NSO Device Operations
MCP Server
- Command:
cisco-nso-mcp-server (pip-installed, stdio transport)
- Requires:
NSO_ADDRESS, NSO_USERNAME, NSO_PASSWORD environment variables
- Optional:
NSO_SCHEME (default: http), NSO_PORT (default: 8080), NSO_VERIFY, NSO_TIMEOUT
- API: RESTCONF (RFC 8040)
Available Tools
| Tool |
Parameters |
What It Does |
get_device_config |
device_name |
Get the full configuration for a device from NSO's CDB |
get_device_state |
device_name |
Get operational state data for a device (interfaces, counters, status) |
check_device_sync |
device_name |
Check if NSO's copy of the device config is in sync with the actual device |
sync_from_device |
device_name |
Pull the current config from the device into NSO's CDB (sync-from) |
get_device_platform |
device_name |
Get platform info: model, OS version, serial number, hardware details |
get_device_ned_ids |
none |
List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
get_device_groups |
none |
List all device groups defined in NSO |
MCP Resource
| Resource URI |
What It Returns |
https://resources.cisco-nso-mcp.io/environment |
NSO environment summary: device count, OS distribution, unique models, device series, group membership |
Workflow: Device Configuration Audit
When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":
- Get device groups:
get_device_groups to see how devices are organized
- Get config:
get_device_config for each target device
- Present: Format the configuration in a readable way
- Cross-reference: Compare with pyATS live config if discrepancies suspected
Workflow: Sync Check and Remediation
When a user asks "are my devices in sync?" or "is NSO up to date?":
- Check sync:
check_device_sync for the target device(s)
- If out of sync: Report which devices are out of sync and why
- Remediate: Use
sync_from_device to pull current config from the device into NSO
- Verify: Run
check_device_sync again to confirm sync is restored
- Record in GAIT: Log the sync operation for audit trail
Workflow: NSO Environment Overview
When a user asks "what's in NSO?" or "show me the NSO inventory":
- Environment resource: Read the NSO environment resource for the summary
- Device groups:
get_device_groups to see organizational structure
- NED IDs:
get_device_ned_ids to see what device types are managed
- Platform details:
get_device_platform for specific devices of interest
- Report: Summary table of devices, OS types, models, and group membership
Workflow: Pre-Change Baseline from NSO
Before making configuration changes:
- Get current config:
get_device_config to capture the NSO baseline
- Check sync:
check_device_sync to ensure NSO is current
- If out of sync:
sync_from_device first to get the latest state
- Save baseline: Commit the config to GAIT or GitHub for audit trail
- Proceed with change: Use pyATS or NSO services to apply changes
Workflow: Device Platform Inventory
When a user needs hardware/software details:
- Get platform:
get_device_platform for each device
- Compile report: Model, serial, OS version, hardware
- Cross-reference: Check NVD for CVEs against OS versions (use nvd-cve skill)
- Cross-reference: Compare with NetBox records for accuracy (use netbox-reconcile skill)
NSO Concepts
| Concept |
Meaning |
| CDB |
Configuration Database — NSO's copy of all device configs |
| NED |
Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
| sync-from |
Pull config from device into NSO CDB |
| sync-to |
Push NSO CDB config to device (not available in this MCP — use services instead) |
| Device Group |
Logical grouping of devices for bulk operations |
| Service |
NSO service instance that provisions config across devices (see nso-service-mgmt skill) |
Integration with Other Skills
| Scenario |
Integration |
| Config differs from NSO |
Compare get_device_config (NSO) vs pyATS show running-config (live) |
| Device inventory audit |
Compare get_device_platform (NSO) vs NetBox records |
| Pre-change validation |
NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
| Vulnerability scanning |
get_device_platform (OS version) → NVD CVE search |
| Config backup to GitHub |
get_device_config → github-ops commit to repo |
Important Rules
- NSO is the orchestration layer — it manages device configs through RESTCONF/NETCONF, not CLI
- Always check sync before trusting config —
check_device_sync first
- sync_from_device pulls FROM the device — it overwrites NSO's CDB with what's actually on the device
- Read-heavy operations are safe — get_device_config, get_device_state, check_device_sync are non-destructive
- sync_from_device modifies NSO CDB — it's safe for the device but changes NSO's database
- Record in GAIT — log all NSO operations for audit trail
Environment Variables
NSO_SCHEME — http or https (default: http)NSO_ADDRESS — NSO server address (default: localhost)NSO_PORT — RESTCONF port (default: 8080)NSO_USERNAME — NSO username (default: admin)NSO_PASSWORD — NSO password (default: admin)NSO_VERIFY — Verify SSL certificate (default: true)NSO_TIMEOUT — Connection timeout in seconds (default: 10)
1---
2name: nso-device-ops
3description: "Cisco NSO device operations — config retrieval, state inspection, sync, platform info, NED IDs, device groups. Use when retrieving device configs from NSO, checking sync status, pulling platform inventory, or inspecting NSO device groups and NED drivers"
4version: 1.0.0
5license: Apache-2.0
6tags: [nso, orchestration, config, sync, restconf]
7---
8
9# NSO Device Operations
10
11## MCP Server
12
13- **Command**: `cisco-nso-mcp-server` (pip-installed, stdio transport)
14- **Requires**: `NSO_ADDRESS`, `NSO_USERNAME`, `NSO_PASSWORD` environment variables
