io.github.wyre-technology/meraki-mcp

Official

by wyre-technology · TypeScript

Cisco Meraki

MCP server for the Cisco Meraki Dashboard: networks, devices, wireless, switch, appliance.

Manages Cisco Meraki cloud networking, devices, wireless and switch infrastructure.

Topics

ciscomcpmerakimodel-context-protocolmspnetwork

README.md5 KBView on GitHub

Meraki MCP Server

A Model Context Protocol (MCP) server that provides AI assistants with structured access to the Cisco Meraki Dashboard — organizations, networks, devices, clients, wireless, switching, and appliance operations.

Note: This project is maintained by Wyre Technology.

Quick Start

Claude Code (CLI):

bash

claude mcp add meraki-mcp \
  -e MERAKI_API_KEY=your-api-key \
  -e MERAKI_ORG_ID=your-org-id \
  -- npx -y github:wyre-technology/meraki-mcp

See Installation for Docker and from-source methods.

Features

🔌 MCP Protocol Compliance: Full support for MCP tools over stdio and HTTP transports
🌐 Network Coverage: Tools spanning organizations, networks, devices, clients, wireless, switching, and appliance (MX) operations
🔍 Flattened Navigation: meraki_navigate and meraki_status are stateless discovery aids — every tool is callable at any time
🛟 Safety by Default: Read-only mode is ON by default; writes are gated and destructive actions require explicit confirmation
🧰 Long-Tail Escape Hatch: meraki_raw_request reaches any Meraki v1 endpoint not covered by a curated tool
🐳 Docker Ready: Containerized deployment with HTTP transport and health checks
📊 Structured Logging: Configurable log levels

Installation

Option 1: Docker

bash

docker run -d \
  -e MERAKI_API_KEY=your-key \
  -e MERAKI_ORG_ID=your-org-id \
  -p 8080:8080 \
  ghcr.io/wyre-technology/meraki-mcp:latest

Option 2: From Source

bash

git clone https://github.com/wyre-technology/meraki-mcp.git
cd meraki-mcp
npm ci
npm run build

Configuration

Variable	Description	Default
`MERAKI_API_KEY`	Meraki Dashboard API key	—
`MERAKI_ORG_ID`	Default organization ID (optional)	—
`MERAKI_BASE_URL`	Override the Meraki API base URL (optional)	—
`READ_ONLY_MODE`	Safety switch — blocks all writes when `true`	`true`
`MCP_TRANSPORT`	Transport mode (`stdio` or `http`)	`stdio`
`MCP_HTTP_PORT`	HTTP server port	`8080`
`AUTH_MODE`	Auth mode (`env` or `gateway`)	`env`
`LOG_LEVEL`	Log level (`debug`, `info`, `warn`, `error`)	`info`

The legacy READ_ONLY variable is also honored; READ_ONLY_MODE takes precedence.

Safety Model

This server defaults to read-only. Write operations (updates, reboots, deletions) are blocked unless you explicitly set READ_ONLY_MODE=false.

Read tools (*_list, *_get) are always available.
High-impact writes (e.g. meraki_networks_update, meraki_devices_reboot, meraki_wireless_ssids_update) are gated by read-only mode.
Destructive tools (meraki_networks_delete, meraki_devices_remove) additionally require a confirm_destructive_action: true argument. The confirmation flag is never forwarded to the Meraki API.
The meraki_raw_request escape hatch classifies the call by HTTP method: GET is a read; POST/PUT/DELETE are writes; DELETE is destructive.

Domains

All tools are returned upfront. Use meraki_navigate to explore a domain's tools, or meraki_status to check connectivity and the configured organization.

Domain	Tools
organizations	`meraki_organizations_list`, `meraki_organizations_get`, `meraki_organizations_inventory_list`
networks	`meraki_networks_list`, `meraki_networks_get`, `meraki_networks_update` ⚠, `meraki_networks_delete` ⚠⚠
devices	`meraki_devices_list`, `meraki_devices_get`, `meraki_devices_reboot` ⚠, `meraki_devices_remove` ⚠⚠
clients	`meraki_clients_list`, `meraki_clients_get`, `meraki_clients_get_policy`, `meraki_clients_update_policy` ⚠
wireless	`meraki_wireless_ssids_list`, `meraki_wireless_ssids_update` ⚠, `meraki_wireless_rf_profiles_list`
switch	`meraki_switch_ports_list`, `meraki_switch_ports_update` ⚠, `meraki_switch_port_statuses_list`
appliance	`meraki_appliance_firewall_l3_get`, `meraki_appliance_firewall_l3_update` ⚠, `meraki_appliance_vpn_status_get`
(long tail)	`meraki_raw_request`

⚠ = high-impact write · ⚠⚠ = destructive / irreversible

Docker Deployment

Copy .env.example to .env and fill in your credentials:

bash

cp .env.example .env
# Edit .env with your Meraki API key (and org ID)
docker run --env-file .env -p 8080:8080 ghcr.io/wyre-technology/meraki-mcp:latest

Development

bash

npm ci
npm run build       # Build the project
npm run start       # Run over stdio
npm run start:http  # Run the HTTP transport
npm run test        # Run tests

Testing

bash

npm test

The test suite covers the safety contract: read-only enforcement, destructive confirmation, and that confirm_destructive_action is never forwarded to the SDK.

License

Apache 2.0 — Copyright WYRE Technology

Install

Configuration

Environment variables

MERAKI_API_KEYrequiredsecret

Cisco Meraki Dashboard API key

MERAKI_ORG_ID

Default Meraki organization ID (optional)

MERAKI_BASE_URL

Override the Meraki API base URL (optional)

READ_ONLY_MODEdefault true

Safety switch. When true (the default), all write operations are blocked. Set to false to enable writes.

MCP_TRANSPORTdefault stdio

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.

AUTH_MODEdefault env

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.

LOG_LEVELdefault info

Log verbosity: debug, info, warn, error

claude_desktop_config.json

{
  "mcpServers": {
    "meraki-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/wyre-technology/meraki-mcp:v1.0.2"
      ],
      "env": {
        "MERAKI_API_KEY": "<YOUR_MERAKI_API_KEY>",
        "MERAKI_ORG_ID": "<YOUR_MERAKI_ORG_ID>",
        "MERAKI_BASE_URL": "<YOUR_MERAKI_BASE_URL>",
        "READ_ONLY_MODE": "true",
        "MCP_TRANSPORT": "stdio",
        "AUTH_MODE": "env",
        "LOG_LEVEL": "info"
      }
    }
  }
}