Tool catalog
hpe-networking-mcp registers 6,715 backend tools when every generated surface and
guarded write is enabled: 6,703 platform API tools across nine vendor
surfaces (Aruba Central, GreenLake Platform, ClearPass, Juniper Mist,
Apstra, ArubaOS 8, EdgeConnect, UXI, Axis Atmos Cloud) plus 7 credential-free
design-core diagram tools and 5 credential-free interop-core tools that
make no vendor API call at all. Direct-all router mode adds seven more
router-native tools (present only in direct mode, not part of the backend
registry itself) for 6,722 client-visible tools total. The recommended
minimal router exposes only find_tool, invoke_read_tool, and
invoke_tool, then searches the larger index on demand.
Every number in this section is derived, not hand-entered – see
docs/project-facts.json’s tools and router_modes
sections, regenerated by scripts/project_facts.py --write.
The nine committed generated manifests contain 6,144 operations (6,127
register as active generated tools; 17 are intentionally excluded — see below).
Adding 576 curated platform tools yields the 6,703 platform API backend
total. Capability totals across the platform API catalog are 3,152 read, 165
diagnostic, 2,544 write, and 842 destructive. See
docs/capability-gap-matrix.md for the full,
reproducible per-platform breakdown and the pinned benchmark comparison
(intentionally excludes design-core/interop-core, which have no vendor
API to benchmark against).
Generated manifests also drive parameter constraints. Compatible OpenAPI enums with up to 20 choices are published exactly; larger enums stay compact in tool schemas but are still enforced before dispatch with bounded errors. Contradictory vendor metadata is ignored in favor of the declared parameter type rather than breaking valid defaults.
Counts by backend
| Server | Read-only annotated | Registered total | Main coverage |
|---|---|---|---|
central-generated |
681 | 1,677 | New Central configuration APIs from merged official specifications |
central-config |
26 | 80 | SSIDs, VLANs, profiles, firmware, BGP, OSPF, VRF, HA, telemetry, application experience, checkpoint policy |
central-monitoring |
73 | 88 | Health, inventory, topology, BSSID mappings, applications, onboarding, AP tunnels, config health, notification rules, guarded Central GET, and reports |
central-nac |
15 | 38 | MAC registration, named MPSK, visitors, auth servers, auth server groups, AAA profiles and diagnostics |
central-ops |
2 | 41 | Troubleshooting, reboot, PoE/port bounce, cable tests, gateway iperf and ping sweep |
glp-core |
571 | 1,011 | Current devices, grouping, subscriptions, auto-subscription settings, users, Audit Logs v2beta1, workspaces, reporting, service catalog, RBAC role-assignment/scope-group lifecycle, identity user lifecycle, events/webhooks/deliveries, locations/tags, SCIM users/groups/membership, region-aware Compute Ops Management/Storage Fleet/Block Storage/Virtualization/Backup & Recovery/Data Services reads plus guarded VM power and run-protection-job-now writes, and read-only cross-resource reconciliation (105 curated + 906 active generated; HPE_MCP_GLP_GENERATED_TOOLS=1 to expand) |
rag-core |
11 | 11 | Docs, exact API, advisory, lifecycle lookup, and skills/runbooks |
clearpass-core |
285 | 845 | CPPM 6.12.7 APIs, Insight endpoint data, OnGuard activity, guarded writes |
mist-core |
547 | 1,080 | 1,050 official OpenAPI operations plus curated NAC, Marvis, inventory, Wired/WAN workflows, assurance snapshots, and bounded authenticated regional WebSocket diagnostic collection |
apstra-core |
86 | 155 | Official 6.1 SDK-derived blueprints, tasks, endpoint policies, object-policy workflows |
aos8-core |
132 | 311 | UIDARUBA/X-CSRF sessions, 258 generated config operations, normalized migration model and dependency planning, and six resumable migration-run tools |
edgeconnect-core |
687 | 1,270 | 1,216 generated operations plus fail-closed Swagger compatibility diagnostics and curated SD-WAN workflows |
uxi-core |
24 | 49 | Current 25-operation UXI API plus curated OAuth, inventory, groups, and assignments |
axis-core |
12 | 47 | Reviewed split create/update/delete Atmos operations from the deterministic SHA-pinned manifest generator |
| Platform API backend total | 3,152 | 6,703 | Vendor-facing tools only – see the note below |
design-core |
7 | 7 | Diagram/network-design tools (drawio, Graphviz, next-ui exports) – credential-free, no vendor API call |
interop-core |
5 | 5 | Central <-> Mist WLAN/site concept translation and bounded trend normalization – credential-free, always loaded |
| Complete backend total | 3,164 | 6,715 | Platform API total + design-core + interop-core |
design-core (opt-in via HPE_MCP_PRODUCTS=design) and interop-core
(always loaded) generate no vendor API traffic, so they sit outside the
platform-API benchmark comparison in
docs/capability-gap-matrix.md – but they are
real, registered, client-dispatchable backend tools, so they are still
counted toward release validation’s tool-catalog floor (a conservative
lower bound set at the platform-only total, checked against the complete
6,715-tool registered catalog) and are included in the complete
backend total (6,715) reported everywhere else in this repository
(docs/project-facts.json’s tools.registered_total,
docs/release-indexes.md’s “Complete backend catalog”,
and the router-modes table below).
