Page MenuHomeVyOS Platform

Native HTTPS Model Context Protocol (MCP) API Endpoint
Open, NormalPublic

Assigned To
Authored By
mihakralj
Jun 29 2026, 5:59 PM
Referenced Files
F116353132: T9030-mcp-implementation.md
Jul 1 2026, 2:55 AM
F116353134: T9030-mcp-security.md
Jul 1 2026, 2:55 AM
F116353131: T9030-mcp-dynamic-schema.md
Jul 1 2026, 2:55 AM
F116353135: T9030-mcp-tools.md
Jul 1 2026, 2:55 AM
F116353133: T9030-mcp-architecture.md
Jul 1 2026, 2:55 AM

Description

This feature introduces a native Model Context Protocol (MCP) server to the VyOS HTTP API, establishing a standardized interface for autonomous AI agents and Large Language Models (LLMs) to interact safely with the routing environment. Deployed as an additional service running alongside the existing REST and GraphQL APIs, the MCP server - when enabled - utilizes a Server-Sent Events (SSE) transport mechanism and inherits the robust API key and JWT authentication frameworks already natively present in VyOS.

To ensure a zero-maintenance lifecycle, MCP integration abandons statically defined toolsets. Instead, it dynamically harvests VyOS' capabilities on-the-fly by introspecting the internal vyos.xml_ref cache and abstract syntax tree. As new features or protocols are added in future VyOS updates, they are instantly exposed through MCP without requiring manual code changes.

Key Capabilities:

  • Dynamic Context via Resources: Exposes the active VyOS configuration tree and schema definitions through dynamic URIs (e.g., vyos-config://running/{path}), allowing AI clients to extract localized, read-only slices of the routing state rather than consuming massive configuration files.
  • Operational & Configuration Meta-Tools: Mirrors the VyOS CLI bifurcation by offering dedicated tools for operational commands (diagnostics, monitoring) and configuration modifications.
  • Atomic Configuration Integrity: Configuration tools strictly leverage the internal ConfigSession API, ensuring that AI-generated modifications undergo the exact same validation, commit, and rollback safety checks as human-driven inputs.
  • Strict Access Controls: Introduces a read-only enforcement mode within the service https api mcp configuration tree, structurally preventing AI agents from executing destructive commands or altering the network state without human-in-the-loop approval.

Details

Version
-
Is it a breaking change?
Perfectly compatible
Issue type
Feature (new functionality)

Event Timeline

mihakralj triaged this task as Normal priority.
mihakralj created this object in space S1 VyOS Public.

1. Exposed MCP Resources
Resources expose read-only context to the language model via specific URIs. Instead of forcing the AI to read a massive monolithic configuration file, the system provides targeted data slices.

Active Configuration Subtrees:

  • URI: vyos-config://running/interfaces/ethernet/eth0
  • Data Returned: A JSON representation of the eth0 interface settings (e.g., MAC address, duplex state, IP addresses) extracted dynamically using the internal configuration reader.

Dynamic Schema Introspection:

  • URI: vyos-schema://config/protocols/bgp
  • Data Returned: A compiled JSON Schema dictating exactly which BGP parameters are valid, which are mandatory, and their data types. This is harvested on-the-fly from the vyos.xml_ref cache using internal functions like cli_defined so the AI never guesses the syntax.

Operational State:

  • URI: vyos-state://operational/dhcp/leases
  • Data Returned: Live, JSON-formatted data representing active DHCP leases, queried directly from the internal operational scripts.

2. Tools
Tools are the executable functions the AI can trigger. They are strictly bifurcated to mimic the VyOS command-line structure, keeping operational diagnostics separate from configuration changes.

execute_operational_command:

  • Purpose: Runs read-only diagnostic and monitoring commands.
  • Parameters: path (an array of strings representing the CLI command).
  • Example Payload: {"path": ["show", "interfaces", "wireguard"]} or {"path": ["monitor", "traceroute", "8.8.8.8"]}.
  • Implementation: The server routes this request to the native operational mode scripts (like qos.py or the mtr wrapper), returning JSON-formatted results directly to the model.

modify_configuration:

  • Purpose: Modifies the system configuration safely using atomic transactions.
  • Parameters: operations (an array of JSON objects detailing the changes).
  • Example Payload:

[{"op": "set", "path": ["interfaces", "dummy", "dum1", "address"], "value": "203.0.113.76/32"}].

  • Implementation: The server instantiates a ConfigSession and stages the operations. It then triggers an atomic commit. If the commit fails validation, the exact semantic error (e.g., "Cannot assign IPv6 address without enabling IPv6 forwarding") is sent back to the AI so it can self-correct.

manage_system_image:

  • Purpose: Downloads and installs new VyOS system images.
  • Parameters: action ("add" or "delete"), url (the image URL).
  • Implementation: Directly interfaces with the internal image_installer.py mechanism.

3. Prompts
Prompts are pre-configured workflow templates that the AI can invoke. They don't execute code, but rather inject domain-specific instructions and context into the AI's memory so it knows how to handle complex VyOS concepts.

audit_firewall_posture:

  • Injected Context: Informs the AI that VyOS utilizes an nftables-based firewall system. It instructs the agent to pull the vyos-config://running/firewall resource and explains the structural differences between global forward filters and zone-based firewall rules. This prevents the AI from hallucinating legacy iptables commands.

troubleshoot_routing_loop:

  • Injected Context: Instructs the AI to invoke the execute_operational_command tool to check ["show", "ip", "route"]. It also provides background context that VyOS relies on FRRouting (FRR) for dynamic paths.

provision_site_to_site_vpn

  • Injected Context: A workflow guide explaining that IPsec configurations in VyOS require coordination across three specific configuration branches (esp-group, ike-group, and site-to-site peer). It instructs the AI to query the schema resources for these branches before attempting to use the modify_configuration tool.

I noticed this independent VyMCP project just dropped a few hours ago. (there is no affiliation between this feature request and their implementation)

Proposed specs for implementation attached for review and discussion.
MCP Architecture proposal:


MCP Tools proposal:

Dynamic Schema proposal:

MCP Security model proposal:

MCP Implementation proposal:

Hi @mihakralj
Is it worth working on this given the community driven projects you mentioned?
I am learning MCP and deployment framework for them, and I am happy to help - as my learning effort

if you are asking about VyManager and VyMCP - I don't know them; it looks only two contributors at the moment...
My proposal here is structurally very different from their MCP implementation - I am proposing to add MCP capability into core VyOS, alongside with rest and GraphQL APIs we already have. They are essentially extending VyManager, that runs in 3 containers separate from VyOS

Thank you for the clarification.

I found this https://github.com/rlerdorf/vyos-mcp-go - MCP that runs alongside VyOS appliance, inside