hpe-networking-mcp 0.4.0 - resumable migration execution, typed GLP, and verified benchmarks

Version 0.4.0 turns the largest 0.3.0 planning/diagnostic surfaces into executable, guarded workflows: ArubaOS 8 migration runs now execute resumable, dependency-aware target writes; Juniper Mist device diagnostics gain bounded WebSocket result collection; EdgeConnect gets a fail-closed Swagger compatibility/report/generation workflow; GreenLake Platform (GLP) gains 22 high-frequency typed reads for RBAC, events/webhooks, locations/tags, and SCIM; and Axis Atmos Cloud gets a deterministic, SHA-pinned manifest generator. The router’s discovery contract and shared guarded-write execution contract are now explicit and reproducible, and a new capability gap matrix replaces informal comparisons with a pinned, apples-to-apples benchmark.

Catalog snapshot

Catalog	Tools	Intended use
Generated manifest operations	5,703	Reproducible platform API coverage across nine manifests
Active generated tools	5,686	Manifest operations that register as callable tools (17 intentionally excluded)
Curated tools	476	Hand-tuned, confirmed-working workflows
Complete backend index	6,162	Discovery/dispatch across every enabled backend (curated + active generated)
Direct-all router	6,165	Full schema introspection plus three router tools
Minimal router	3	Recommended low-token client surface (unchanged)

Capability totals across the complete backend index: 2,813 read, 164 diagnostic, 2,382 write, 803 destructive. See the capability gap matrix for the full, reproducible, per-platform breakdown and the pinned benchmark comparison against nowireless4u/hpe-networking-mcp@da9c834.

Router discovery and execution contract

find_tool now returns normalized routing and safety metadata for every result: platform, capability (read, diagnostic, write, or destructive), recommended_dispatcher, gate state, supports_dry_run, supports_confirm, requires_confirmation, and standard MCP annotation flags. Filter discovery with platform, exact server, or normalized capability. Write/destructive results — and router-dispatched write responses — carry the same compact execution_contract describing the exact gate to enable, dry-run state, confirmation requirement, idempotency, and next action. Diagnostic tools dispatch through invoke_tool because they are intentionally not annotated read-only. The minimal router remains three tools: find_tool, invoke_read_tool, and invoke_tool.

This same guarded-write contract now covers every optional product, including a dedicated HPE_MCP_AXIS_WRITES gate for Axis Atmos Cloud. Optional product writes stay fail-closed by default but remain available for intentional lab/read-write use with HPE_MCP_PRODUCT_ACCESS=read-write or a narrower per-platform override. See tool-router.md for the full contract shape.

Capability gap matrix and pinned benchmark

docs/capability-gap-matrix.md is generated by scripts/report_capability_gaps.py from committed FastMCP decorators, generated manifests, and a pinned benchmark snapshot — no network access required. It carefully distinguishes executable tools, generated/spec operations, indexed documentation endpoints, and client-visible router tools, which are different units that must not be summed or treated as equivalent coverage. It also reproduces and corrects two stale claims in the pinned benchmark’s own README (a stale GreenLake cell and a stale 24-tool dynamic-mode claim; the benchmark’s own tree implies 36 client-visible tools in that mode).

ArubaOS 8: expanded migration model and resumable execution

The AOS8 normalized migration model now covers AAA/auth profiles, server groups, RADIUS/LDAP/TACACS, IPv4/IPv6 routes, VRRP/VRRPv6, and detailed policy rules, with explicit dependency tracking, malformed-input warnings, unsupported-field preservation, deterministic ordering, and credential redaction throughout exports and plans.

Six new resumable migration-run tools execute guarded target writes instead of only planning them:

Tool	Purpose
aos8_preview_migration_run	Non-persisted preview of a migration run before creating it
aos8_create_migration_run	Create atomic, resumable migration-run state under state/aos8_migrations/
aos8_apply_migration_run	Apply a run’s candidates; dry-run first, confirmed writes second
aos8_get_migration_run	Bounded status, partial results, and retryability for one run
aos8_list_migration_runs	Bounded listing of persisted migration runs
aos8_verify_migration_run	Bounded, read-only identity/direct-field comparison of applied results

Migration runs are atomic per candidate, resume and retry in dependency order, accept target secrets only for the current attempt (never persisted to disk), and support conflict policies. Verified target adapters cover a New Central subset (VLANs, allow-all roles, RADIUS, simple AAA, and open bridged/tunneled WLANs) and a Classic Central subset (open bridged WLAN); unsupported objects remain unapplied rather than silently dropped. New Central rollback guidance is limited to its documented post-change checkpoint policy and automatic device rollback — there is no manual checkpoint listing or restore workflow, and this release does not claim one. Classic Central guidance remains export-before-apply.

