VeilStrat

You deploy the Junos MCP Server to let large language models securely interact with Juniper devices. It provides a bridge between your network gear and AI assistants, enabling tasks like retrieving device state, running commands, and applying configurations through structured prompts while keeping security and auditing in mind.

How to use

You use the MCP server by running it locally or in a container and connecting your MCP/IDE client (such as VSCode) to the server’s transport. The server supports two transports: stdio for local desktop clients and streamable-http for web-based clients. In VSCode or similar tools, you typically interact via the streamable-http endpoint, sending requests that map to tool handlers like showing BGP neighbors, gathering device facts, or loading configurations.

How to install

Prerequisites: Python and a compatible runtime are required. You also need access to your Junos devices and any SSH keys you plan to use.

Step-by-step commands to get started locally with Python and the MCP server core:

# Clone the project
git clone https://github.com/Juniper/junos-mcp-server.git
cd junos-mcp-server

# Install dependencies
pip install -r requirements.txt

# Run the server with the stdio transport (local testing)
python jmcp.py -f devices.json -t stdio

Configuration

Configure the MCP server for your environment using the prepared JSON-based configuration. Two common setups are shown: a Claude Desktop/stdio configuration and a Claude Desktop/uv configuration. When using Docker, you can mount your device mapping and SSH keys into the container and run the server with standard Python invocations.

# Claude Desktop (stdio transport) configuration
{
  "mcpServers": {
    "jmcp": {
      "type": "stdio",
      "command": "python3",
      "args": ["jmcp.py", "-f", "devices.json", "-t", "stdio"]
    }
  }
}

# Claude Desktop (using uv)
{
  "mcpServers": {
    "jmcp": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "python", "jmcp.py", "-f", "devices.json", "-t", "stdio"]
    }
  }
}

# Claude Desktop (Docker container)
{
  "mcpServers": {
    "jmcp": {
      "type": "stdio",
      "command": "/usr/local/bin/docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-v",
        "devices.json:/app/config/devices.json",
        "-v",
        "vsrx_keypair.pem:/app/config/vsrx_keypair.pem",
        "junos-mcp-server:latest"
      ]
    }
  }
}

Docker Usage

You can run the MCP server inside a Docker container and map in your device configuration and any SSH keys needed for authentication. The container defaults to stdio transport, but you can override arguments to run streamable-http as well.

# Build the container
$ docker build -t junos-mcp-server:latest .

# Run with default settings (stdio transport)
$ docker run --rm -it -v /path/to/your/devices.json:/app/config/devices.json junos-mcp-server:latest

# Override default arguments for stdio
$ docker run --rm -it -v /path/to/your/devices.json:/app/config/devices.json junos-mcp-server:latest python jmcp.py -f /app/config/devices.json -t stdio

# Override for streamable-http with a custom port
$ docker run --rm -it -v /path/to/your/devices.json:/app/config/devices.json -p 30030:30030 junos-mcp-server:latest python jmcp.py -f /app/config/devices.json -t streamable-http -p 30030 -H 0.0.0.0

Junos Device Configuration

The MCP server supports SSH key-based authentication and password-based authentication for Junos devices. You provide a device mapping that includes the target IP, port, username, and authentication details. SSH keys are preferred for security.

Example device configuration snippet showing both password and SSH key approaches, including a jumphost scenario and a proxy command for access through an intermediary host.

{
  "router-1": {
    "ip": "ip-addr",
    "port": 22,
    "username": "user",
    "auth": {
      "type": "password",
      "password": "pwd"
    }
  },
  "router-2": {
    "ip": "ip-addr",
    "port": 22,
    "username": "user",
    "auth": {
      "type": "ssh_key",
      "private_key_path": "/path/to/private/key.pem"
    }
  },
  "router-3": {
    "ip": "ip-addr",
    "port": 22,
    "username": "user",
    "ssh_config": "~/.ssh/config_dc",
    "auth": {
      "type": "ssh_key",
      "private_key_path": "/path/to/private/key.pem"
    }
  },
  "router-4": {
    "ip": "ip-addr",
    "port": 22,
    "username": "user",
    "ssh_config": "/home/user/.ssh/config_jumphost",
    "auth": {
      "type": "password",
      "password": "pwd"
    }
  }
}

Dynamic Device Management with Elicitation

You can dynamically add Junos devices using the elicitation feature. This interactive flow collects device name, IP, port, username, and SSH key path, validates inputs, and registers the device for immediate use. Elicitation is currently supported in VSCode with streamable-http transport; Claude Desktop does not yet support elicitation.

Key notes for the add_device tool: SSH key authentication is required; there is no password option; devices are stored in memory and will not persist after a restart; you have five minutes to respond to prompts.

# Example interaction in VSCode with Copilot:
@jmcp Please add a new device to the MCP server

VSCode + GitHub Copilot Integration

Start the server and connect from VSCode by pointing the MCP client to the server URL. The server runs an HTTP endpoint that VSCode can reach for tool calls and responses.

$ python3.11 jmcp.py -f devices.json
[06/11/25 08:26:11] INFO     Starting MCP server 'jmcp-server' with transport 'streamable-http' on http://127.0.0.1:30030/mcp
INFO:     Started server process [33512]
INFO:     Waiting for application startup.
INFO:     Application startup complete.
INFO:     Uvicorn running on http://127.0.0.1:30030 (Press CTRL+C to quit)

Authentication for MCP Server Access

The server supports token-based authentication for streamable-http transport, providing secure access to your network infrastructure.

Token management, server status, and client configuration are used to enable secure access. Tokens are managed via a token management tool and can be added, listed, shown, or revoked as needed.

Using MCP Server with Juniper Cloud-Native Router (JCNR)

The MCP server can be used with JCNR by enabling SSH access on a non-default port, enabling authentication, and enabling Netconf over SSH. This setup typically involves configuring SSH services and root authentication on JCNR components.

Developer Guide

The server exposes a core MCP implementation, a set of tool handlers, and a transport layer that supports stdio for local development and streamable-http for web clients. Tools are registered in a central registry and expose metadata that describes their inputs and behavior.

Available tools

add_device

Dynamically add a new Junos device using elicitation to collect device name, IP, SSH port, username, and SSH key path; available in VSCode with streamable-http transport

show_bgp_neighbors

Show BGP neighbors or BGP summary from a specified router using the MCP tool flow

execute_junos_command

Run a Junos CLI command on a specified device and return the result

get_junos_config

Retrieve the current Junos configuration from a device via the tool interface

gather_device_facts

Collect basic facts about a device such as model, version, and interfaces

get_router_list

List configured routers in the device mapping with their connection details

load_and_commit_config

Load and commit a configuration snippet to a target device via the MCP tool flow

Junos

Documentation & install

Installation