secure-network-analytics-mcp-community

An MCP server that lets an AI agent connect to and
query a Cisco Secure Network Analytics (SNA) deployment — formerly Stealthwatch
Enterprise — over its REST API.

Tested against SNA Manager 7.6.0.

What it does

All SNA tools are read-only. They cover connectivity checks, flow/security-event
queries, top-N reports, host groups, users, and CTA incidents. An optional ISE ANC
module (below) can quarantine endpoints; its mutating tools are disabled by
default and only run when ISE_ENABLE_ANC_ACTIONS=true.

ISE ANC quarantine module (ise_anc_*)

The SNA→ISE Adaptive Network Control (ANC) quarantine is not exposed by
SNA's REST API (in SNA it's configured under Configure → Response Management
and executed internally over pxGrid). Programmatic quarantine lives on ISE's
ERS API (TCP 9060, Basic auth). This server includes a small ISE ANC module so
you can complete the detect→quarantine chain:

Requirements: ERS enabled in ISE (Administration → System → Settings → ERS
Settings) and an ERS Admin account. The mutating quarantine/clear tools
only run when ISE_ENABLE_ANC_ACTIONS=true; reads work without it.

Notes on the SNA API

• Auth is cookie/session based (not bearer). Login returns stealthwatch.jwt
  and XSRF-TOKEN cookies; the XSRF value must be echoed as X-XSRF-TOKEN on
  every non-GET request (SNA 7.3.2+). Sessions expire after ~20 min — the client
  re-authenticates automatically.
• Reporting is asynchronous: submit a query, poll for completion, then fetch
  results. The client handles both the v1 (status == COMPLETED / percentComplete)
  and v2 (percentComplete) flavours.
• SNA Managers ship a self-signed TLS cert; SNA_VERIFY_TLS defaults to
  false for lab use. Enable it (with a proper CA/cert) for production.
• On deployments with a Data Store (dataStoreType: CDS, see
  sna_get_domain_info), the legacy SOAP API (e.g. host snapshot) is not
  supported, so this server uses REST endpoints exclusively.

Output shaping (keeps results readable)

List-returning tools (flows, top-N reports, security events, host-group traffic,
flow sources, host groups, users) accept two optional args:

• max_items (default 50) — caps how many items are returned to you.
• fields — a list of dot-path field names to project, e.g.
  ["subject.ipAddress", "peer.ipAddress", "statistics.byteCount"].

They return an envelope so you always know if data was truncated:

{ "total": 1234, "returned": 50, "truncated": true, "items": [ ... ] }

Setup

git clone https://github.com/CiscoDevNet/secure-network-analytics-mcp-community.git
cd secure-network-analytics-mcp-community
python3 -m venv .venv && source .venv/bin/activate
pip install -e .        # add ".[dev]" for tests
cp .env.example .env    # then fill in your SNA (and optional ISE) credentials

The server auto-loads .env from the project root (or $SNA_ENV_FILE), and
real environment variables always take precedence.

Configuration

All settings come from environment variables (never hardcoded):

Run

# stdio transport (how MCP clients launch it)
sna-mcp
# or
python -m sna_mcp

Register in Cursor

Add to your MCP config (e.g. ~/.cursor/mcp.json), pointing at the venv python.
Keep credentials in .env rather than in the MCP config file:

{
  "mcpServers": {
    "sna": {
      "command": "/path/to/secure-network-analytics-mcp-community/.venv/bin/python",
      "args": ["-m", "sna_mcp"]
    }
  }
}

Tests

All tests are offline (HTTP is mocked with pytest-httpx); no SNA or ISE
system is needed. They include checks that the mutating ISE ANC tools refuse to
run unless ISE_ENABLE_ANC_ACTIONS=true.

pip install -e ".[dev]"
pytest

References

• Cisco DevNet: https://developer.cisco.com/docs/stealthwatch/enterprise/
• Sample scripts: https://github.com/CiscoDevNet/stealthwatch-enterprise-sample-scripts

Contributing, security, and license

• Contributions are welcome — see CONTRIBUTING.md and the
  Code of Conduct.
• Please report security issues privately as described in SECURITY.md.
• Licensed under the Apache License 2.0.