This server provides an MCP interface to the Cisco Secure Access REST API, enabling AI clients to manage security infrastructure, policies, and deployments across five categories: Admin, Deployments, Policies, Investigate, and Reports.

Administration

• API Keys: List, get, create, refresh (rotate), and delete Secure Access API keys

• Alert Rules: List, get, create, and delete alert rules

• Tenants: List tenants for multi-org/MSSP environments

Deployments

• Network Tunnel Groups: List, get, create, and delete; list available regions

• Sites: List, get, create, and delete organizational sites

• Networks: List, get, create (by CIDR), and delete networks

• Roaming Computers: List (with filters), get, and delete endpoint devices

Policies

• Destination Lists: List, get, create, and delete allow/block lists (domains, URLs, IPs, CIDRs, apps)

• Destinations: List entries, add, and remove destinations within a list

• Access Rules: List, get, create, update, and delete access rules

• Application Lists: List, get, create, and delete application lists

Authentication is handled via OAuth 2.0 client credentials with automatic token refresh, and multi-organization support is available via SECURE_ACCESS_ORG_ID.

Provides tools for interacting with Cisco Secure Access REST API, enabling management of admin resources, deployments, investigations, policies, and reports in a Cisco Secure Access environment.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@cisco-secure-access-mcp show recent security alerts"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.

# 1. Clone and install (using uv)
git clone https://github.com/sdntechforum/Secure_Access.git
cd Secure_Access
uv sync

# 2. Provide your Cisco Secure Access API credentials via environment variables
# (Admin > API Keys in the Secure Access dashboard)
export SECURE_ACCESS_API_KEY=...
export SECURE_ACCESS_API_SECRET=...

# 3. Run the server (stdio transport, default)
uv run cisco-secure-access-mcp

python scripts/dump_catalog.py # human-readable text
python scripts/dump_catalog.py --json # machine-readable JSON

pytest -m integration tests/integration/test_list_coverage.py -v

.
├── AGENTS.md # Install + tool catalog + env vars (read this first if you're an AI agent)
├── CODE_OF_CONDUCT.md # Cisco DevNet template (unchanged)
├── CONTRIBUTING.md # Cisco DevNet template (project name filled in)
├── LICENSE # Apache-2.0 (Cisco DevNet template)
├── README.md # this file
├── SECURITY.md # Cisco DevNet template (project name filled in)
├── TOOLS.md # Full tool catalog (185 tools, per-module verification status)
├── install.md # Build journal — phases, troubleshooting, enhancements
├── pyproject.toml # Package metadata + entry point
├── Dockerfile # Optional secondary distribution
├── .env.example # Documented env vars; NEVER real secrets
├── scripts/
│ └── dump_catalog.py # Generates TOOLS.md content from the live registry
├── src/cisco_secure_access_mcp/
│ ├── server.py # FastMCP entrypoint (stdio default)
│ ├── auth.py # OAuth2 client-credentials + token cache
│ ├── client.py # httpx-based REST client (TLS-only, retry-aware)
│ ├── config.py # Env-var loading + validation
│ ├── errors.py # SDK / HTTP errors → MCP errors
│ ├── logging.py # Structured JSON logs with secret redaction
│ ├── registry.py # Discovers and registers tools from each category
│ └── tools/
│ ├── admin/ # admin_* — Admin Resources
│ ├── deployments/ # deploy_* — Deployments Resources
│ ├── investigate/ # investigate_* — Investigate Resources (v1.1)
│ ├── policies/ # policy_* — Policies Resources
│ └── reports/ # report_* — Reports Resources (v1.1)
└── tests/
 ├── unit/ # Offline; mock HTTP and clock
 └── integration/ # Opt-in; requires real DevNet sandbox credentials

# Unit tests only — fast, fully offline (default)
uv run pytest

# Live smoke tests against a real Secure Access tenant — opt-in only
export SECURE_ACCESS_API_KEY=...
export SECURE_ACCESS_API_SECRET=...
# optional: SECURE_ACCESS_ORG_ID, SECURE_ACCESS_BASE_URL
uv run pytest -m integration tests/integration

Looking for Admin?