portnox/portnox-mcp repository overview

⁠Portnox MCP Server

The Portnox MCP Server enables AI assistants and Large Language Models (LLMs) to securely interact with Portnox Cloud through the Model Context Protocol (MCP). It exposes the Portnox Cloud REST API as a collection of MCP tools, allowing AI clients to retrieve information, answer operational questions, and perform administrative tasks using natural language.

Instead of manually navigating the Portnox Cloud interface or writing custom scripts against the REST API, administrators can simply ask an AI assistant to perform common management tasks such as locating devices, reviewing network access infrastructure, updating configuration, or managing endpoints.

⁠What It Does

The Portnox MCP Server acts as a secure translation layer between AI assistants and the Portnox Cloud REST API.

Rather than allowing an AI model to interact directly with the API, the MCP server exposes well-defined tools that map to supported Portnox operations. When an AI assistant receives a request, it calls the appropriate MCP tool, which authenticates to Portnox Cloud, performs the requested operation, and returns structured results back to the AI.

The server supports both read-only operations (such as searching for devices or retrieving configuration) and administrative operations (such as updating sites, modifying network devices, blocking endpoints, or deleting devices), depending on the permissions granted to the configured Portnox administrator account.

⁠Key Features

• Native Model Context Protocol (MCP) server
• Direct integration with the Portnox Cloud REST API
• Compatible with modern MCP clients, including:
  • Claude Desktop
  • Claude Code
  • GitHub Copilot
  • Visual Studio Code
  • Other MCP-compatible AI assistants
• Supports API token authentication as well as local Portnox administrator credentials
• Containerized deployment using Docker
• HTTPS support using existing certificates, PKCS#12 bundles, or automatically generated self-signed certificates
• Secure secret handling through Docker Secrets or environment variables
• Open Source under the Apache License 2.0

⁠Supported Operations

Current functionality includes management of several common Portnox Cloud resources, including:

⁠Network Access Servers (NAS)

• List switches and network devices
• Batch update NAS configuration

⁠Sites

• Create, update, retrieve, and delete sites
• Modify site subnet and IP range rules

⁠Endpoints / Devices

• Search for managed devices
• View device information
• Block or unblock devices
• Delete devices

⁠Authentication

The server supports two authentication methods:

• Portnox API Tokens (recommended)
• Local Portnox administrator username/password credentials

For production deployments, Portnox recommends using a dedicated administrator account that follows the principle of least privilege.

⁠Who Is It For?

The Portnox MCP Server is designed for:

• Network administrators
• Security administrators
• NAC administrators
• IT operations teams
• Security Operations Centers (SOC)
• Platform engineering teams
• AI automation developers
• Organizations building AI-powered operational assistants

It is especially useful for organizations that want to incorporate Portnox Cloud into AI-driven workflows without building custom integrations against the REST API.

⁠Example Use Cases

Examples of tasks an AI assistant can perform through the MCP server include:

• Find all blocked devices that connected today.
• List every switch configured at our Dallas office.
• Block this endpoint in Portnox.
• Show me which site contains subnet 10.10.5.0/24.
• Update the IP ranges assigned to the Austin site.

These natural language interactions eliminate the need for administrators to manually navigate the Portnox Cloud interface or write one-off API scripts for common operational tasks.

⁠Problems It Solves

Organizations increasingly want AI assistants to help operate their infrastructure, but exposing production APIs directly to AI models introduces complexity and security concerns.

The Portnox MCP Server addresses this by:

• Converting the Portnox Cloud REST API into standardized MCP tools
• Eliminating the need to build custom AI integrations
• Providing a consistent interface for multiple AI platforms
• Simplifying automation of repetitive administrative tasks
• Enabling conversational management of Portnox Cloud
• Accelerating troubleshooting and operational workflows
• Reducing the learning curve for new administrators

By using MCP, organizations can integrate Portnox Cloud into their AI ecosystem using an open standard rather than vendor-specific integrations.

⁠Security

The MCP server communicates only with your Portnox Cloud tenant using the credentials you provide.

Because the server can perform administrative actions, it should always be deployed using a dedicated administrator account with only the permissions required for your intended workflows.

As with any AI-enabled administrative interface, production deployments should include appropriate change management, auditing, and validation processes before allowing AI assistants to make configuration changes.

⁠Open Source

The Portnox MCP Server is an open source project sponsored by Portnox and licensed under the Apache License 2.0.

Community contributions are welcome through GitHub, including:

• Bug reports
• Feature enhancements
• Documentation improvements
• Pull requests

⁠Docker Parameters

⁠CLI Arguments You Can Pass After Image Name

Example usage

Credential Based Authentication (Portnox Cloud Admin Account)

sudo docker run -p 8765:8765 \
-e MCP_ENABLE_HTTPS='true' \
-e PORTNOX_USERNAME='[email protected]' \
-e PORTNOX_PASSWORD='password' \
portnox/portnox-mcp:latest \
python /app/server.py --transport streamable-http --host 0.0.0.0 --port 8765

Bearer Token Authentication

sudo docker run -p 8765:8765 \
-e MCP_ENABLE_HTTPS='true' \
-e PORTNOX_TOKEN="<your token"
portnox/portnox-mcp:latest \
python /app/server.py --transport streamable-http --host 0.0.0.0 --port 8765

Example TLS Self-Signed claude_desktop_config.json

{
  "mcpServers": {
    "my-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<MCP_SERVER_IP>:<MCP_SERVER_PORT>/mcp"
      ],
      "env": {
        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
      }
    }
  },

Example HTTP claude_desktop_config.json

{
  "mcpServers": {
    "my-mcp-server": {
      "command": "/opt/homebrew/bin/npx",
      "args": [
        "-y",
        "mcp-remote",
        "<MCP_SERVER_IP>:<MCP_SERVER_PORT>/mcp",
        "--allow-http",
        "--transport",
        "http-first"
      ]
    }
  },