How to connect an AI agent to rConfig V8 over MCP

rConfig runs a Model Context Protocol (MCP) server, so AI agents such as Claude Code, Cursor, and Gemini CLI can query your device inventory, configs, diffs, and compliance status directly. Instead of exporting a config and pasting it into a chat, you ask your agent “what changed on edge-fw-02 since yesterday?” and it fetches the answer from rConfig itself.

When to use this

• Investigations across many devices: “Find every device with snmp-server community public” searches all your stored configs at once.
• Working in your own tools: engineers who live in Claude Code or Cursor can pull rConfig data without switching to the rConfig UI.
• Building automation with an agent: an agent drafting a script can check real device names and config shapes as it goes.

For an offline, installable package instead of a live connection, see Skills.

Which agents work, and what to do with them

The Iris guides compare every common MCP client (including why ChatGPT can’t connect today) and walk through playbooks that combine rConfig with NetBox, Zabbix, Grafana and PagerDuty.

Prerequisites

• A permission to create tokens: aicenter.mcptoken for your own, or aicenter.update. See Tokens and permissions.
• An MCP-compatible agent that can reach your rConfig server over HTTPS.

Tokens and permissions

An agent connects with an MCP token. Each token belongs to one rConfig user, its owner, and sees only the devices the owner’s role can see. The token works only on the MCP endpoint, and only for reading.

Permission	What it allows on the MCP Server tab
aicenter.view	Open the tab and see your own tokens. Can’t create or revoke them.
aicenter.mcptoken	Create and revoke your own tokens. It doesn’t allow changing AI providers or settings, so give it to engineers who connect agents.
aicenter.update	Everything above, plus: see and revoke the tokens of users you manage, and create a token owned by one of them, such as a service user. Admins have it.

“Users you manage” follows the same rule as user management: an Admin manages everyone; anyone else manages only users whose role ranks below theirs.

• Expiry. A new token lasts 1 year unless you choose 30 days, 90 days, a custom date, or No expiry. An expired token is refused with 401 Unauthorized.
• Audit. Every token created or revoked is recorded in the activity log with who did it, the owner, the token name and its expiry. Every tool call is logged too (see below).
• No secret recovery. A token is shown once, when it’s created. If it’s lost, revoke it and create another.

What the MCP server exposes

Setting	Value
Endpoint	https://<your-rconfig-server>/mcp (copy it from the MCP Server tab)
Transport	Streamable HTTP
Authentication	Bearer token with the mcp:read scope
Scope	Read-only

Eight tools are available. You never call them by name; your agent picks the right one from a plain-language request.

Tool	What it does	Example request
get_devices	Lists devices, filtered by name, vendor, group (category), or tag. 50 per page.	“List all Cisco devices in the core group”
get_device	Gets one device by its ID	“Show me the details of device 42”
get_latest_config	Gets a device’s most recent config, including its content. Can be limited to one command.	“Show me the latest running config for switch-01”
get_config	Gets one stored config version by its ID, including its content.	“Show me core-sw-01’s running config from June 1”
get_config_history	Lists a device’s config versions, newest first (metadata only)	“When did core-sw-01’s config last change?”
get_config_diff	Diffs two config versions of the same device	“What changed on edge-fw-02 since yesterday?”
search_configs	Searches stored configs for text and returns matching lines	“Find every device with snmp-server community public”
get_compliance_status	Reports policy compliance for one device or a whole group	“Is core-sw-01 compliant?”

A device often collects more than one command, for example show running-config and show version. On its own, get_latest_config returns the newest output of any of them. It also takes an optional command filter (partial and case-insensitive, like the one on get_config_history), so a request for “the running config” gets the running config even when show version ran later. Your agent adds the filter when the request names a command, and every result includes a command field showing which output it is.

Every result is limited to the devices the token’s owner can see under Roles, and secrets in config content are obfuscated before they leave rConfig. Every tool call is recorded in the rConfig activity log with the tool name and outcome; the arguments are not stored.

Search limits

To stay fast on large estates, search_configs checks the latest config per device by default, scans up to 500 configs, skips files over 10 MiB, and stops after about 5 seconds. When a search is cut short, the agent is told so and can narrow the query by device or command.

Step-by-step walkthrough

1. Open the MCP Server tab

Click AI Center in the left sidebar and select the MCP Server tab. The endpoint card shows the MCP URL with a copy button, and a status of Active or Action needed.

If you don’t have a token yet, a banner says The MCP endpoint is live, but you don’t have an MCP access token yet.

2. Create an MCP token

1. Click Create MCP Token (in the banner) or New MCP Token (in the MCP Access Tokens section).
2. Enter a Token name that says where it’s used, such as “Claude Code on my laptop”. Names must be unique for the token’s owner.
3. Choose when it Expires: 30 days, 90 days, 1 year (the default), a custom date, or No expiry. Choosing No expiry shows a warning, because the token then works until someone revokes it.
4. Click Generate Token and copy the token straight away.

Shown once

The token is displayed only once. Revoke it with the trash icon in MCP Access Tokens when it’s no longer needed. Revoking takes effect immediately and has no confirmation step.

The Expires column shows each token’s expiry date, Never, or Expired. When a token expires, create a new one and update your agent’s config.

MCP tokens and REST API tokens are separate. An MCP token only works on the MCP endpoint, and a REST API token can’t be used for MCP.

