NSO Device Operations
MCP Server
- Command:
cisco-nso-mcp-server (pip-installed, stdio transport)
- Requires:
NSO_ADDRESS, NSO_USERNAME, NSO_PASSWORD environment variables
- Optional:
NSO_SCHEME (default: http), NSO_PORT (default: 8080), NSO_VERIFY, NSO_TIMEOUT
- API: RESTCONF (RFC 8040)
Available Tools
| Tool |
Parameters |
What It Does |
get_device_config |
device_name |
Get the full configuration for a device from NSO's CDB |
get_device_state |
device_name |
Get operational state data for a device (interfaces, counters, status) |
check_device_sync |
device_name |
Check if NSO's copy of the device config is in sync with the actual device |
sync_from_device |
device_name |
Pull the current config from the device into NSO's CDB (sync-from) |
get_device_platform |
device_name |
Get platform info: model, OS version, serial number, hardware details |
get_device_ned_ids |
none |
List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
get_device_groups |
none |
List all device groups defined in NSO |
MCP Resource
| Resource URI |
What It Returns |
https://resources.cisco-nso-mcp.io/environment |
NSO environment summary: device count, OS distribution, unique models, device series, group membership |
Workflow: Device Configuration Audit
When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":
- Get device groups:
get_device_groups to see how devices are organized
- Get config:
get_device_config for each target device
- Present: Format the configuration in a readable way
- Cross-reference: Compare with pyATS live config if discrepancies suspected
Workflow: Sync Check and Remediation
When a user asks "are my devices in sync?" or "is NSO up to date?":
- Check sync:
check_device_sync for the target device(s)
- If out of sync: Report which devices are out of sync and why
- Remediate: Use
sync_from_device to pull current config from the device into NSO
- Verify: Run
check_device_sync again to confirm sync is restored
- Record in GAIT: Log the sync operation for audit trail
Workflow: NSO Environment Overview
When a user asks "what's in NSO?" or "show me the NSO inventory":
- Environment resource: Read the NSO environment resource for the summary
- Device groups:
get_device_groups to see organizational structure
- NED IDs:
get_device_ned_ids to see what device types are managed
- Platform details:
get_device_platform for specific devices of interest
- Report: Summary table of devices, OS types, models, and group membership
Workflow: Pre-Change Baseline from NSO
Before making configuration changes:
- Get current config:
get_device_config to capture the NSO baseline
- Check sync:
check_device_sync to ensure NSO is current
- If out of sync:
sync_from_device first to get the latest state
- Save baseline: Commit the config to GAIT or GitHub for audit trail
- Proceed with change: Use pyATS or NSO services to apply changes
Workflow: Device Platform Inventory
When a user needs hardware/software details:
- Get platform:
get_device_platform for each device
- Compile report: Model, serial, OS version, hardware
- Cross-reference: Check NVD for CVEs against OS versions (use nvd-cve skill)
- Cross-reference: Compare with NetBox records for accuracy (use netbox-reconcile skill)
NSO Concepts
| Concept |
Meaning |
| CDB |
Configuration Database — NSO's copy of all device configs |
| NED |
Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
| sync-from |
Pull config from device into NSO CDB |
| sync-to |
Push NSO CDB config to device (not available in this MCP — use services instead) |
| Device Group |
Logical grouping of devices for bulk operations |
| Service |
NSO service instance that provisions config across devices (see nso-service-mgmt skill) |
Integration with Other Skills
| Scenario |
Integration |
| Config differs from NSO |
Compare get_device_config (NSO) vs pyATS show running-config (live) |
| Device inventory audit |
Compare get_device_platform (NSO) vs NetBox records |
| Pre-change validation |
NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
| Vulnerability scanning |
get_device_platform (OS version) → NVD CVE search |
| Config backup to GitHub |
get_device_config → github-ops commit to repo |
Important Rules
- NSO is the orchestration layer — it manages device configs through RESTCONF/NETCONF, not CLI
- Always check sync before trusting config —
check_device_sync first
- sync_from_device pulls FROM the device — it overwrites NSO's CDB with what's actually on the device
- Read-heavy operations are safe — get_device_config, get_device_state, check_device_sync are non-destructive
- sync_from_device modifies NSO CDB — it's safe for the device but changes NSO's database
- Record in GAIT — log all NSO operations for audit trail
Environment Variables
NSO_SCHEME — http or https (default: http)NSO_ADDRESS — NSO server address (default: localhost)NSO_PORT — RESTCONF port (default: 8080)NSO_USERNAME — NSO username (default: admin)NSO_PASSWORD — NSO password (default: admin)NSO_VERIFY — Verify SSL certificate (default: true)NSO_TIMEOUT — Connection timeout in seconds (default: 10)
1---2name: nso-device-ops3description: Cisco NSO device operations — config retrieval, state inspection, sync, platform info, NED IDs, device groups. Use when retrieving device configs from NSO, checking sync status, pulling platform inventory, or inspecting NSO device groups and NED drivers4license: Apache-2.05---6
7# NSO Device Operations
8
9## MCP Server
10
11- **Command**: `cisco-nso-mcp-server` (pip-installed, stdio transport)
12- **Requires**: `NSO_ADDRESS`, `NSO_USERNAME`, `NSO_PASSWORD` environment variables
