# Cisco SD-WAN MCP Server [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/pcDamasceno/cisco-sdwan-mcp  
**GitHub Stars:** 1  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/cisco-sd-wan-mcp-server

## Description
MCP server for Cisco Catalyst SD-WAN (vManage): fabric inventory, device health, alarms, policies.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "cisco-sd-wan-mcp-server": {
    "command": "uvx",
    "args": ["cisco-sdwan-mcp"],
    "env": {
      "SDWAN_VMANAGE_URL": "",
      "SDWAN_VMANAGE_HOST": "",
      "SDWAN_VMANAGE_PORT": "",
      "SDWAN_USERNAME": "",
      "SDWAN_PASSWORD": ""
    }
  }
}
```

**Requires environment variables:** `SDWAN_VMANAGE_URL`, `SDWAN_VMANAGE_HOST`, `SDWAN_VMANAGE_PORT`, `SDWAN_USERNAME`, `SDWAN_PASSWORD` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Cisco SD-WAN MCP Server MCP server does

Cisco SD-WAN MCP Server MCP server gives an MCP client access to operational data from Cisco Catalyst SD-WAN Manager (vManage). It covers fabric inventory, device reachability, system status, control connections, BFD sessions, OMP peers, interfaces, alarms, events, tunnel quality, interface statistics, templates, policies, configuration groups, feature profiles, parcels, and running configuration.

The default operating mode is read-only. Configuration-changing operations are not registered unless write support is enabled, and enabled write calls still require explicit human confirmation before reaching vManage. This makes the default deployment suitable for investigation and reporting with a vManage account that has read-only privileges.

## How it works

The package is built with FastMCP and can expose MCP over HTTP or stdio. HTTP uses port 8000 and provides the MCP endpoint at `/mcp`; the default HTTP bind address is `0.0.0.0`. A health endpoint is available at `/healthz`.

Tools return selected fields rather than unfiltered vManage records. This keeps large fabric responses usable by language models, while `detailed=true` can request fuller results where supported. List operations include both `count` and `returned`, distinguishing the number of matching records from the number included in the response. Authentication, connectivity, invalid credentials, and unknown resources are returned as readable tool results instead of unhandled errors.

The server also provides four workflow prompts and three resources, although the supplied reference does not detail their individual names or contents.

## Setup and configuration

Cisco SD-WAN MCP Server MCP server requires Python 3.11 or newer and a reachable vManage controller with an account. It can be run from PyPI with `uvx cisco-sdwan-mcp` or installed with pip. A source checkout supports `uv sync --extra dev` or editable pip installation.

Set `SDWAN_VMANAGE_URL`, `SDWAN_USERNAME`, and `SDWAN_PASSWORD` before startup. `SDWAN_VMANAGE_HOST` with `SDWAN_VMANAGE_PORT` can be used instead of a full URL. The server reads `.env` from the repository root by default; `SDWAN_ENV_FILE` selects another file without overwriting variables already present in the environment.

Useful settings include `SDWAN_VERIFY_SSL`, `SDWAN_CA_BUNDLE`, `SDWAN_TIMEOUT`, `SDWAN_PAGE_SIZE`, and `SDWAN_ENABLE_WRITES`. Server behavior can be adjusted with `MCP_TRANSPORT`, `MCP_HOST`, `MCP_PORT`, `MCP_AUTH`, `MCP_SERVER_NAME`, and `LOG_LEVEL`. For private or self-signed controller certificates, a CA bundle is preferred; disabling verification is documented as a last resort for controlled labs.

## Tools and capabilities

The read-oriented tool groups include:

- Inventory and fabric summaries
- Device health and control-plane status
- Alarms and events
- Tunnel and interface performance
- Device templates, feature templates, and policies
- Configuration groups, feature profiles, parcels, variables, and running configuration

Optional write tools can attach device templates, activate vSmart policies, update parcels or CLI add-ons, deploy configuration groups, and check task status. They are exposed only when `SDWAN_ENABLE_WRITES=true` and remain subject to confirmation.

## Limitations and notes

The server depends on vManage reachability and valid credentials. The vManage account's permissions remain the primary access boundary. MCP client authentication is separate from the credentials used by the server to access vManage.

The default page size is 100 records per tool call, so callers should use returned counts when interpreting lists. HTTP deployments should also configure `MCP_AUTH` when clients must authenticate to the MCP server. Clients without MCP elicitation cannot silently perform enabled writes; a write call is refused unless an explicit confirmation path is supplied.

_Full upstream README: https://allmcps.com/mcp/cisco-sd-wan-mcp-server/readme_