Cisco Switch MCP

MCP server for Cisco Catalyst 3650 and other IOS-XE switches. Connects via SSH using Netmiko.

Prerequisites on the switch

SSH enabled: ip domain-name local.lan + crypto key generate rsa + ip ssh version 2
User account with privilege 15 (or enable password configured)
Management IP reachable from the Hermes LXC

Install

/usr/local/lib/hermes-agent/venv/bin/pip install -e /root/cisco-switch-mcp

Hermes config

Add to ~/.hermes/config.yaml:

mcp_servers:
  cisco-switch:
    command: /usr/local/lib/hermes-agent/venv/bin/cisco-switch-mcp
    timeout: 120
    enabled: true
    env:
      CISCO_SWITCH_HOST: "10.77.30.40"
      CISCO_SWITCH_USERNAME: "admin"
      CISCO_SWITCH_PASSWORD: "your_password"
      CISCO_SWITCH_DEVICE_TYPE: "cisco_xe"
      CISCO_SWITCH_ALLOW_WRITES: "false"

Or: echo Y | hermes mcp add cisco-switch --command /usr/local/lib/hermes-agent/venv/bin/cisco-switch-mcp --env CISCO_SWITCH_HOST=...

Restart dashboard/gateway and start a new chat session.

Tools (40+)

Category	Examples
System	version, inventory, CPU, memory, environment, stack status
Interfaces	status, descriptions, counters, port-channels
VLAN/STP	vlan brief, spanning-tree
L2	MAC table, CDP/LLDP neighbors, ARP
Diagnostics	logging, ping, traceroute, running-config
Writes	shutdown port, set access VLAN, description, save config

Safety

Writes disabled by default (CISCO_SWITCH_ALLOW_WRITES=false)
Blocks reload, write erase, format
Audit log at CISCO_SWITCH_AUDIT_LOG_PATH

device_type

Catalyst 3650 runs IOS-XE. Use cisco_xe (default). If connection fails, try cisco_ios.

1.8 KiB Raw Blame History