| name | nso-device-ops |
| description | Cisco NSO device operations — config retrieval, state inspection, sync, platform info, NED IDs, device groups. Use when retrieving device configs from NSO, checking sync status, pulling platform inventory, or inspecting NSO device groups and NED drivers |
| version | 1.0.0 |
| license | Apache-2.0 |
| tags | ["nso","orchestration","config","sync","restconf"] |
NSO Device Operations
MCP Server
- Command:
cisco-nso-mcp-server (pip-installed, stdio transport)
- Requires:
NSO_ADDRESS, NSO_USERNAME, NSO_PASSWORD environment variables
- Optional:
NSO_SCHEME (default: http), NSO_PORT (default: 8080), NSO_VERIFY, NSO_TIMEOUT
- API: RESTCONF (RFC 8040)
Available Tools
| Tool | Parameters | What It Does |
|---|
get_device_config | device_name | Get the full configuration for a device from NSO's CDB |
get_device_state | device_name | Get operational state data for a device (interfaces, counters, status) |
check_device_sync | device_name | Check if NSO's copy of the device config is in sync with the actual device |
sync_from_device | device_name | Pull the current config from the device into NSO's CDB (sync-from) |
get_device_platform | device_name | Get platform info: model, OS version, serial number, hardware details |
get_device_ned_ids | none | List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
get_device_groups | none | List all device groups defined in NSO |
MCP Resource
| Resource URI | What It Returns |
|---|
https://resources.cisco-nso-mcp.io/environment | NSO environment summary: device count, OS distribution, unique models, device series, group membership |
Workflow: Device Configuration Audit
When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":
- Get device groups:
get_device_groups to see how devices are organized
- Get config:
get_device_config for each target device
- Present: Format the configuration in a readable way
- Cross-reference: Compare with pyATS live config if discrepancies suspected
Workflow: Sync Check and Remediation
When a user asks "are my devices in sync?" or "is NSO up to date?":
- Check sync:
check_device_sync for the target device(s)
- If out of sync: Report which devices are out of sync and why
- Remediate: Use
sync_from_device to pull current config from the device into NSO
- Verify: Run
check_device_sync again to confirm sync is restored
- Record in GAIT: Log the sync operation for audit trail
Workflow: NSO Environment Overview
When a user asks "what's in NSO?" or "show me the NSO inventory":
- Environment resource: Read the NSO environment resource for the summary
- Device groups:
get_device_groups to see organizational structure
- NED IDs:
get_device_ned_ids to see what device types are managed
- Platform details:
get_device_platform for specific devices of interest
- Report: Summary table of devices, OS types, models, and group membership
Workflow: Pre-Change Baseline from NSO
Before making configuration changes:
- Get current config:
get_device_config to capture the NSO baseline
- Check sync:
check_device_sync to ensure NSO is current
- If out of sync:
sync_from_device first to get the latest state
- Save baseline: Commit the config to GAIT or GitHub for audit trail
- Proceed with change: Use pyATS or NSO services to apply changes
Workflow: Device Platform Inventory
When a user needs hardware/software details:
- Get platform:
get_device_platform for each device
- Compile report: Model, serial, OS version, hardware
- Cross-reference: Check NVD for CVEs against OS versions (use nvd-cve skill)
- Cross-reference: Compare with NetBox records for accuracy (use netbox-reconcile skill)
NSO Concepts
| Concept | Meaning |
|---|
| CDB | Configuration Database — NSO's copy of all device configs |
| NED | Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
| sync-from | Pull config from device into NSO CDB |
| sync-to | Push NSO CDB config to device (not available in this MCP — use services instead) |
| Device Group | Logical grouping of devices for bulk operations |
| Service | NSO service instance that provisions config across devices (see nso-service-mgmt skill) |
Integration with Other Skills
| Scenario | Integration |
|---|
| Config differs from NSO | Compare get_device_config (NSO) vs pyATS show running-config (live) |
| Device inventory audit | Compare get_device_platform (NSO) vs NetBox records |
| Pre-change validation | NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
| Vulnerability scanning | get_device_platform (OS version) → NVD CVE search |
| Config backup to GitHub | get_device_config → github-ops commit to repo |
Important Rules
- NSO is the orchestration layer — it manages device configs through RESTCONF/NETCONF, not CLI
- Always check sync before trusting config —
check_device_sync first
- sync_from_device pulls FROM the device — it overwrites NSO's CDB with what's actually on the device
- Read-heavy operations are safe — get_device_config, get_device_state, check_device_sync are non-destructive
- sync_from_device modifies NSO CDB — it's safe for the device but changes NSO's database
- Record in GAIT — log all NSO operations for audit trail
Environment Variables
NSO_SCHEME — http or https (default: http)NSO_ADDRESS — NSO server address (default: localhost)NSO_PORT — RESTCONF port (default: 8080)NSO_USERNAME — NSO username (default: admin)NSO_PASSWORD — NSO password (default: admin)NSO_VERIFY — Verify SSL certificate (default: true)NSO_TIMEOUT — Connection timeout in seconds (default: 10)
