Capability gap matrix
This report compares callable MCP capabilities on an apples-to-apples basis. Executable tools, generated/spec operations, indexed documentation endpoints, and client-visible router tools are different units and must not be added together or treated as equivalent coverage.
Official vendor APIs, SDKs, and target-instance specifications are the authority for behavior. The pinned nowireless4u/hpe-networking-mcp data is a useful MIT-licensed benchmark, not an API authority.
scripts/check_nowireless_source_drift.py checks whether the GLP vendored-spec, Axis platform-source, and capability-benchmark path pins referenced here have advanced past their reviewed commit; drift means review the changed path(s) upstream and regenerate with scripts/generate_glp_tools.py, scripts/generate_axis_manifest.py, or this script (updating docs/capability-benchmark-snapshot.json) before advancing the pin.
hpe-networking-mcp executable catalog
Counts below describe the full read-write registration of the platform API backends only – the nine vendor surfaces plus RAG. The two credential-free local backends (design-core, interop-core) make no vendor API call and are excluded here, so this page’s total is the platform API backend total, not the complete registered backend total; see docs/tool-catalog.md for both. Optional products remain opt-in, and optional write tools are hidden in read-only mode.
| Platform | Manifest operations | Active generated tools | Curated tools | Executable total | Read | Diagnostic | Write | Destructive | Source / provenance |
|---|---|---|---|---|---|---|---|---|---|
| Aruba Central | 1,677 | 1,677 | 249 | 1,926 | 799 | 31 | 816 | 280 | official OpenAPI + curated; Official HPE APIs; OAuth token manager ready |
| GreenLake Platform | 921 | 907 | 107 | 1,014 | 573 | 0 | 353 | 88 | official OpenAPI + curated; Official HPE APIs; Workspace OAuth ready |
| RAG / API lookup | 0 | 0 | 16 | 16 | 16 | 0 | 0 | 0 | committed application code; Local indexes over cited sources; No platform auth |
| ClearPass | 816 | 815 | 30 | 845 | 285 | 0 | 412 | 148 | official OpenAPI + curated; Official HPE API; API credential ready |
| Juniper Mist | 1,050 | 1,050 | 30 | 1,080 | 547 | 9 | 405 | 119 | official OpenAPI + curated; Official Juniper OpenAPI; REST token/session ready |
| Juniper Apstra | 135 | 133 | 22 | 155 | 86 | 2 | 47 | 20 | official SDK-derived + curated; Official Juniper SDK; Login/token session ready |
| ArubaOS 8 | 258 | 258 | 53 | 311 | 132 | 2 | 114 | 63 | official OpenAPI + curated; Official HPE API; UIDARUBA/X-CSRF session ready |
| EdgeConnect | 1,216 | 1,216 | 54 | 1,270 | 687 | 121 | 359 | 103 | instance artifact + curated; Target Orchestrator Swagger; Token/session and doctor ready |
| HPE Aruba UXI | 25 | 25 | 24 | 49 | 24 | 0 | 16 | 9 | official OpenAPI + curated; Official HPE API; OAuth client credentials ready |
| Axis Atmos Cloud | 47 | 47 | 0 | 47 | 12 | 0 | 23 | 12 | reviewed benchmark-derived registry; Benchmark only; verify with Axis; Static bearer token ready |
| Total | 6,145 | 6,128 | 585 | 6,713 | 3,161 | 165 | 2,545 | 842 |
The 6,145 manifest records are provenance-bearing generated operations. Only 6,128 register as executable generated tools because 17 are intentionally excluded. Adding 585 curated tools yields 6,713 executable platform API backend tools. The three minimal-router tools are a separate client-visible dispatch surface, not three additional backend capabilities.
In 2 of the rows above the curated count sits below the backend’s own registration on purpose: glp-core defines 108 curated tools of which 107 count here (glp_preflight), and rag-core defines 17 curated tools of which 16 count here (corpus_provenance). Those tools inspect local configuration, cache, or committed-corpus state, make no vendor API call, and describe the catalog rather than extending it, so counting them in a platform API benchmark would inflate it. The set is NON_API_LOCAL_TOOLS in src/hpe_networking_mcp/pipeline/project_facts.py; docs/tool-catalog.md lists them as their own rows.
