hpe-networking-mcp 0.8.0
Released 2026-08-12.
Version 0.8.0 launches secure-ssid/hpe-networking-mcp as the clean, product-neutral successor to secure-ssid/centralmcp. The legacy repository and its history remain untouched as a rollback and reference point. The new repository uses an installable src/hpe_networking_mcp/ package, hpe-mcp-* commands, HPE_MCP_* project configuration, and product-specific MCP server IDs.
This is a breaking pre-1.0 rename. Follow MIGRATION.md when moving an existing checkout or MCP client configuration.
Highlights
MCP 2 transport and runtime
- Uses the MCP Python SDK 2.x
MCPServerAPI. - Repairs streamable HTTP and bearer-protected HTTP startup by passing host, port, and transport-security settings through supported APIs.
- Preserves the Starlette lifespan/session-manager context when static bearer authentication is enabled.
- Covers health, initialize, tools/list, tools/call, bearer rejection, and authenticated round trips with real protocol tests.
- Rejects unknown toolsets, products, RAG backends, unsafe HTTP wildcard configuration, malformed infrastructure URLs, and invalid credential structures with explicit errors.
Low-token router and complete catalog
Canonical facts are generated by scripts/project_facts.py and tracked in project-facts.json:
| Surface | Tools |
|---|---|
| Minimal router | 3 |
| Recommended default profile | 18 |
| Platform API backends | 6,703 |
| Complete registered backend catalog | 6,715 |
| Direct-all client-visible surface | 6,722 |
The complete catalog comprises 6,703 platform API tools, 7 credential-free design-core tools, and 5 credential-free interop-core tools. Direct-all adds seven router-native tools whose names do not duplicate backend identities.
Privacy, elicitation, and interoperability
- Adds opt-in reversible PII tokenization around unified-router dispatch.
- Retains capability annotations, write confirmation/elicitation, and the skills/runbook execution model.
- Adds
interop-corewith Central-to-Mist and Mist-to-Central WLAN/site translation plus bounded vendor-neutral trend normalization. - Adds
HPE_MCP_ACCESS_PROFILEwithsafe-read-only, compatibility-preservingcustom, andfull-read-writemodes across router, direct, stdio, HTTP, and standalone backend execution. - Full read/write mode keeps write-capable dispatch explicitly destructive and preserves dry-run, confirmation, elicitation, and dedicated rollback guards.
GLP Reporting and Service Catalog
- Reconciles all 105 curated GLP tools with their inventory buckets.
- Includes GreenLake Reporting and Service Catalog coverage.
- Keeps the 920 generated GLP operations available behind the generated-tool gate.
- Labels community-derived GLP specifications separately from HPE-authoritative sources.
RAG and exact API lookup
The validated local release snapshot contains:
| Artifact content | Count |
|---|---|
| Prose chunks | 96,256 |
| Declared sources | 16 |
| Exact endpoints | 4,106 |
| Schemas | 8,890 |
| Fields | 50,675 |
| Security advisories | 104 |
| Lifecycle records | 346 |
| Generated manifest operations | 6,144 |
Evaluation results are source_hit@k=0.97, MRR=0.923, and 1.0 for how-to recall, exact API lookup, structured exact lookup, and structured-list lookup.
No upstream API or documentation source was refreshed while preparing 0.8.0. The index manifest records source_refresh_performed: false and preserves the actual modification time and content hash for each local artifact.
Drift and refresh safety
- Classifies content drift, source additions/removals, pointer movement, stale pins, unavailable networks, parser failures, and known coverage gaps independently.
- Runs scheduled checks as separate jobs with JSON artifacts and an aggregate summary.
- Makes refresh planning declarative over the source manifest, including pre-discovery and post-scrape phases.
- Treats expected classified drift as actionable, but refuses to plan from incomplete, malformed, or unavailable checks unless the operator explicitly permits a partial check.
- Snapshots and rolls back docs, tools, exact API data, generated manifests, and local index manifests when any refresh or evaluation step fails.
Dependency snapshot
The 0.8.0 lock refresh includes MCP 2.0.0, LanceDB 0.37.1, FastEmbed 0.8.0, Playwright 1.62.0, Redis 8.1.0, pypdf 6.15.0, pytest 9.1.1, and Ruff 0.16.2. LanceDB full-text index creation now uses the current FTS index API.
Validation
The release baseline completed:
- 3,816 unit tests passed and 4 were skipped.
- 6,144 generated operations validated.
- All 6,715 registered backend identities matched the tool index exactly.
- Strict RAG/API evaluation and local source/index manifest reconciliation passed.
- The targeted changed-file lint set passed.
The source-manifest validator reports ten documented warnings for intentionally structured-only or not-yet-ingested source families; it reports zero failures.
Known boundaries
- The Mist OpenAPI pin remains intentionally stale/review-needed and was not advanced without review.
- Generated GLP specifications remain community-derived until official HPE registry coverage is available.
- RAG-first behavior is advisory and guarded through prompts, discovery, diagnostics, and tests; direct MCP clients are not protocol-forced through a discovery token.
- Credentials,
.env, generated indexes, runtime outputs, and private vendor icon packs are not committed.
See the compact changelog and prebuilt index guide for release assets and restore instructions.