15- **Optional**: `NSO_SCHEME` (default: http), `NSO_PORT` (default: 8080), `NSO_VERIFY`, `NSO_TIMEOUT`
16- **API**: RESTCONF (RFC 8040)
17
18## Available Tools
19
20| Tool | Parameters | What It Does |
21|------|-----------|-------------|
22| `get_device_config` | `device_name` | Get the full configuration for a device from NSO's CDB |
23| `get_device_state` | `device_name` | Get operational state data for a device (interfaces, counters, status) |
24| `check_device_sync` | `device_name` | Check if NSO's copy of the device config is in sync with the actual device |
25| `sync_from_device` | `device_name` | Pull the current config from the device into NSO's CDB (sync-from) |
26| `get_device_platform` | `device_name` | Get platform info: model, OS version, serial number, hardware details |
27| `get_device_ned_ids` | none | List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
28| `get_device_groups` | none | List all device groups defined in NSO |
29
30## MCP Resource
31
32| Resource URI | What It Returns |
33|-------------|----------------|
34| `https://resources.cisco-nso-mcp.io/environment` | NSO environment summary: device count, OS distribution, unique models, device series, group membership |
35
36## Workflow: Device Configuration Audit
37
38When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":
39
401. **Get device groups**: `get_device_groups` to see how devices are organized
412. **Get config**: `get_device_config` for each target device
423. **Present**: Format the configuration in a readable way
434. **Cross-reference**: Compare with pyATS live config if discrepancies suspected
44
45## Workflow: Sync Check and Remediation
46
47When a user asks "are my devices in sync?" or "is NSO up to date?":
48
491. **Check sync**: `check_device_sync` for the target device(s)
502. **If out of sync**: Report which devices are out of sync and why
513. **Remediate**: Use `sync_from_device` to pull current config from the device into NSO
524. **Verify**: Run `check_device_sync` again to confirm sync is restored
535. **Record in GAIT**: Log the sync operation for audit trail
54
55## Workflow: NSO Environment Overview
56
57When a user asks "what's in NSO?" or "show me the NSO inventory":
58
591. **Environment resource**: Read the NSO environment resource for the summary
602. **Device groups**: `get_device_groups` to see organizational structure
613. **NED IDs**: `get_device_ned_ids` to see what device types are managed
624. **Platform details**: `get_device_platform` for specific devices of interest
635. **Report**: Summary table of devices, OS types, models, and group membership
64
65## Workflow: Pre-Change Baseline from NSO
66
67Before making configuration changes:
68
691. **Get current config**: `get_device_config` to capture the NSO baseline
702. **Check sync**: `check_device_sync` to ensure NSO is current
713. **If out of sync**: `sync_from_device` first to get the latest state
724. **Save baseline**: Commit the config to GAIT or GitHub for audit trail
735. **Proceed with change**: Use pyATS or NSO services to apply changes
74
75## Workflow: Device Platform Inventory
76
77When a user needs hardware/software details:
78
791. **Get platform**: `get_device_platform` for each device
802. **Compile report**: Model, serial, OS version, hardware
813. **Cross-reference**: Check NVD for CVEs against OS versions (use nvd-cve skill)
824. **Cross-reference**: Compare with NetBox records for accuracy (use netbox-reconcile skill)
83
84## NSO Concepts
85
86| Concept | Meaning |
87|---------|---------|
88| **CDB** | Configuration Database — NSO's copy of all device configs |
89| **NED** | Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
90| **sync-from** | Pull config from device into NSO CDB |
91| **sync-to** | Push NSO CDB config to device (not available in this MCP — use services instead) |
92| **Device Group** | Logical grouping of devices for bulk operations |
93| **Service** | NSO service instance that provisions config across devices (see nso-service-mgmt skill) |
94
95## Integration with Other Skills
96
97| Scenario | Integration |
98|----------|-------------|
99| Config differs from NSO | Compare `get_device_config` (NSO) vs pyATS `show running-config` (live) |
100| Device inventory audit | Compare `get_device_platform` (NSO) vs NetBox records |
101| Pre-change validation | NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
102| Vulnerability scanning | `get_device_platform` (OS version) → NVD CVE search |
103| Config backup to GitHub | `get_device_config` → github-ops commit to repo |
104
105## Important Rules
106
107- **NSO is the orchestration layer** — it manages device configs through RESTCONF/NETCONF, not CLI
108- **Always check sync before trusting config** — `check_device_sync` first
109- **sync_from_device pulls FROM the device** — it overwrites NSO's CDB with what's actually on the device
110- **Read-heavy operations are safe** — get_device_config, get_device_state, check_device_sync are non-destructive
111- **sync_from_device modifies NSO CDB** — it's safe for the device but changes NSO's database
112- **Record in GAIT** — log all NSO operations for audit trail
113
114## Environment Variables
115
116- `NSO_SCHEME` — http or https (default: http)
117- `NSO_ADDRESS` — NSO server address (default: localhost)
118- `NSO_PORT` — RESTCONF port (default: 8080)
119- `NSO_USERNAME` — NSO username (default: admin)
120- `NSO_PASSWORD` — NSO password (default: admin)
121- `NSO_VERIFY` — Verify SSL certificate (default: true)
122- `NSO_TIMEOUT` — Connection timeout in seconds (default: 10)
gabrielmoreira