Skip to main content
Glama

cml2-mcp

Thin MCP server for Cisco CML2.

It deliberately avoids mirroring the CML API as typed (Pydantic) tools — every prior generation that did so broke when the controller shipped a schema change. Instead this server exposes only:

  • cml_openapi(refresh=False) — fetch CML's live openapi.json (cached 24 h).

  • cml_api(method, path, body=None) — generic authenticated REST call after /api/v0. Re-authenticates and retries once on HTTP 401.

  • Resource cml://openapi.json — same content as cml_openapi().

The model is expected to read the OpenAPI spec first and then craft calls.

Configuration

Required environment:

Var

Example

CML_URL

https://cml.example.net/

CML_USERNAME

admin

CML_PASSWORD

Optional:

  • CML_VERIFY_SSL=true — verify TLS (default: off; CML often uses self-signed certs).

  • CML_CACHE_DIR — token / openapi cache directory (default: ~/.cache/cml/).

The token is written to $CML_CACHE_DIR/token with mode 0600.

Related MCP server: specrun

Running

With uv directly from the source tree:

uv run cml2-mcp

After publishing to PyPI (or via uv tool install .):

uvx cml2-mcp

Claude Desktop / Claude Code registration

Wrap the command so the password is fetched from a secure store rather than appearing in plain text. Example with macOS Keychain:

{
  "mcpServers": {
    "cml2": {
      "command": "sh",
      "args": [
        "-c",
        "CML_PASSWORD=$(security find-generic-password -a <account> -s <service> -w) exec uvx cml2-mcp"
      ],
      "env": {
        "CML_URL": "https://cml.example.net/",
        "CML_USERNAME": "admin"
      }
    }
  }
}

For Claude Code:

claude mcp add cml2 -- sh -c 'CML_PASSWORD=$(security find-generic-password -a <account> -s <service> -w) exec uvx cml2-mcp'

(Set CML_URL / CML_USERNAME in the same env or via claude mcp add ... -e KEY=VAL.)

Available Tools

2 tools
cml_apiA

Authenticated CML2 REST call.

Args: method: HTTP method (GET/POST/PUT/PATCH/DELETE). path: Path AFTER /api/v0, must start with '/'. Example: '/labs'. body: Optional JSON-serializable value (object/array/string/etc.). Sent as the request body with Content-Type: application/json.

Returns the raw response body as text (callers should json.parse if needed). Re-authenticates and retries once on HTTP 401. Raises on non-2xx.

ParametersJSON Schema
NameRequiredDescriptionDefault
methodYes
pathYes
bodyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description carries full burden. It discloses key behaviors: re-authenticates and retries on 401, raises on non-2xx, returns raw body text, expects JSON body. However, it does not cover rate limits or authentication details beyond re-auth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is reasonably concise with a clear first line, then Args section. Every sentence adds value, but slight redundancy ('Returns the raw response body as text' is repeated). Could be slightly more front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given output schema exists, description doesn't need to detail return values. It covers method, path, body, auth retry, and error handling. For a generic API call, this is sufficiently complete, though pagination or response format details are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description compensates fully. It explains method (HTTP verbs), path (after /api/v0, must start with '/'), and body (optional JSON, Content-Type set). Adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is for authenticated CML2 REST calls, specifying method, path, and body. It implies direct API access but does not explicitly differentiate from sibling cml_openapi, lacking explicit sibling distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for making authenticated REST calls to CML2 but offers no guidance on when to use this tool versus alternatives (like cml_openapi) or when not to use it. No exclusions or prerequisites mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cml_openapiA

Return CML2's live OpenAPI spec as a JSON string.

Cached at $CML_CACHE_DIR/openapi.json (default ~/.cache/cml/) for 24h. Set refresh=True to force a re-fetch.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses caching behavior (location, duration of 24h) and the ability to force a refresh with refresh=True. Since no annotations are provided, this fills a gap in transparency. It does not mention rate limits or authorization needs, but for a read-only retrieval tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences. The first sentence states the primary purpose immediately, and the second adds caching details and the parameter behavior. Every sentence earns its place with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists (though not provided), the description adequately covers the return value and caching. It does not mention error conditions or output format details, but the presence of an output schema reduces the need for such detail. The description is reasonably complete for a simple retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'refresh' is a boolean with default false, and the description explains it: 'Set refresh=True to force a re-fetch.' Although schema description coverage is 0%, the tool description compensates by clearly explaining the parameter's effect.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'CML2's live OpenAPI spec as a JSON string.' This is a specific verb (return) and resource (OpenAPI spec), and it differentiates from the sibling tool 'cml_api' which presumably handles general API calls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when the OpenAPI spec is needed, but does not explicitly state when to use this tool versus the sibling 'cml_api' or provide exclusions. Usage guidelines are implied but not elaborated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.1
    • First observedcml_api
    • First observedcml_openapi

TDQS

A3.9/5.0
Disambiguation5/5

The two tools have clearly distinct purposes: cml_api makes arbitrary REST calls to the CML2 API, while cml_openapi fetches the OpenAPI specification. There is no overlap in functionality.

Naming Consistency5/5

Both tools use the consistent prefix 'cml_' followed by a descriptive snake_case name ('api' and 'openapi'), following a clear pattern.

Tool Count2/5

With only two tools, the server is extremely minimal for what appears to be a full API wrapper. Most use cases would require the user to manually parse the OpenAPI spec and craft REST calls, making the tool set feel incomplete.

Completeness2/5

The server provides only a low-level API call tool and a spec fetcher, lacking any higher-level operations (e.g., CRUD for labs, devices, etc.). Users must implement all logic themselves, which is a significant gap for a CML2 integration.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    F
    maintenance
    A MCP server that exposes OpenAPI schema information to LLMs like Claude. This server allows an LLM to explore and understand large OpenAPI schemas through a set of specialized tools, without needing to load the whole schema into the context
    358
    50
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    MCP server that wraps any REST API with an OpenAPI spec, dynamically creating MCP tools at runtime without code generation.
    12
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/higebu/cml2-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server