{
  "markdown": "# Meraki MCP Server\n\n[![Build Status](https://github.com/WYRE-AI/meraki-mcp/actions/workflows/release.yml/badge.svg)](https://github.com/WYRE-AI/meraki-mcp/actions/workflows/release.yml)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![Node.js](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen.svg)](https://nodejs.org/)\n\nA [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides AI assistants with structured access to the [Cisco Meraki Dashboard](https://developer.cisco.com/meraki/api-v1/) — organizations, networks, devices, clients, wireless, switching, and appliance operations.\n\n> **Note:** This project is maintained by [Wyre Technology](https://github.com/WYRE-AI).\n\n## Quick Start\n\n**Claude Code (CLI):**\n\n```bash\nclaude mcp add meraki-mcp \\\n  -e MERAKI_API_KEY=your-api-key \\\n  -e MERAKI_ORG_ID=your-org-id \\\n  -- npx -y github:WYRE-AI/meraki-mcp\n```\n\nSee [Installation](#installation) for Docker and from-source methods.\n\n## Features\n\n- **🔌 MCP Protocol Compliance**: Full support for MCP tools over stdio and HTTP transports\n- **🌐 Network Coverage**: Tools spanning organizations, networks, devices, clients, wireless, switching, and appliance (MX) operations\n- **🔍 Flattened Navigation**: `meraki_navigate` and `meraki_status` are stateless discovery aids — every tool is callable at any time\n- **🛟 Safety by Default**: Read-only mode is **ON by default**; writes are gated and destructive actions require explicit confirmation\n- **🖼️ Interactive Device Card (MCP Apps)**: `meraki_devices_get` renders as a read-only interactive card in MCP Apps hosts (SEP-1865) — neutral by default, brandable via `window.__BRAND__` injection or `MCP_BRAND_*` env vars\n- **🧰 Long-Tail Escape Hatch**: `meraki_raw_request` reaches any Meraki v1 endpoint not covered by a curated tool\n- **🐳 Docker Ready**: Containerized deployment with HTTP transport and health checks\n- **📊 Structured Logging**: Configurable log levels\n\n## Installation\n\n### Option 1: Docker\n\n```bash\ndocker run -d \\\n  -e MERAKI_API_KEY=your-key \\\n  -e MERAKI_ORG_ID=your-org-id \\\n  -p 8080:8080 \\\n  ghcr.io/wyre-ai/meraki-mcp:latest\n```\n\n### Option 2: From Source\n\n```bash\ngit clone https://github.com/WYRE-AI/meraki-mcp.git\ncd meraki-mcp\nnpm ci\nnpm run build\n```\n\n## Configuration\n\n| Variable | Description | Default |\n|----------|-------------|---------|\n| `MERAKI_API_KEY` | Meraki Dashboard API key | — |\n| `MERAKI_ORG_ID` | Default organization ID (optional) | — |\n| `MERAKI_BASE_URL` | Override the Meraki API base URL (optional) | — |\n| `READ_ONLY_MODE` | Safety switch — blocks all writes when `true` | `true` |\n| `MCP_TRANSPORT` | Transport mode (`stdio` or `http`) | `stdio` |\n| `MCP_HTTP_PORT` | HTTP server port | `8080` |\n| `AUTH_MODE` | Auth mode (`env` or `gateway`) | `env` |\n| `LOG_LEVEL` | Log level (`debug`, `info`, `warn`, `error`) | `info` |\n\n> The legacy `READ_ONLY` variable is also honored; `READ_ONLY_MODE` takes precedence.\n\n## Safety Model\n\nThis server defaults to **read-only**. Write operations (updates, reboots, deletions) are blocked unless you explicitly set `READ_ONLY_MODE=false`.\n\n- **Read tools** (`*_list`, `*_get`) are always available.\n- **High-impact writes** (e.g. `meraki_networks_update`, `meraki_clients_update_policy`) are gated by read-only mode.\n- **Confirmation-gated tools** additionally require a `confirm_destructive_action: true` argument, even once `READ_ONLY_MODE=false`. The confirmation flag is never forwarded to the Meraki API. Two groups qualify:\n  - **Irreversible** — `meraki_networks_delete`, `meraki_devices_remove`.\n  - **High blast radius** — `meraki_appliance_firewall_l3_update`, `meraki_switch_ports_update`, `meraki_wireless_ssids_update`, `meraki_devices_reboot`. These are reversible in principle, but each is applied over the same network link the change can break, so an operator can lose the connectivity needed to undo it. `meraki_appliance_firewall_l3_update` also *replaces* the rule set — any rule not in the payload is deleted — and `meraki_wireless_ssids_update` drops every client on the SSID when the PSK or auth mode changes.\n- Confirmation is **not** an escape hatch from read-only mode: while `READ_ONLY_MODE` is on, a confirmed call is still blocked.\n- The **`meraki_raw_request`** escape hatch classifies the call by HTTP method: `GET` is a read; `POST`/`PUT`/`DELETE` are writes; `DELETE` is destructive.\n\n## Domains\n\nAll tools are returned upfront. Use `meraki_navigate` to explore a domain's tools, or `meraki_status` to check connectivity and the configured organization.\n\n| Domain | Tools |\n|--------|-------|\n| **organizations** | `meraki_organizations_list`, `meraki_organizations_get`, `meraki_organizations_inventory_list` |\n| **networks** | `meraki_networks_list`, `meraki_networks_get`, `meraki_networks_update` ⚠, `meraki_networks_delete` ⚠⚠ |\n| **devices** | `meraki_devices_list`, `meraki_devices_get`, `meraki_devices_reboot` ⚠⚠, `meraki_devices_remove` ⚠⚠ |\n| **clients** | `meraki_clients_list`, `meraki_clients_get`, `meraki_clients_get_policy`, `meraki_clients_update_policy` ⚠ |\n| **wireless** | `meraki_wireless_ssids_list`, `meraki_wireless_ssids_update` ⚠⚠, `meraki_wireless_rf_profiles_list` |\n| **switch** | `meraki_switch_ports_list`, `meraki_switch_ports_update` ⚠⚠, `meraki_switch_port_statuses_list` |\n| **appliance** | `meraki_appliance_firewall_l3_get`, `meraki_appliance_firewall_l3_update` ⚠⚠, `meraki_appliance_vpn_status_get` |\n| **(long tail)** | `meraki_raw_request` ⚠⚠ (on `DELETE`) |\n\n⚠ = high-impact write, gated by read-only mode · ⚠⚠ = additionally requires `confirm_destructive_action: true`\n\n## Docker Deployment\n\nCopy `.env.example` to `.env` and fill in your credentials:\n\n```bash\ncp .env.example .env\n# Edit .env with your Meraki API key (and org ID)\ndocker run --env-file .env -p 8080:8080 ghcr.io/wyre-ai/meraki-mcp:latest\n```\n\n## Development\n\n```bash\nnpm ci\nnpm run build       # Build the project\nnpm run start       # Run over stdio\nnpm run start:http  # Run the HTTP transport\nnpm run test        # Run tests\n```\n\n## Testing\n\n```bash\nnpm test\n```\n\nThe test suite covers the safety contract: read-only enforcement, destructive confirmation, and that `confirm_destructive_action` is never forwarded to the SDK.\n\n## License\n\nApache 2.0 — Copyright WYRE Technology\n",
  "bytes": 6387,
  "sha": "71cd05eb5082d59bf4ccb2be4280cf710aec8025f3cbeafa34a5ad080e1ef7e6",
  "repo_slug": "wyre-technology/meraki-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_wyre_technology_meraki_mcp_70012597/readme"
}