Infoblox Ddi MCP

    

Infoblox DDI——MCP服务器

26个意图级工作流工具 用于通过模型上下文协议管理Infoblox通用DDI。

任何与MCP兼容的AI代理都可以管理您的整个DDI基础设施——DNS、DHCP、IPAM、安全和联盟——而无需成为Infoblox专家。

______________________________________________________________________

为什么使用Intent-Level工具（不是1:1 API映射）

Infoblox通用DDI平台具有 300多个REST API端点 跨DDI、安全和洞察服务。一个简单的MCP实现会将每个端点作为一个单独的工具公开。此服务器采用了一种根本不同的方法： 26个意图级工作流工具 由...支持 303 API方法 将多步操作抽象为单个调用。

1:1映射的问题：

# What an agent must do to provision a host with 1:1 tools (7 API calls):
1. list_ip_spaces(filter="name==prod")          → resolve space name to ID
2. list_subnets(filter="space==ipam/ip_space/1") → find subnets
3. get_next_available_ip(subnet_id)              → allocate IP
4. list_auth_zones(filter="fqdn==example.com")   → resolve zone
5. create_ipam_host(name, addresses, ...)        → create host
6. create_dns_record(type="A", ...)              → create A record
7. create_dns_record(type="PTR", ...)            → create PTR record

# Same operation with intent-level tool (1 call):
provision_host(hostname="web-01", space="prod", zone="example.com")

关键设计原则：

• 每个用户意图一个工具 --“配置主机”、“诊断DNS”、“调查威胁”
• 解析程序句柄名称→ID映射 --代理传递人类可读的名称，而不是资源ID
• 默认情况下进行试运行 在所有变异操作中，代理必须明确选择参与
• 指导下一步行动 --每个回复都会提示下一步该做什么，减少多次来回

______________________________________________________________________

快速开始

选项A:uv（推荐）

cd infoblox-ddi-mcp

# Install dependencies
uv pip install -r requirements.txt

# Configure credentials
cp .env.example .env
# Edit .env — add INFOBLOX_API_KEY

# Run (stdio)
uv run python mcp_intent.py

# Run (HTTP)
uv run python mcp_intent.py --http

选项B:Docker（一个命令）

docker build -t infoblox-ddi-mcp .
docker run -p 4005:4005 -e INFOBLOX_API_KEY=your_key infoblox-ddi-mcp

或者使用docker compose（读 .env 自动）：

cp .env.example .env   # add your INFOBLOX_API_KEY
docker compose up -d

选项C:pip安装

cd infoblox-ddi-mcp
pip install .

# Now available as a CLI command:
infoblox-ddi-mcp --http

运输方式

Stdio传输通过stdin/stdout JSON-RPC进行通信。HTTP传输在端口4005上运行符合规范的MCP服务器（可通过以下方式配置 MCP_PORT).

配置

当 MCP_AUTH_TOKEN 已设置，所有HTTP请求必须包括 Authorization: Bearer .Stdio传输不受影响（身份验证由主机进程处理）。

______________________________________________________________________

连接到AI框架

克劳德桌面版

添加 ~/Library/Application Support/Claude/claude_desktop_config.json （macOS）或 %APPDATA%\Claude\claude_desktop_config.json （Windows）：

{
  "mcpServers": {
    "infoblox-ddi": {
      "command": "python",
      "args": ["/absolute/path/to/infoblox-ddi-mcp/mcp_intent.py"],
      "env": {
        "INFOBLOX_API_KEY": "your_api_key_here",
        "INFOBLOX_BASE_URL": "https://csp.infoblox.com"
      }
    }
  }
}

重新启动Claude Desktop——工具选择器中会显示26个工具。

克劳德代码（CLI）

# Add the MCP server (stdio — Claude Code launches the process)
claude mcp add infoblox-ddi -e INFOBLOX_API_KEY=your_api_key_here -- python /absolute/path/to/infoblox-ddi-mcp/mcp_intent.py

# Or connect to a running HTTP server
claude mcp add --transport http infoblox-ddi http://localhost:4005/mcp

Anthropic Python SDK

import anthropic

client = anthropic.Anthropic()

response = client.beta.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=1024,
    mcp_servers=[
        {
            "type": "url",
            "url": "https://your-gateway.example.com/mcp",  # must be HTTPS
            "name": "infoblox-ddi",
            "authorization_token": "your_mcp_auth_token",   # optional, if MCP_AUTH_TOKEN is set
        }
    ],
    tools=[
        {
            "type": "mcp_toolset",
            "mcp_server_name": "infoblox-ddi",
        }
    ],
    messages=[{"role": "user", "content": "Show me all IP spaces and their utilization"}],
    betas=["mcp-client-2025-11-20"],
)