“Read-only annotated” excludes diagnostic operations that remain visible in optional read-only mode. Registered totals include guarded writes; write gates, dry-run defaults, and confirmation still apply.
Generated manifest counts
| Platform | Operations |
|---|---|
| Aruba Central | 1,677 |
| GreenLake Platform | 920 |
| Juniper Mist | 1,050 |
| ClearPass | 816 |
| ArubaOS 8 | 258 |
| EdgeConnect | 1,216 |
| HPE Aruba UXI | 25 |
| Juniper Apstra | 135 |
| Axis Atmos Cloud | 47 |
| Total | 6,144 |
GLP registers 906 generated operations because 14 sunset device/subscription
operations remain in the provenance manifest but are intentionally suppressed
at runtime. ClearPass registers 815 generated operations because /oauth
returns credentials and is excluded from model-visible tools. Apstra excludes
its two login operations because session credentials are injected internally.
17 operations total are excluded this way, so 6,127 of the 6,144 manifest
operations register as active generated tools.
Router modes
| Mode | Client-visible tools | Use |
|---|---|---|
minimal |
3 | Recommended low-token discovery and dispatch |
default |
18 | Router convenience wrappers (list_sites, ask_docs, plan_tool_workflow, etc.) |
direct + HPE_MCP_TOOLSETS=all |
6,722 | Full schema introspection and debugging |
The default count (18) is measured identically whether every toolset is
loaded or only the documented recommended client profile
(HPE_MCP_ROUTER_MODE=default, HPE_MCP_TOOLSETS=central,glp,rag) is –
default mode’s wrapper set depends only on central-monitoring/rag-core
being loaded, which both scenarios satisfy. docs/project-facts.json’s
router_modes.tools.default_recommended_profile tracks this specific,
documented-profile measurement separately from the “every toolset” scenario
so the two are never assumed to match without being independently checked.
direct mode’s 6,722 = the complete 6,715 backend total + 7 router-native
tools that have no backend-identity equivalent at all (find_tool,
invoke_read_tool, invoke_tool, invoke_read_tool_batch,
plan_tool_workflow, plan_reconciliation_schedule,
evaluate_compliance_policy). The other 11 default-mode wrapper names
(list_scopes, get_global_scope_id, list_sites, list_devices,
find_device, find_client, ask_docs, search_docs, list_skills,
load_skill, lookup_api) intentionally reuse the name of a real backend
tool, so they don’t add to the total in direct mode – the router’s compact
forwarding signature simply wins over the backend’s registration for that
name. See docs/project-facts.json’s router_modes
section for the exact, regenerable derivation.
HPE_MCP_ROUTER_MODE=minimal
HPE_MCP_TOOLSETS=central,glp,rag
For full direct introspection:
HPE_MCP_ROUTER_MODE=direct
HPE_MCP_TOOLSETS=all
HPE_MCP_ACCESS_PROFILE=full-read-write
HPE_MCP_PRODUCT_ACCESS=read-write
HPE_MCP_CENTRAL_GENERATED_TOOLS=1
HPE_MCP_GLP_GENERATED_TOOLS=1
HPE_MCP_AOS8_GENERATED_TOOLS=1
HPE_MCP_EDGECONNECT_GENERATED_TOOLS=1
HPE_MCP_APSTRA_GENERATED_TOOLS=1
HPE_MCP_MIST_GENERATED_TOOLS=1
HPE_MCP_CLEARPASS_GENERATED_TOOLS=1
HPE_MCP_UXI_GENERATED_TOOLS=1
HPE_MCP_GLP_V2BETA1_WRITES=1
HPE_MCP_TOOLSETS=all alone loads every core, generated, always-on, and
optional-product backend – do not also set HPE_MCP_PRODUCTS=all;
HPE_MCP_PRODUCTS only accepts specific product names
(clearpass,mist,apstra,aos8,edgeconnect,uxi,axis,design) or is omitted
entirely, never the literal value all. Setting HPE_MCP_PRODUCTS=all
raises InvalidRuntimeConfigError at startup.
Build and validate the catalog
uv run python scripts/ingest_tools.py
uv run python scripts/ingest_tools.py --complete-catalog
uv run python scripts/check_generated_tool_manifests.py
uv run python scripts/report_capability_gaps.py --check
Optional product writes are hidden and blocked under safe-read-only and under
the default optional-product settings in custom. Generated writes remain
platform-gated and preview-first. invoke_tool remains annotated destructive
because it can dispatch any enabled write-capable backend.