GreenLake Platform: 22 high-frequency typed reads

Beyond the existing 62 curated and up to 904 active generated tools (918 in the provenance manifest; opt in with HPE_MCP_GLP_GENERATED_TOOLS=1, or automatically in direct router mode with the glp/all toolset), GLP gains 22 typed, bounded reads promoted from generic exploration:

• RBAC: list_glp_role_assignments, get_glp_role_assignment, list_glp_scope_groups, get_glp_scope_group, list_glp_scope_group_scopes
• Events/webhooks: list_glp_event_webhooks, get_glp_event_webhook, list_glp_event_subscriptions, list_glp_webhook_deliveries
• Locations/tags: list_glp_locations, get_glp_location, reverse_geocode_glp_location, list_glp_location_tags, get_glp_location_tags, list_glp_tags, list_glp_tag_resources
• SCIM: list_glp_scim_users, get_glp_scim_user, list_glp_scim_groups, get_glp_scim_group, list_glp_scim_group_users, list_glp_scim_user_groups

Juniper Mist: bounded WebSocket diagnostic collection

mist_collect_diagnostic_results connects to the documented regional WS /api-ws/v1/stream endpoint, subscribes to a site/device diagnostic channel, and returns only the events correlated to the requesting session_id. Collection is bounded by event count, byte size, and elapsed time, with explicit non-success results for timeout, unmatched/bound exhaustion, malformed streams, and premature closure. This adds a new websockets>=14.0 runtime dependency.

EdgeConnect: fail-closed Swagger compatibility workflow

scripts/generate_edgeconnect_tools.py now supports a local Swagger 2.0 / OpenAPI 3.0 / OpenAPI 3.1 (JSON or YAML) compatibility, report, and generation workflow. The compatibility check compares operations, methods, paths, auth declarations, API version, and base-path assumptions against the committed 1,216-operation baseline, and fails closed on malformed input, unsupported versions, stale baselines, digest mismatch, endpoint drift, unsupported auth, or non-root server base paths. The manifest is regenerated only with an explicit --generate flag, after which the tool updates a provenance/digest pin under src/hpe_networking_mcp/mcp_servers/openapi_gen/provenance/.

This release does not claim to have obtained or validated a real current EdgeConnect 9.3+ target Swagger. The committed manifest is still named for 9.7 but declares API 7.2.0 internally; production compatibility for a live 9.3+ Orchestrator still requires exporting that instance’s Swagger document and running it through this workflow.

Axis Atmos Cloud: deterministic manifest generator

scripts/generate_axis_manifest.py builds the 25-operation Axis manifest deterministically from digest-pinned local sources, with explicit-fetch and offline-check modes (--check, --source-dir, --fetch). The generator itself is now reproducible; the underlying 25 operations remain a reviewed benchmark-derived registry rather than an official Axis specification or a target-verified capture. scripts/check_generated_tool_manifests.py now verifies the committed Axis manifest against this generator automatically.

Generation and validation tooling

• scripts/check_generated_tool_manifests.py validates all nine manifests, including the Axis digest-pinned generator, in one pass.
• Dynamic capability totals throughout the docs and docs/tool-catalog.md are derived from the same generator/AST-based counting used by scripts/report_capability_gaps.py, not hand-maintained numbers.
• scripts/validate_release.py runs unit tests, the capability gap report --check, generated manifest checks, the tool catalog floor (--min-tools, now defaulting comparisons against the 6,162-tool complete catalog), and tool-index freshness.

Upgrade notes

1. Run uv sync (adds websockets>=14.0 for Mist diagnostic collection).
2. Rebuild the router catalog. Use the safe read-only default, or set HPE_MCP_PRODUCT_ACCESS=read-write plus HPE_MCP_GLP_GENERATED_TOOLS=1 to index all 6,162 backend tools.
3. Run uv run python scripts/check_generated_tool_manifests.py and uv run python scripts/report_capability_gaps.py --check to confirm the local checkout matches the committed manifests and capability report.
4. Review product-workflows.md for the new AOS8 migration-run, Mist diagnostic-collection, and GLP typed-read tool names.
5. Review optional-products.md before enabling AOS8, EdgeConnect, or Axis writes in a lab environment.

See the 0.3.0 release notes for prior platform parity, migration planning, and safety history.