centralmcp — HPE Networking MCP toolkit

The banner tracks the current backend catalog: a large tool surface stays available on demand, while the MCP client itself only ever sees three router tools by default.

Low-token Model Context Protocol (MCP) server for HPE Networking automation: Aruba Central, HPE GreenLake Platform (GLP), ClearPass, Juniper Mist, Apstra, ArubaOS 8 migration automation, EdgeConnect, HPE Aruba UXI, and Axis Atmos Cloud.

centralmcp gives MCP-capable AI clients a low-token way to search Aruba/HPE docs, look up exact OpenAPI details, inspect Central health, run troubleshooting workflows, manage configuration, execute guarded ArubaOS 8 migrations, and use guarded GreenLake Platform operations. It is built around direct REST calls with httpx.

For the full visual walkthrough of this same information — audience picker, diagrams, and write-safety flow — see the centralmcp GitHub Pages site. This README stays intentionally short; canonical guides live under docs/.

Who it's for

Five-minute credential-free quickstart

Verify the install, build the router catalog, and start the MCP HTTP server before adding any Aruba Central or GreenLake Platform credentials:

git clone https://github.com/secure-ssid/centralmcp.git
cd centralmcp
python3 scripts/setup_wizard.py --yes --skip-credentials
uv run python scripts/doctor.py
MCP_PORT=8010 bash scripts/run_http_router.sh

Expected outcomes:

• The wizard prints each completed phase and ends with a setup-complete summary; no Central/GLP calls are made.
• doctor.py reports local dependency, config-path, and index checks — everything reads OK or lists what to fix, without calling any vendor API.
• The HTTP router prints a Uvicorn running on http://127.0.0.1:8010 line and keeps running in the foreground.

The same six steps this diagram shows — clone, run the wizard, check the doctor, connect, discover, and call safely — are exactly what the commands above walk through.

Connect any MCP-capable client to http://127.0.0.1:8010/mcp, then try a credential-free discovery call:

find_tool("ask Aruba docs with citations")
invoke_read_tool("ask_docs", {"question": "WPA3 SAE transition mode", "top_k": 5})

Expected outcome: a short, cited answer from the embedded docs index — this call only reaches the local RAG index, never Central or GLP.

Write safety at a glance

• find_tool only searches the local tool catalog; it never calls a vendor API.
• invoke_read_tool blocks any backend tool that is not annotated read-only.
• invoke_tool is deliberately marked destructive because it can also dispatch write/destructive backend tools — use it only when a write is intended.
• Use dry_run=True first when supported; real execution then requires either confirm=True or MCP elicitation, depending on the tool schema.
• Optional product writes stay blocked by default (CENTRALMCP_PRODUCT_ACCESS=read-only); a global or per-platform override is required for lab read-write access.
• Credentials stay in config/credentials.yaml or environment variables and are never committed.

See Tool router for the complete discovery/dispatch/write-safety model.

Project snapshot

Full per-backend counts live in Tool catalog. See the 0.7.0 release notes for everything added in the current release, and the capability gap matrix for reproducible tool/benchmark comparisons.

Why the router matters

Point your MCP client at one server: mcp_servers/tool_router.py. The recommended minimal profile keeps the client-visible tool list at three entries while still reaching the full backend catalog:

1. find_tool — discover the right backend tool.
2. invoke_read_tool — dispatch read-only calls.
3. invoke_tool — dispatch intentional write/destructive calls only.

Task-oriented guides

Local setup essentials

The default MCP client profile stays lean:

CENTRALMCP_ROUTER_MODE=minimal
CENTRALMCP_TOOLSETS=central,glp,rag

Enable optional products only when needed:

CENTRALMCP_PRODUCTS=clearpass,mist,apstra,aos8,edgeconnect,uxi,axis,design
CENTRALMCP_PRODUCT_ACCESS=read-only

.claude/launch.json ships a matching minimal aruba-tool-router launch profile for daily use. find_tool omits full JSON schemas by default; request include_schema=true only when a client needs the full parameter shape.

Build or refresh the router tool index, and download the prebuilt RAG/OpenAPI indexes instead of scraping locally:

uv run python scripts/ingest_tools.py --products all
uv run python scripts/download_indexes.py

See Getting started for credentials, region selection, optional-product env vars, and the full ingestion/refresh path.

Streamable HTTP mode

MCP_PORT=8010 bash scripts/run_http_router.sh

Then point any MCP-capable client at http://127.0.0.1:8010/mcp. The server also exposes /livez, /readyz, and /healthz. Non-loopback binds require explicit MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINS and can be protected with MCP_HTTP_BEARER_TOKEN. See MCP client recipes for copy/paste stdio and HTTP configs.

Project layout

mcp_servers/     Low-token router + Central/GLP/RAG/optional-product servers
pipeline/        httpx clients, 8-stage migration pipeline, SSID helpers
ingestion/       Docs/API scraping and LanceDB + SQLite index builders
docs/            Setup, router, architecture, product, and release guides
scripts/         Setup wizard, local doctor, HTTP router helper, release validation
tests/           Unit, integration, and RAG eval coverage
config/          Credentials template; real credentials stay git-ignored
run_pipeline.py  Migration pipeline CLI
run_ssid.py      SSID helper CLI

The full repository map, including generated/git-ignored paths, lives in System overview.

Validation

uv run pytest tests/unit -q
uv run python scripts/validate_release.py --catalog-products all --strict-rag --strict-tool-index --min-tools 6703

The release helper runs unit tests, optional RAG/API eval when indexes exist, tool catalog floor checks, and local tool-index freshness checks. Unit tests also include static guards for the active MCP/pipeline code, committed low-token MCP config examples, local-only config files, router product/toolset docs, bounded generic read-only GET tools, MCP list default bounds, RAG/search top_k bounds, public tool-count claims, tool-count docstrings, tracked Markdown local links and images, Pages sitemap and robots metadata, documented router example arguments, product workflow tool-name tables, and wizard optional-product env tables.

Related projects and thanks

centralmcp is an independent HPE Networking MCP toolkit, improved by watching the official MCP ecosystem and community work:

• HewlettPackard/gl-mcp - official GreenLake Platform MCP server
• modelcontextprotocol/python-sdk - MCP Python SDK
• KarthikSKumar98/central-mcp-server - community Aruba Central MCP server
• nowireless4u/hpe-networking-mcp - unified HPE networking MCP reference

Disclaimer

centralmcp is an independent community project. It is not an official HPE or HPE Aruba Networking product and is not endorsed by or supported by HPE.

License

MIT - see the repository license. Generated API metadata and upstream implementation references are documented in THIRD_PARTY_NOTICES.md.