Labsco
MCP SERVER

Cisco ACI MCP Server

by jim-coyne ↗

Full CRUD on a Cisco ACI fabric through the APIC REST API — tenants, application profiles, EPGs, bridge domains, VRFs and contracts — plus fabric health and fault reads.

Network, Endpoint & Fleet Management
Summary
The delete tools are loaded by default — narrow the surface first.

This exposes the destructive half of the APIC object model, and the default tool mode already includes it. Two levers exist for that, and they are worth setting before the first connection: `ACI_TOOL_MODE` selects between the core set of 35 tools and the full 50+, and `aci-mcp-config.json` takes a whitelist so `enabledTools` can be cut to the reads and the one or two writes you actually want. `ACI_TENANT_FOCUS` narrows the blast radius further by pinning work to a single tenant.

What it is

An MCP server for configuring and managing Cisco ACI fabrics. It talks to the APIC controller's REST API and exposes the object model as tools, so the same objects you would click through in the APIC GUI — tenants down to filters — are addressable in a conversation.

What you get
  • Tenants, with the full lifecycle rather than reads alone — `list_tenants`, `get_tenant`, `create_tenant`, `update_tenant`, `delete_tenant`
  • Application profiles inside a tenant, same five operations — `list_application_profiles`, `get_application_profile`, `create_application_profile`, `update_application_profile`, `delete_application_profile`
  • Endpoint groups with statistics alongside the lifecycle calls — `list_endpoint_groups`, `get_endpoint_group`, `create_endpoint_group`, `update_endpoint_group`, `delete_endpoint_group`, `get_endpoint_group_stats`
  • Layer 2 bridge domains and VRFs — `list_bridge_domains`, `get_bridge_domain`, `create_bridge_domain`, `update_bridge_domain`, `delete_bridge_domain`, `list_vrfs`, `get_vrf`, `create_vrf`, `update_vrf`, `delete_vrf`
  • Security policy as contracts and filters — `list_contracts`, `get_contract`, `create_contract`, `update_contract`, `delete_contract`, `list_filters`, `create_filter`, `delete_filter`
  • Health and monitoring reads: overall fabric health, faults with a summary by severity, node inventory and per-node health, interfaces with their statistics, and APIC system information — `get_fabric_health`, `list_faults`, `get_fault_summary`, `list_nodes`, `get_node_health`, `list_interfaces`, `get_interface_stats`, `get_system_info`
Requirements

Access to a Cisco APIC controller and credentials for it. The controller URL goes in `ACI_APIC_URL`; from there you choose username and password (`ACI_USERNAME`, `ACI_PASSWORD`) or X.509 certificate authentication (`ACI_CERT_NAME` plus `ACI_PRIVATE_KEY_PATH`), which the README recommends for production. Node.js 18+ and npm; the package is `aci-mcp-server` (1.0.0 in package.json), built with `npm run build` and started with `npm start`.