rust-junosmcp MCP server

rust-junosmcp

One MCP server for Juniper Junos and SRX devices, in Rust a mechub project — sovereign network-security automation

Unofficial / community project. This repository is an independent, community-driven project. It is not affiliated with, endorsed by, sponsored by, or supported by Hewlett Packard Enterprise or Juniper Networks. "HPE", "Juniper", "SRX", "JUNOS", "Security Director" and "Juniper Mist" are trademarks of their respective owners and are used here only to describe what this software interoperates with. Please direct support and licensing questions about those products to the respective vendors.

A Model Context Protocol server for Juniper Junos and SRX devices, written in Rust. The single rust-junosmcp process exposes the core Junos tools and, by default, the SRX security workflows through one tool registry and endpoint. It is drop-in compatible with Juniper/junos-mcp-server on the inventory format and core tool surface, but built on async Rust (rustEZ + rustnetconf) instead of PyEZ.

Beyond Juniper/junos-mcp-server

Drop-in on devices.json and the core tools — plus a lot the Python/PyEZ server doesn't have:

• Safer config — commitcheckconfig (validate, never commit), confirmed commits with auto-rollback, and discard_candidate to unstick a dirty candidate.
• Device lifecycle — staged upgradejunos (image → install → reboot → verify), SCP transferfile/fetch_file, PFE commands.
• Scale & UX — parallel session-pooled batch (~1.7× faster), | last N/| count + maxlines/maxbytes output caps, router/router_name aliases, Jinja2 templates.
• Transport & auth — streamable-HTTP with per-token router/tool scopes, TLS, and a Host allowlist; upstream is stdio-only.
• SRX tools (enabled by the default srx feature) — IDP & Application-ID signature-package updates (check/download/install/rollback), chassis-cluster health, license & security-services status, JTAC bundle with secret redaction, and read-only security-policy / address-book / application / NAT-rule inspection.

Performance

Benchmarked on 2026-10-05 against Juniper/junos-mcp-server 1.1.1 and shigechika/junos-mcp 0.18.0 / 0.22.0 with the same read-only workload on a vSRX lab device (Junos 26.2R1.7), 3 runs × 30 calls per operation, 0 failed calls. Medians across runs:

¹ the read-only bench login has no configuration view, so this measures a round trip with a ~400-byte reply, not a full config fetch. See docs/BENCHMARKS.md.

Full results, the mock-target overhead numbers, method and reproduction steps: docs/BENCHMARKS.md.

Shortened. The full README is on GitHub.