Protocol-only capabilities
These capabilities are documented by RAG but are not REST/OpenAPI operations. They are tracked separately from manifest totals and map to curated transport/workflow tools when one exists.
| Platform | Family | Protocol | Subscription | Curated tool | Endpoints | Documentation sources |
|---|---|---|---|---|---|---|
| central | streaming | wss | Advanced | central_collect_streaming_events | /network-monitoring/v1alpha1/ap-events /network-services/v1alpha1/audit-trail-events /network-services/v1alpha1/geofence /network-services/v1alpha1/location /network-services/v1alpha1/rssi-events | developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-connection-management.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-cloudevents.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-event-ap-monitoring.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-event-audit-trail.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-event-geofence.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-event-location.md developer_docs/developer_arubanetworks_com_new-central_docs_streaming-api-event-location-analytics.md |
Intentional exclusions
| Platform | Count | Reason |
|---|---|---|
| GreenLake Platform | 14 | sunset GLP device/subscription version |
| ClearPass | 1 | credential-returning OAuth endpoint |
| Juniper Apstra | 2 | login handled by the internal session client |
The exclusions are read directly from the same operation predicates used by the runtime modules: 14 sunset GLP operations, ClearPass /oauth, and two Apstra login operations whose credentials are injected internally.
Pinned benchmark snapshot
Snapshot date: 2026-08-12. Repository: nowireless4u/hpe-networking-mcp@a1b2afa.
| Benchmark measure | Count | Meaning |
|---|---|---|
| Executable backend tools | 4,109 | Registered call targets reachable through its code/dynamic dispatch |
| Indexed endpoints | 5,960 | OpenAPI documentation rows built by scripts/build_spec_index.py; not tools |
| Default code-mode surface | 6 | Top-level execution/discovery tools |
| Dynamic-mode surface | 36 | 27 platform routers + 7 direct cross-platform tools + 2 skills tools |
Benchmark executable tools by platform
| Platform | Executable tools |
|---|---|
| Juniper Mist | 1,050 |
| Aruba Central | 669 |
| GreenLake Platform | 919 |
| ClearPass | 142 |
| Juniper Apstra | 19 |
| Axis Atmos Cloud | 25 |
| ArubaOS 8 | 48 |
| HPE Aruba UXI | 21 |
| EdgeConnect | 1,216 |
| Total | 4,109 |
The pinned README’s early comparison matrix contains a stale GreenLake cell (10). Its platform tree and startup examples state 919, and 919 is the value that makes the per-platform sum equal the stated 4,109 total. The snapshot records that reconciliation explicitly.
The pinned README’s 24-tool dynamic-mode claim is also stale and contradictory. The pinned implementation registers three router tools for each of nine platforms (27), seven direct cross-platform tools (health, two site aggregators, and four translation tools), and two skills tools, for 36 client-visible tools with all platforms configured.
The benchmark’s 5,960 endpoint count was reproduced from the pinned tree with its standard-library index builder: 81 specs, 39,576 responses, 17,836 parameters, 13,578 schemas, 63,111 fields, and 6 skipped inputs. The committed snapshot data contains the exact source URLs, command, and counts.
Why the headline totals are non-equivalent
- 6,713 platform API tools vs. 4,109 compares executable backend registries, but generation strategy and curated overlap differ; it does not prove practical superiority.
- 6,145 vs. 5,960 compares hpe-networking-mcp generated operation records with the benchmark’s documentation index. The latter includes endpoints that may have no callable tool, so this is not a tool-count comparison.
- Router/code/dynamic surfaces intentionally expose only discovery and dispatch tools. A smaller top-level surface can still reach a much larger backend.
- Capability quality depends on authentication, bounded responses, safe writes, async-result handling, and verified workflows—not raw endpoint quantity.
