JackRiebel/Cisco_ISE_MCP

Cisco ISE MCP Server

DISCLAIMER: THIS IS CURRENTLY BUILT FOR USE IN A DEVNET ENVIRONMENT FOR POC. SSL VERIFICATION IS DISABLED. THIS IS NOT RECOMMENDED FOR PRODUCTION USE.

Cisco ISE ERS API Client is a Python-based Model Context Protocol (MCP) server for Cisco Identity Services Engine (ISE). It provides tools for querying the ISE External RESTful Services (ERS) API to manage identities, endpoints, network devices, and authorization profiles in your ISE environment.

Features

• Identity Management: Create, update, and manage user identities (persons).
• Endpoint Management: Register and manage network endpoints (devices).
• Network Device Management: Configure and manage Network Access Devices (NADs).
• Authorization Profiles: Manage authorization profiles for policy enforcement.
• FastMCP Integration: Built with FastMCP for seamless integration with Claude Desktop or similar tools.
• Type-Safe Data Handling: Uses Pydantic for robust data validation.

Installation

Clone the repository:

git clone https://github.com/your-username/Cisco_ISE_MCP.git
cd Cisco_ISE_MCP

Create a virtual environment and activate it:

python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

Install dependencies:

pip install -r requirements.txt

Configuration

Copy the example environment file:
cp .env-example .env

Update the .env file with your Cisco ISE server details:

ISE_API_BASE_URL=https://your-ise-server/admin/ERS/v1
ISE_USERNAME=your_username
ISE_PASSWORD=your_password

Usage with Claude Desktop Client Configure Claude Desktop to use this MCP server:

Open Claude Desktop. Navigate to Settings > Developer > Edit Config. Add the following configuration to claude_desktop_config.json:

{
  "mcpServers": {
    "Cisco_ISE_MCP": {
      "command": "/path/to/cisco-ise-api-client/.venv/bin/fastmcp",
      "args": [
        "run",
        "/path/to/cisco-ise-api-client/cisco_ise_api.py"
      ]
    }
  }
}

Replace /path/to/cisco-ise-api-client with the actual path to your repository. Restart Claude Desktop. Interact with the Cisco ISE MCP via Claude Desktop.

Network Tools Guide

Table of Contents

• Identity Management Tools
• Endpoint Management Tools
• Network Device Management Tools
• Authorization Profile Tools

Identity Management Tools

• GET /persons - Retrieve a list of persons (identities).
• POST /persons - Create a new person in Cisco ISE.

Endpoint Management Tools

• GET /endpoints - Retrieve a list of endpoints.
• POST /endpoints - Register a new endpoint.

Network Device Management Tools

• GET /networkdevices - Retrieve a list of network devices (NADs).
• POST /networkdevices - Create a new network device.

Authorization Profile Tools

• GET /authorizationprofiles - Fetch a list of authorization profiles.
• POST /authorizationprofiles - Create a new authorization profile.

Best Practices

• Error Handling: Always check API responses for errors to handle authentication or resource issues.
• Rate Limiting: Implement delays to respect Cisco ISE API rate limits.
• Security: Keep ISE credentials secure and rotate them regularly.
• Validation: Use provided Pydantic schemas to ensure data integrity.

Troubleshooting

Authentication Errors: Verify the ISE username and password in the .env file. Rate Limiting: If rate limit errors occur, add delays between API calls. Resource Not Found: Ensure correct IDs (person, endpoint, device, profile) are used. SSL Issues: SSL verification is disabled for DevNet use; enable it for production with proper certificates.

Disclaimer

This software is provided "AS IS" without warranty. Use in production environments at your own risk. Ensure ISE credentials are stored securely and rotated regularly. About Cisco ISE ERS API Client for managing Cisco Identity Services Engine resources via the ERS API. License This project is licensed under the MIT License. See the LICENSE file for details. Contributing Contributions are welcome! Please submit a pull request or open an issue for bug reports or feature requests. Contact For questions or support, please open an issue on the repository.```