cml-mcp: Cisco Modeling Labs through MCP
cml-mcp
An MCP server for Cisco Modeling Labs: an agent creates topologies, starts nodes, configures links and captures traffic
- 80 ★ on the repository
- Last commit
- BSD-2-Clause
Broad access
Why this level
- The agent creates and wipes labs and changes virtual device configs
- CML credentials are passed to the server and administrator rights open user management
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/cml-mcpDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent creates and wipes labs and changes virtual device configs
- CML credentials are passed to the server and administrator rights open user management
This is third-party code. Review the repository files before installing.
What it does
cml-mcp connects MCP clients to a Cisco Modeling Labs (CML) server, where virtual network labs are built and run. At a plain-language request an agent creates a lab with two routers and configures OSPF or shows a device's running config. Tools are split into modules: labs, nodes, links, packet capture, annotations, users and groups, and system information. The agent queries the state of labs, nodes and links, starts, stops and wipes a lab or a single node, sets latency, loss and bandwidth on links, adds text and shape annotations, starts and retrieves PCAP for Wireshark and reads node console logs. With the `cml-mcp[pyats]` extra, `send_cli_command` and `send_cli_config_command` run commands on virtual devices through PyATS. In HTTP mode tool permissions are restricted with a YAML file, and OpenTelemetry tracing goes to any compatible backend.
Who it is for. Network engineers and students who build labs in CML and want to drive them from Claude Desktop or Claude Code.
Good fit when
- You want to assemble a lab with routers quickly and set up a routing protocol
- An agent captures traffic on a link and hands over a PCAP for Wireshark analysis
- You want to degrade a link with latency, jitter and loss to test an application
- You need a node's console log while looking for an error
Not a fit when
- You have no CML server: the tool works only with Cisco Modeling Labs
- You need to manage a production network: the server connects to a lab only
- You need no device commands or PyATS cannot be installed: the base package without `[pyats]` is enough
Example request
Create a lab in CML with two routers, connect them, start it and show the running config of the first.MCP
- Transport
- stdio, http
- Authentication
- API key
Environment variables
CML_URLrequired- Cisco Modeling Labs server address
CML_USERNAMErequired- CML username
CML_PASSWORDrequired, secret- CML password
CML_VERIFY_SSL- TLS certificate verification, on by default
Limitations
Access to a CML server is required: the address, username and password in the variables `CML_URL`, `CML_USERNAME` and `CML_PASSWORD`. CML ships a self-signed certificate by default, so most users need `CML_VERIFY_SSL=false`, while verification is on by default. Device commands need the `[pyats]` extra.
Managing users and groups needs CML administrator rights. Clients such as Claude Desktop run in a restricted environment, and `uvx` sometimes has to be given by full path. Docker, Windows through WSL and HTTP mode are covered in a separate `INSTALLATION.md`.
How to disable. Remove the `Cisco Modeling Labs CML` entry from `claude_desktop_config.json` and, if needed, change the CML account password.
FAQ
How do I connect cml-mcp to Claude Desktop?
Add a server with the command `uvx` and the argument `cml-mcp` to `claude_desktop_config.json` and set `CML_URL`, `CML_USERNAME`, `CML_PASSWORD` and `CML_VERIFY_SSL` in env.
Why would I need `CML_VERIFY_SSL=false`?
CML ships a self-signed certificate, so TLS verification fails with default settings. Keep `true` if you have a trusted certificate.
How do I run commands on virtual devices?
Use `cml-mcp[pyats]`: then `send_cli_command` and `send_cli_config_command` are available for exec and configuration modes.
Can I limit rights per tool?
In HTTP mode yes: a YAML access list defines which users call which tools.
What does packet capture do?
Starts and stops a capture on a link and retrieves the PCAP for Wireshark or another analyzer.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server for Cisco Packet Tracer: an agent plans a network, builds it on the canvas and proves connectivity with ping.
The mcpcap MCP server parses PCAP files for DNS, DHCP, ICMP, TCP and SIP and hands the agent structured JSON for network diagnostics
Cisco's local MCP server: an agent designs a network and builds L1, L2 and L3 diagrams in SVG and PowerPoint plus a device table
MCPM
mcpm
A package manager and registry for MCP on all platforms and clients: finds, adds and configures MCP servers, remembers the source and updates
A local agent runtime and MCP gateway with 298 tools: files, Git, processes, Chrome browser, Windows and Office
MCP SSH Agent is an MCP server that reads hosts from ~/.ssh/config, runs commands and copies files through system ssh and scp.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| cml-mcp: Cisco Modeling Labs through MCP (this card) | no | API key | 80 | |
| NetBox MCP Server | yes | API key | 256 | NetBox network inventory and documentation without running virtual labs |
| SSH MCP | no | API key | 875 | runs commands over SSH on real hosts |
README in short
The README explains the server's purpose, lists features and gives `uvx` installation with a Claude Desktop config example. It continues with requirements, tool tables by module, example requests, a system prompt, contributing and fixes for common errors: imports, SSL and PyATS.