13- **Optional**: `NSO_SCHEME` (default: http), `NSO_PORT` (default: 8080), `NSO_VERIFY`, `NSO_TIMEOUT`
14- **API**: RESTCONF (RFC 8040)
15
16## Available Tools
17
18| Tool | Parameters | What It Does |
19|------|-----------|-------------|
20| `get_device_config` | `device_name` | Get the full configuration for a device from NSO's CDB |
21| `get_device_state` | `device_name` | Get operational state data for a device (interfaces, counters, status) |
22| `check_device_sync` | `device_name` | Check if NSO's copy of the device config is in sync with the actual device |
23| `sync_from_device` | `device_name` | Pull the current config from the device into NSO's CDB (sync-from) |
24| `get_device_platform` | `device_name` | Get platform info: model, OS version, serial number, hardware details |
25| `get_device_ned_ids` | none | List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
26| `get_device_groups` | none | List all device groups defined in NSO |
27
28## MCP Resource
29
30| Resource URI | What It Returns |
31|-------------|----------------|
32| `https://resources.cisco-nso-mcp.io/environment` | NSO environment summary: device count, OS distribution, unique models, device series, group membership |
33
34## Workflow: Device Configuration Audit
35
36When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":
37
381. **Get device groups**: `get_device_groups` to see how devices are organized
392. **Get config**: `get_device_config` for each target device
403. **Present**: Format the configuration in a readable way
414. **Cross-reference**: Compare with pyATS live config if discrepancies suspected
42
43## Workflow: Sync Check and Remediation
44
45When a user asks "are my devices in sync?" or "is NSO up to date?":
46
471. **Check sync**: `check_device_sync` for the target device(s)
482. **If out of sync**: Report which devices are out of sync and why
493. **Remediate**: Use `sync_from_device` to pull current config from the device into NSO
504. **Verify**: Run `check_device_sync` again to confirm sync is restored
515. **Record in GAIT**: Log the sync operation for audit trail
52
53## Workflow: NSO Environment Overview
54
55When a user asks "what's in NSO?" or "show me the NSO inventory":
56
571. **Environment resource**: Read the NSO environment resource for the summary
582. **Device groups**: `get_device_groups` to see organizational structure
593. **NED IDs**: `get_device_ned_ids` to see what device types are managed
604. **Platform details**: `get_device_platform` for specific devices of interest
615. **Report**: Summary table of devices, OS types, models, and group membership
62
63## Workflow: Pre-Change Baseline from NSO
64
65Before making configuration changes:
66
671. **Get current config**: `get_device_config` to capture the NSO baseline
682. **Check sync**: `check_device_sync` to ensure NSO is current
693. **If out of sync**: `sync_from_device` first to get the latest state
704. **Save baseline**: Commit the config to GAIT or GitHub for audit trail
715. **Proceed with change**: Use pyATS or NSO services to apply changes
72
73## Workflow: Device Platform Inventory
74
75When a user needs hardware/software details:
76
771. **Get platform**: `get_device_platform` for each device
782. **Compile report**: Model, serial, OS version, hardware
793. **Cross-reference**: Check NVD for CVEs against OS versions (use nvd-cve skill)
804. **Cross-reference**: Compare with NetBox records for accuracy (use netbox-reconcile skill)
81
82## NSO Concepts
83
84| Concept | Meaning |
85|---------|---------|
86| **CDB** | Configuration Database — NSO's copy of all device configs |
87| **NED** | Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
88| **sync-from** | Pull config from device into NSO CDB |
89| **sync-to** | Push NSO CDB config to device (not available in this MCP — use services instead) |
90| **Device Group** | Logical grouping of devices for bulk operations |
91| **Service** | NSO service instance that provisions config across devices (see nso-service-mgmt skill) |
92
93## Integration with Other Skills
94
95| Scenario | Integration |
96|----------|-------------|
97| Config differs from NSO | Compare `get_device_config` (NSO) vs pyATS `show running-config` (live) |
98| Device inventory audit | Compare `get_device_platform` (NSO) vs NetBox records |
99| Pre-change validation | NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
100| Vulnerability scanning | `get_device_platform` (OS version) → NVD CVE search |
101| Config backup to GitHub | `get_device_config` → github-ops commit to repo |
102
103## Important Rules
104
105- **NSO is the orchestration layer** — it manages device configs through RESTCONF/NETCONF, not CLI
106- **Always check sync before trusting config** — `check_device_sync` first
107- **sync_from_device pulls FROM the device** — it overwrites NSO's CDB with what's actually on the device
108- **Read-heavy operations are safe** — get_device_config, get_device_state, check_device_sync are non-destructive
109- **sync_from_device modifies NSO CDB** — it's safe for the device but changes NSO's database
110- **Record in GAIT** — log all NSO operations for audit trail
111
112## Environment Variables
113
114- `NSO_SCHEME` — http or https (default: http)
115- `NSO_ADDRESS` — NSO server address (default: localhost)
116- `NSO_PORT` — RESTCONF port (default: 8080)
117- `NSO_USERNAME` — NSO username (default: admin)
118- `NSO_PASSWORD` — NSO password (default: admin)
119- `NSO_VERIFY` — Verify SSL certificate (default: true)
120- `NSO_TIMEOUT` — Connection timeout in seconds (default: 10)
gabrielmoreira