Ranked practical gaps
| Rank | Platform | Capability gap | Authoritative source | Auth readiness | User value | Recommended scope | Evidence |
|---|---|---|---|---|---|---|---|
| 1 | ArubaOS 8 | Broader verified migration mappings and live evaluation | Official AOS8 and Central APIs | Source and target auth clients are ready; six resumable migration tools ship | Very high | Preview/create/apply/get/list/verify migration-run tools now execute guarded New Central and Classic writes with dependency-aware resume, conflict policies, and bounded verification. The verified target mapping subset (VLANs, allow-all roles, RADIUS, simple AAA, open bridged/tunneled WLANs on New Central; open bridged WLAN on Classic) still needs broadening against live estates, plus AAA/auth-profile, server-group, and policy-rule target mappings beyond the verified subset, and end-to-end evaluation against real source exports. | docs/aos8-migration-contract-matrix.md, src/hpe_networking_mcp/pipeline/aos8_migration_orchestrator.py, src/hpe_networking_mcp/pipeline/aos8_target_adapters.py, src/hpe_networking_mcp/mcp_servers/aos8.py, docs/product-workflows.md |
| 2 | EdgeConnect | Real current 9.3+ Swagger acquisition and validation | Target Orchestrator’s instance Swagger | Token/session, fail-closed compatibility doctor, and --generate workflow ready | High | The compatibility/report/generation workflow correctly fails closed and requires an explicit --generate with a provenance digest pin, but a real current 9.3+ target Swagger has not yet been obtained. Acquire one from a live Orchestrator instance and run it through the compatibility doctor to validate and remap production coverage before treating the generated wrappers as production-ready against that release. | scripts/generate_edgeconnect_tools.py, src/hpe_networking_mcp/mcp_servers/openapi_gen/compatibility.py, docs/optional-products.md |
| 3 | Axis Atmos Cloud | Official or target-instance verification of the generator inputs | Axis documentation/API behavior required | Static bearer token ready; deterministic SHA-pinned 25-operation generator ships | Medium | scripts/generate_axis_manifest.py now builds the manifest deterministically from digest-pinned local sources, with explicit-fetch and offline-check modes, so the generator itself is reproducible. The underlying 25 operations are still a reviewed benchmark-derived registry, not an official Axis specification or a target-verified capture. Confirm against Axis-published documentation or a live Axis Atmos instance when access is available. | scripts/generate_axis_manifest.py, src/hpe_networking_mcp/mcp_servers/openapi_gen/manifests/axis.json, src/hpe_networking_mcp/mcp_servers/axis.py |
| 4 | Cross-platform | Broader live workflow evaluation | Official per-platform APIs and target instances | Guarded writes, dry-run confirmation, and gate metadata ready across platforms | Medium | The router’s discovery contract, guarded-write gate, and per-platform generated/curated coverage are in place and unit-tested, but most workflows are validated against fixtures and manifests rather than sustained live estates. Expand live, cross-platform evaluation (Central, GLP, AOS8 migration, Mist diagnostics, EdgeConnect, Axis) as lab/production access becomes available, and feed findings back into the verified-mapping and gap lists. | src/hpe_networking_mcp/mcp_servers/tool_router.py, src/hpe_networking_mcp/mcp_servers/shared.py, docs/product-workflows.md |
These are verified implementation gaps, not differences inferred only from the benchmark’s count. The original five 0.3 priorities (AOS8 migration execution, Mist WebSocket diagnostic collection, EdgeConnect Swagger import/compatibility, GreenLake typed workflows, and a reproducible Axis manifest generator) now ship; the gaps above describe what remains after that work — broader verified migration mappings and live evaluation, a real current EdgeConnect 9.3+ Swagger, official/target Axis verification, and broader live cross-platform workflow evaluation.
Reproduce and check drift
No network access is required:
python3 scripts/report_capability_gaps.py --write
python3 scripts/report_capability_gaps.py --check
The script parses committed MCPServer tool decorators, committed generated manifests, runtime-equivalent exclusion predicates, and the pinned benchmark JSON. --check exits non-zero if this file is stale.