# Cisco Switch MCP

MCP server for **Cisco Catalyst 3650** and other **IOS-XE** switches. Connects via SSH using [Netmiko](https://github.com/ktbyers/netmiko).

## Prerequisites on the switch

1. **SSH enabled**: `ip domain-name local.lan` + `crypto key generate rsa` + `ip ssh version 2`
2. **User account** with privilege 15 (or enable password configured)
3. **Management IP** reachable from the Hermes LXC

## Install

```bash
/usr/local/lib/hermes-agent/venv/bin/pip install -e /root/cisco-switch-mcp
```

## Hermes config

Add to `~/.hermes/config.yaml`:

```yaml
mcp_servers:
  cisco-switch:
    command: /usr/local/lib/hermes-agent/venv/bin/cisco-switch-mcp
    timeout: 120
    enabled: true
    env:
      CISCO_SWITCH_HOST: "10.77.30.40"
      CISCO_SWITCH_USERNAME: "admin"
      CISCO_SWITCH_PASSWORD: "your_password"
      CISCO_SWITCH_DEVICE_TYPE: "cisco_xe"
      CISCO_SWITCH_ALLOW_WRITES: "false"
```

Or: `echo Y | hermes mcp add cisco-switch --command /usr/local/lib/hermes-agent/venv/bin/cisco-switch-mcp --env CISCO_SWITCH_HOST=...`

Restart dashboard/gateway and start a **new chat session**.

## Tools (40+)

| Category | Examples |
|----------|----------|
| System | version, inventory, CPU, memory, environment, stack status |
| Interfaces | status, descriptions, counters, port-channels |
| VLAN/STP | vlan brief, spanning-tree |
| L2 | MAC table, CDP/LLDP neighbors, ARP |
| Diagnostics | logging, ping, traceroute, running-config |
| Writes | shutdown port, set access VLAN, description, save config |

## Safety

- Writes disabled by default (`CISCO_SWITCH_ALLOW_WRITES=false`)
- Blocks `reload`, `write erase`, `format`
- Audit log at `CISCO_SWITCH_AUDIT_LOG_PATH`

## device_type

Catalyst 3650 runs IOS-XE. Use `cisco_xe` (default). If connection fails, try `cisco_ios`.