Intersight MCP 服务器

Intersight MCP Server

An MCP server for Cisco Intersight, enabling AI assistants to query and manage server infrastructure.

Features

• Physical server inventory, alarms, HCL compliance, firmware, organizations, profiles and policies
• Detail lookups for a single server (by name, serial or Moid) and a single alarm
• OData $filter, $orderby, $select, $top and $skip on every listing
• Truncation-aware results: each listing reports the total match count, so a partial page is never mistaken for a complete one
• Optional write operations (alarm acknowledgement, power control, profile assignment), off by default
• stdio and remote Streamable HTTP transports, with optional bearer-token auth
• MCP resources and guided prompts for common workflows

Quick Start

Prerequisites

• Cisco Intersight API key (generate one here)
• Go 1.25+ (build from source) or Docker/Podman

Configuration

* Supply exactly one of INTERSIGHT_API_KEY_FILE or INTERSIGHT_API_KEY.

Build and Run

make build
export INTERSIGHT_API_KEY_ID="your-key-id"
export INTERSIGHT_API_KEY_FILE="/path/to/key.pem"
./intersight-mcp-server

Claude Desktop / Claude Code

Add to claude_desktop_config.json (or your MCP settings):

{
  "mcpServers": {
    "intersight": {
      "command": "/path/to/intersight-mcp-server",
      "env": {
        "INTERSIGHT_API_KEY_ID": "your-key-id",
        "INTERSIGHT_API_KEY_FILE": "/path/to/key.pem"
      }
    }
  }
}

Remote connections (Streamable HTTP)

Set TRANSPORT=http to serve MCP over HTTP instead of stdio. The server exposes /mcp for MCP traffic and /healthz for liveness checks. /healthz is deliberately outside the authenticated path so container health checks do not need the token.

export TRANSPORT=http PORT=8080 MCP_API_KEY="$(openssl rand -hex 32)"
./intersight-mcp-server

Set MCP_API_KEY. Without it /mcp accepts any request, which hands anonymous callers your Intersight account. The server logs a warning at startup when the key is unset. Terminate TLS in front of the server — the bearer token crosses the wire in clear text otherwise.

Connecting a client

Clients that speak Streamable HTTP natively can use the URL directly:

{
  "mcpServers": {
    "intersight": {
      "url": "https://intersight-mcp.example.com/mcp",
      "headers": { "Authorization": "Bearer your-token" }
    }
  }
}

For stdio-only clients, bridge with mcp-remote:

{
  "mcpServers": {
    "intersight": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://intersight-mcp.example.com/mcp",
        "--header", "Authorization:Bearer your-token"
      ]
    }
  }
}

Container

make docker      # or: make podman
docker run --rm \
  -p 8080:8080 \
  -e TRANSPORT=http \
  -e MCP_API_KEY="your-token" \
  -e INTERSIGHT_API_KEY_ID="your-key-id" \
  -e INTERSIGHT_API_KEY_FILE="/app/key.pem" \
  -v /path/to/key.pem:/app/key.pem:ro \
  ghcr.io/inchix/intersight-mcp-server:latest

make podman-run wraps the equivalent podman invocation, reading INTERSIGHT_API_KEY_ID, INTERSIGHT_API_KEY_FILE and MCP_API_KEY from your environment.

Available Tools

Read operations (always registered)

Every listing tool accepts:

All read tools are annotated readOnlyHint, so clients can run them without write-approval prompts.

Write operations

These are not registered unless INTERSIGHT_ENABLE_WRITES=true. They change real infrastructure, so the default deployment cannot reach them at all.

set_power_state acts on real hardware. PowerOff, PowerCycle, HardReset and Reboot cut power immediately and can lose unsaved data on a running workload; Shutdown asks the operating system to stop cleanly. The tool resolves the target by name, serial or Moid and refuses to act on an ambiguous match, but it cannot know whether the server matters. Both power and profile tools carry the MCP destructiveHint annotation so clients prompt before calling.

Resources and prompts

Two MCP resources expose slow-changing inventory without spending a tool call. Both are cached for five minutes:

• intersight://organizations
• intersight://server-profiles

Two prompts chain the read tools into a workflow:

• diagnose_server — inventory, alarms, firmware and HCL for one server
• audit_firmware — fleet-wide firmware and compliance survey, optionally scoped by a filter

OData Filter Examples

# Servers by model
filter: "Model eq 'UCSC-C220-M5SX'"

# Powered-on servers only
filter: "OperPowerState eq 'on'"

# Critical alarms
filter: "Severity eq 'Critical'"

# Non-compliant HCL
filter: "Status ne 'Validated'"

# Servers with specific tag
filter: "Tags/any(t:t/Key eq 'Site' and t/Value eq 'London')"

# Newest critical alarms first
filter: "Severity eq 'Critical'", orderby: "CreationTime desc"

# Page two of a large inventory
top: 100, skip: 100, orderby: "Name"

Intersight supports $filter, $select, $top, $skip, $orderby, $count, $inlinecount, $expand and $apply. See the query syntax reference.

Development

make build             # Build binary
make test              # Unit tests
make test-integration  # Read-only tests against a real Intersight account
make lint              # golangci-lint
make docker            # Build container image
make clean             # Remove binary

./scripts/smoke.sh     # MCP handshake check against a built binary

make test-integration needs INTERSIGHT_API_KEY_ID and a key; it is read-only and skips itself when credentials are absent.

License

Apache-2.0. See LICENSE.