected outcome: dependencies install, local git-ignored config files are created, and the wizard reports each completed phase without contacting Central or GLP.

3

Check the doctor.

uv run hpe-mcp-doctor

Expected outcome: a non-mutating local report — dependencies, config paths, and index status each print OK or a specific fix, with no vendor API calls.

4

Connect over streamable HTTP.

MCP_PORT=8010 bash scripts/run_http_router.sh

Expected outcome: a Uvicorn running on http://127.0.0.1:8010 line. Point any MCP-capable client at http://127.0.0.1:8010/mcp.

5

Discover a tool.

find_tool("ask Aruba docs with citations")

Expected outcome: a compact match list that includes ask_docs, which only reaches the local embedded RAG index — no credentials required.

6

Call it safely.

invoke_read_tool("ask_docs", {"question": "WPA3 SAE transition mode", "top_k": 5})

Expected outcome: a short, cited answer from the embedded docs index. invoke_read_tool refuses any tool that is not annotated read-only, so this step cannot reach a write path by accident.

For the full guided path with credentials, region selection, and optional products, see Getting started and MCP client recipes.

Write safety at a glance

Decision flow from find_tool through read, diagnostic, write, and destructive dispatch with dry-run, confirmation, and write gates
Discovery never touches a vendor API. Dispatch checks the tool's safety annotation before a read, diagnostic, write, or destructive call is allowed through.

READ DIAGNOSTIC WRITE DESTRUCTIVE

Every backend tool carries one of these annotations, and the router enforces them before dispatch:

Default-safe: invoke_read_tool only dispatches tools annotated READ. DIAGNOSTIC tools use invoke_tool, while writes follow HPE_MCP_ACCESS_PROFILE: safe-read-only, compatibility-preserving custom, or full-read-write.

Guarded writes: use dry_run=True first when the tool supports it. Real execution then requires the tool’s explicit confirmation mechanism: a confirm=True argument or MCP elicitation, depending on the schema.

invoke_tool is destructive: it is the only dispatcher that can reach WRITE and DESTRUCTIVE tools, so it is annotated destructive even for a read-only call. Use invoke_read_tool unless a write is intended.

See Tool router for the complete discovery/dispatch model and Optional product starters for the per-platform write-gating matrix.

Optional products

Enable only the product starters you want in the current session:

python3 scripts/setup_wizard.py --products clearpass,mist

Available starters:

Product Variables
ClearPass CLEARPASS_BASE_URL, CLEARPASS_API_TOKEN
Juniper Mist MIST_HOST, MIST_API_TOKEN
Apstra APSTRA_BASE_URL, preferred APSTRA_USERNAME/APSTRA_PASSWORD, optional APSTRA_API_TOKEN
ArubaOS 8 AOS8_BASE_URL, preferred AOS8_USERNAME/AOS8_PASSWORD, optional AOS8_API_TOKEN, optional AOS8_CLIENT_IP, optional AOS8_SESSION_TTL_SECONDS
EdgeConnect EDGECONNECT_BASE_URL, EDGECONNECT_API_TOKEN, optional EDGECONNECT_AUTH_HEADER, endpoint-specific EDGECONNECT_AI_SESSION_AUTHORIZATION
HPE Aruba UXI UXI_CLIENT_ID, UXI_CLIENT_SECRET, optional UXI_BASE_URL, optional UXI_TOKEN_URL
Axis Atmos Cloud AXIS_BASE_URL, AXIS_API_TOKEN
Network design diagrams (Draw.io / Graphviz / NeXt) none required; optional HPE_MCP_DIAGRAM_ICON_DIR

See the optional product matrix for the full setup and safety model. Use HPE_MCP_ACCESS_PROFILE=full-read-write for every loaded platform, or keep custom with HPE_MCP_PRODUCT_ACCESS=read-write / a narrower HPE_MCP_<PLATFORM>_WRITES=1 override.