Create a token for another user

Users with aicenter.update see a Token for field. Leave it as Yourself, or pick a user, such as a service user for an automation. The token belongs to that user and sees only the devices their role can see, not yours. That’s how you give an agent narrower access than your own without signing in as someone else.

The list only offers users you’re allowed to manage: everyone if you’re an Admin, otherwise users whose role ranks below yours. Hand the token over securely, because it’s shown only once.

See and revoke other users’ tokens

Users with aicenter.update also see the tokens of the users they manage in MCP Access Tokens, with an Owner column, and can revoke them. Everyone else sees only their own tokens. Every token created or revoked is recorded in the activity log with who did it, whose token it was, its name and its expiry.

3. Connect your agent

Copy the snippet for your client from the Connect Your Agent section; the endpoint URL is already filled in for your server. Replace YOUR_MCP_TOKEN with your token, then restart the client.

Claude Code

claude mcp add --transport http rconfig https://<your-rconfig-server>/mcp \
  --header "Authorization: Bearer YOUR_MCP_TOKEN"

Claude Desktop

Claude Desktop connects through the mcp-remote bridge, which needs Node.js. Add this to claude_desktop_config.json:

{
  "mcpServers": {
    "rconfig": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://<your-rconfig-server>/mcp",
        "--header", "Authorization: Bearer YOUR_MCP_TOKEN"
      ]
    }
  }
}

Cursor

Add this to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "rconfig": {
      "url": "https://<your-rconfig-server>/mcp",
      "headers": { "Authorization": "Bearer YOUR_MCP_TOKEN" }
    }
  }
}

Gemini CLI

Add this to ~/.gemini/settings.json. Gemini CLI uses httpUrl for streamable HTTP servers:

{
  "mcpServers": {
    "rconfig": {
      "httpUrl": "https://<your-rconfig-server>/mcp",
      "headers": { "Authorization": "Bearer YOUR_MCP_TOKEN" }
    }
  }
}

Google replaced Gemini CLI with Antigravity CLI for unpaid and Google One accounts on 18 June 2026. It still runs with a Gemini API key or a Gemini Code Assist Standard or Enterprise licence.

VS Code

Add this to .vscode/mcp.json in your workspace. VS Code prompts for the token the first time the server starts and stores it securely, so it never sits in the file:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "rconfig-token",
      "description": "rConfig MCP token",
      "password": true
    }
  ],
  "servers": {
    "rconfig": {
      "type": "http",
      "url": "https://<your-rconfig-server>/mcp",
      "headers": { "Authorization": "Bearer ${input:rconfig-token}" }
    }
  }
}

Codex CLI

Add this to ~/.codex/config.toml, then set RCONFIG_MCP_TOKEN in the environment Codex runs in:

[mcp_servers.rconfig]
url = "https://<your-rconfig-server>/mcp"
bearer_token_env_var = "RCONFIG_MCP_TOKEN"

Other

Point any MCP client at the endpoint with these settings:

URL:        https://<your-rconfig-server>/mcp
Transport:  Streamable HTTP
Auth:       Authorization: Bearer YOUR_MCP_TOKEN

Most clients accept the same mcpServers block shown in the Cursor tab. Field names change between client releases; if one doesn’t match, check your client’s MCP documentation.

Self-signed or internal-CA certificates

The endpoint is HTTPS only. With a self-signed or internal-CA certificate, most agents fail with a generic “failed to connect” and no TLS detail. Don’t disable certificate checks globally. Trust the certificate instead: for Claude Code, set NODE_EXTRA_CA_CERTS to the path of the rConfig certificate. Hosted agents running outside your network can’t reach an internal-only address at all.

4. Verify the connection

• Claude Code: run /mcp. rconfig should be listed as connected with 8 tools.

• Cursor: open the MCP settings panel. rconfig shows a green dot and its tool list.

• Any client: from the machine running the agent, check the token is accepted:

  curl -s -o /dev/null -w "%{http_code}\n" -X POST https://<your-rconfig-server>/mcp \
    -H "Authorization: Bearer YOUR_MCP_TOKEN" \
    -H "Content-Type: application/json" -d '{}'

  401 means the token was rejected. Any other code means the server is reachable and the token is valid. Use POST: a plain GET to /mcp always returns 405, whatever the token.

Example session

Scenario: a security advisory says SNMP community public must be removed everywhere. You ask your agent:

“Using rConfig, find every device whose latest config still has snmp-server community public, group them by vendor, and tell me which ones are in the core group.”

The agent calls search_configs to find the matching configs, then get_devices to look up vendor and group, and replies with a grouped list.

More things to try: “What changed on edge-fw-02 since yesterday?”, “Is everything in the datacenter group compliant?”, “Show me the latest config for switch-01 and explain its spanning-tree setup.”

Common gotchas

Common connection issues

• Lost token: tokens can’t be shown again. Revoke it and create a new one.
• 401 Unauthorized: the token expired, was revoked, was mistyped, or is a REST API token rather than an MCP token. The header must be exactly Authorization: Bearer <token>.
• Agent sees no devices, or fewer than expected: results follow the token owner’s role. Check that user’s device access in Roles.
• Generic “failed to connect”: almost always a certificate trust problem with self-signed or internal-CA certificates. See the note above.
• Asking the agent to change a device: every tool is read-only. The MCP server has no write path by design.

What’s next

• Download the rConfig Skill for portable agent setup
• Generate AI-friendly REST API docs
• Review what data leaves your network