Labsco
MCP SERVER

Nexus Dashboard

by beye91 ↗

Ask a Cisco Nexus Dashboard about fabrics, switches, VLANs and anomalies — read-only until an admin turns writing on.

Network, Endpoint & Fleet Management
Summary
Read-only is the default, and the audit log is not optional.

EDIT_MODE_ENABLED starts false, so a fresh install cannot change your fabric even if the model tries. Around that sits the part most single-binary servers skip: users and roles with admin, operator and viewer levels, Fernet-encrypted credential storage, and a complete audit trail with client IP that you can export as CSV. If several people are pointing assistants at the same network, that plumbing is the reason to pick this over a thin API wrapper.

What it is

A Nexus Dashboard server that exposes the platform's REST operations as MCP tools, fronted by a web management interface for users, roles, clusters and audit logs. It ships as a Docker Compose stack with PostgreSQL behind it.

What you get
  • Fabrics: `manage_listFabrics`, `manage_getFabricDetails`, `manage_createFabric`, `manage_updatefabricDetails`, `manage_deleteFabric`
  • Switches: `manage_listFabricSwitches`, `manage_getFabricSwitch`, `manage_getSwitchInterfacesOverview`, `manage_getSwitchConfigurationDiff`, plus actions like `manage_executeRediscoverSwitches` and `manage_executeSwitchConfigurationPreview`
  • Networks, VRFs and interfaces each get list, get, summary, create, replace and delete — `manage_listNetworks`, `manage_getVrf`, `manage_listInterfaces` and their siblings
  • `manage_listAnomalies` and the compliance rule tools cover anomalies and compliance; `manage_listTemplates` covers templates
  • Every GET is available in read-only mode; POST, PUT and DELETE require edit mode to be switched on
  • Coverage spans five Nexus Dashboard APIs — Manage, Analyze, Infrastructure, OneManage and Orchestration
Requirements

Docker 20.10+ with Docker Compose 2.0+, and a Cisco Nexus Dashboard 4.1+ with NDFC 12.x. Set CERT_SERVER_IP to your server's address, plus ENCRYPTION_KEY and SESSION_SECRET_KEY for production. Self-signed certificates are generated on first start. The stack listens on 7443 for the web UI, 8444 for the API and MCP SSE endpoint, and 15432 for PostgreSQL. Remote clients connect through mcp-remote at https://YOUR_SERVER_IP:8444/mcp/sse.

Setup effort

One command plus a key — docker compose up -d --build, then supply credentials