Project snapshot

Area Current snapshot
Tool catalog 6,144 generated operations (6,127 active) / 588 curated / 6,715 backend tools / 6,722 direct-all
Capability totals (platform APIs) 3,152 read, 165 diagnostic, 2,544 write, 842 destructive
RAG 96,256 prose chunks in LanceDB
Structured lookup 4,106 endpoints, 8,890 schemas, 50,675 fields, 104 advisories, 346 lifecycle records
API provenance Aruba ReadMe registries, official Mist/Apstra sources, pinned GLP and EdgeConnect snapshots, SHA-pinned Axis generator
Optional platforms ClearPass, Mist, Apstra, AOS8, EdgeConnect, UXI, Axis Atmos Cloud
Safety Per-platform gates, dry-run writes, confirmation, HTTP host/origin and bearer controls, credential-gated live-test config, versioned/redacted artifact contracts
The low-token router searches 6,715 backend tools and 6,144 generated operations across nine HPE Networking, Juniper, and Axis platforms
Every platform is opt-in except Central, GLP, and RAG, which load by default under the minimal router profile.

Read the 0.8.0 release notes for the clean repository and package rename, MCP 2 transport repair, PII protection, interop tools, GLP inventory completion, strict catalog/RAG facts, and classified drift gates. See the capability gap matrix for reproducible executable-tool, generated-operation, benchmark, and practical-gap comparisons.

Task-oriented guides

Set up and connect

Goal Guide
Install, configure credentials, and connect an MCP client Getting started
Copy/paste stdio or streamable HTTP client config MCP client recipes
Understand the low-token router’s modes and safety model Tool router
Try realistic prompts with expected call shapes Example prompts
Enable ClearPass, Mist, Apstra, AOS8, EdgeConnect, UXI, or Axis Optional product starters
Plan typed product-specific workflows Typed product workflow roadmap
Fix setup, credentials, HTTP, or catalog issues Troubleshooting
Download or package prebuilt RAG/OpenAPI indexes Prebuilt RAG/OpenAPI indexes
Browse all backend counts and coverage Tool catalog
See architecture, data, and safety diagrams System overview
Review RAG/OpenAPI lookup design RAG architecture

Releases, provenance, and migration depth

Goal Guide
Review the 0.8.0 repository launch 0.8.0 release notes
Review the complete 0.7.0 expansion 0.7.0 release notes
Review Central v0.7 depth workflows (templates, bulk delete, firmware campaigns, config-health remediation, troubleshooting bundles) Central v0.7 workflows
Reuse v0.7 artifact schemas and credential-gated live-test config Artifact contracts and live-test configuration
Build, restore, and smoke-test release artifact bundles (SBOM, checksums, provenance) Release artifact automation
Understand security/lifecycle source freshness, provenance, and coverage boundaries Source lifecycle coverage
Review the AOS8 migration contract matrix and live evaluation Contract matrix, live/dry-run evaluation
Review the prior 0.6.0 expansion (historical) 0.6.0 release notes
Review the prior 0.5.0 AOS8 migration expansion (historical) 0.5.0 release notes
Review the prior 0.4.0 expansion (historical) 0.4.0 release notes
Review the prior 0.3.0 expansion (historical) 0.3.0 release notes

Continue

Search keywords

HPE Networking MCP server, HPE Aruba Networking MCP server, HPE Aruba Central MCP server, HPE Aruba Networking Central MCP server, Aruba Central AI tools, AI network automation, HPE GreenLake Platform MCP, GreenLake Platform automation, GreenLake Platform MCP, GreenLake service catalog MCP, GreenLake reporting status MCP, MCPServer network automation, Model Context Protocol networking, network configuration MCP, Aruba API RAG, Aruba Central OpenAPI lookup, ClearPass MCP, Juniper Mist MCP, Apstra MCP, ArubaOS 8 MCP, ArubaOS 8 migration MCP, ArubaOS 8 migration automation, AOS8 automation, Classic Central migration, New Central migration, guarded dry-run migration, HPE Aruba EdgeConnect MCP, EdgeConnect SD-WAN MCP, HPE Aruba UXI MCP, UXI sensor status MCP, Axis Atmos Cloud MCP, guarded read/write lab automation, EdgeConnect zones, EdgeConnect interface labels, zone-based firewall MCP, Python httpx network automation, EdgeConnect ACL object groups, EdgeConnect services, EdgeConnect bypass mode, EdgeConnect link integrity diagnostics, low-token MCP router.

Community and support

hpe-networking-mcp is an independent HPE Networking MCP toolkit. It is improved by watching the official MCP ecosystem and community work; thanks to these projects for useful patterns and references:

Disclaimer

hpe-networking-mcp is an independent community project. It is not an official HPE or HPE Aruba Networking product and is not endorsed by or supported by HPE.

License

MIT - see the repository license.