Connect AI assistants to Netpicker with the MCP server

The Netpicker MCP server connects an AI assistant or automation agent to the Netpicker API through the open Model Context Protocol (MCP). In practical terms, you can ask a compatible client to inspect devices, investigate backups, review compliance, triage CVEs, or run approved automation without building a separate integration for every workflow.

The current server exposes 60 tools across device management, configuration backups, compliance policies, automation jobs, schedules, CVEs, agents, and webhooks. Tools are annotated as read-only, write, destructive, or live-device operations so an MCP client can apply suitable confirmation rules.

What you need

• A running Netpicker instance that your MCP server can reach.
• Your Netpicker base API URL, tenant identifier, and API token.
• Node.js 22 (recommended) and npm, or Docker.
• An MCP-compatible client that supports local stdio servers or Streamable HTTP.

Option 1: run locally with Node.js

Clone the project, install its dependencies, and build it:

git clone https://gitlab.com/netpicker/netpicker-mcp-server.git
cd netpicker-mcp-server
npm install
npm run build

Create a .env file in the project directory:

NETPICKER_URL=https://your-netpicker.example/api/v1
NETPICKER_TENANT=your-tenant
NETPICKER_API_TOKEN=your-api-token

Start the server with the default stdio transport:

npm start

For a local MCP client, add a server entry like this and replace the path with the absolute path on your system:

{
  "mcpServers": {
    "netpicker": {
      "command": "node",
      "args": ["/absolute/path/to/netpicker-mcp-server/dist/index.js"],
      "env": {
        "NETPICKER_URL": "https://your-netpicker.example/api/v1",
        "NETPICKER_TENANT": "your-tenant",
        "NETPICKER_API_TOKEN": "your-api-token"
      }
    }
  }
}

Restart the MCP client after changing its configuration. A simple first test is to ask it to run get_api_status or list_devices.

Option 2: run with Docker

docker build -t netpicker-mcp .

docker run -p 3000:3000 \
  -e NETPICKER_URL=https://your-netpicker.example/api/v1 \
  -e NETPICKER_TENANT=your-tenant \
  -e NETPICKER_API_TOKEN=your-api-token \
  netpicker-mcp

The container uses Streamable HTTP by default. Point your MCP client to:

http://localhost:3000/mcp

Without Docker, you can enable the same transport with:

TRANSPORT=http HTTP_PORT=3000 npm start

Useful workflows

Investigate a backup problem

Ask for recent failed backups, inspect a device’s backup history, and retrieve the latest configuration. You can also search all current configurations for a command or setting.

Review compliance in plain language

Summarise the compliance overview, filter failed rules by policy or device, and inspect the latest status for a specific device. When appropriate, the server can start a new compliance run and retrieve the results later.

Triage network CVEs

List CVEs by affected-device count, find the devices affected by one CVE, or show all known CVEs for a device. This is useful for turning a broad vulnerability list into a prioritised remediation plan.

Build controlled automation

Create and test Netpicker automation jobs, execute them on selected devices, and inspect per-device results. For higher-risk changes, use the approval workflow so one person submits a job and another reviews it before execution. Recurring work can be managed through schedules.

Check operational health

List connected Netpicker agents, check API status, and manage webhooks that notify other systems when backups, compliance checks, or jobs finish.

Operate it safely

• Start with read-only tools and add write access only where there is a clear operational need.
• Require confirmation for destructive actions and anything that touches live devices, such as command execution, backups, job runs, or approvals.
• Keep the API token out of source control and client logs. Use a dedicated token with the minimum required permissions.
• Do not expose the HTTP endpoint directly to the public internet. Place shared deployments on a trusted network or behind an authenticated reverse proxy.
• Test write and live-device workflows in a non-production tenant first.

For the complete tool list and the latest setup instructions, see the Netpicker MCP server repository on GitLab.