注： Anthropic MCP连接器要求服务器可以通过HTTPS访问。对于本地测试，请使用Claude Desktop（stdio）。

语言链/语言图

from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient(
    {
        "infoblox-ddi-stdio": {
            "command": "python",
            "args": ["/path/to/infoblox-ddi-mcp/mcp_intent.py"],
            "transport": "stdio",
        },
        # Or use HTTP (streamable_http is recommended over sse):
        # "infoblox-ddi-http": {
        #     "url": "http://127.0.0.1:4005/mcp",
        #     "transport": "streamable_http",
        # },
    }
)

tools = await client.get_tools()
# Use with any LangChain agent or LangGraph workflow

OpenAI代理SDK

from agents import Agent, Runner
from agents.mcp import MCPServerStdio, MCPServerStreamableHttp

# Option A: stdio transport
async with MCPServerStdio(
    name="infoblox-ddi",
    params={
        "command": "python",
        "args": ["/path/to/infoblox-ddi-mcp/mcp_intent.py"],
    },
) as server:
    agent = Agent(name="ddi-agent", mcp_servers=[server])
    result = await Runner.run(agent, "Show me all IP spaces")
    print(result.final_output)

# Option B: HTTP streamable transport (start server first with --http)
async with MCPServerStreamableHttp(
    name="infoblox-ddi",
    params={"url": "http://127.0.0.1:4005/mcp"},
) as server:
    agent = Agent(name="ddi-agent", mcp_servers=[server])
    result = await Runner.run(agent, "List all DNS zones")
    print(result.final_output)

光标IDE

添加 .cursor/mcp.json 在项目根目录中：

{
  "mcpServers": {
    "infoblox-ddi": {
      "command": "python",
      "args": ["/absolute/path/to/infoblox-ddi-mcp/mcp_intent.py"],
      "env": {
        "INFOBLOX_API_KEY": "your_api_key_here"
      }
    }
  }
}

Windsurf IDE

添加 ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "infoblox-ddi": {
      "command": "python",
      "args": ["/absolute/path/to/infoblox-ddi-mcp/mcp_intent.py"],
      "env": {
        "INFOBLOX_API_KEY": "your_api_key_here"
      }
    }
  }
}

HCL BigFix AEX

AEX具有原生MCP客户端支持。在 管理控制台→ 代理工作室:

1. 添加MCP服务器工具源
2. 将端点设置为 http://:4005/mcp
3. 使用启动服务器 python mcp_intent.py --http
4. 这26个工具是自动发现的，可供AEX特工使用

任何HTTP客户端

# Step 1: Initialize session (capture the Mcp-Session-Id header from the response)
curl -v -X POST http://127.0.0.1:4005/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1.0"}
    }
  }'
# Look for the response header: Mcp-Session-Id: 

# Step 2: List available tools (pass the session ID from step 1)
curl -X POST http://127.0.0.1:4005/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: " \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list"}'

# Step 3: Call a tool
curl -X POST http://127.0.0.1:4005/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: " \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "explore_network",
      "arguments": {"depth": "summary"}
    }
  }'

远程访问（HTTP传输）

任何兼容MCP的客户端都可以通过HTTP进行远程连接。使用启动服务器 --http 并将客户端指向端点：

http://:4005/mcp

本地网络：

# Start the server
python mcp_intent.py --http

# Any client on the network connects to:
# http://192.168.1.100:4005/mcp

Docker（远程主机）：

docker run -p 4005:4005 -e INFOBLOX_API_KEY=your_key infoblox-ddi-mcp

# Clients connect to:
# http://your-docker-host:4005/mcp

通过身份验证：

# Start with auth token
MCP_AUTH_TOKEN=my-secret-token python mcp_intent.py --http

# Clients must include the header:
# Authorization: Bearer my-secret-token

生产（TLS）： 对于交互部署，将服务器放置在处理TLS的反向代理（nginx，API网关）后面。看 生产部署 在......下面

摘要： stdio =客户端在本地启动服务器。 HTTP =服务器独立运行，客户端连接到 http://host:4005/mcp.使用 MCP_AUTH_TOKEN 以保护HTTP访问。

______________________________________________________________________

可用工具

发现与探索（只读）

配置（写入）

故障排除（只读）

安全（读+写）

IPAM管理（CRUD）

DNS配置（CRUD）

DHCP配置（CRUD）

DNS流量控制（CRUD）

联邦（CRUD）

报告（只读）

______________________________________________________________________

响应格式

每个工具都返回一个标准信封：

{
  "status": "success | partial | failed",
  "summary": "Human-readable one-liner",
  "steps": [
    {"step": "Resolve IP space", "status": "success", "result": {"space_id": "ipam/ip_space/abc"}},
    {"step": "Create subnet", "status": "success", "result": {"id": "ipam/subnet/xyz"}}
  ],
  "result": { "..." : "..." },
  "warnings": ["Optional warnings"],
  "next_actions": ["Suggested follow-up tool calls"]
}

这使得任何LLM都很容易：

• 检查 status 了解操作是否成功
• 阅读 summary 向用户显示一行答案
• 检查 steps 了解多步骤工作流
• 跟随 next_actions 智能跟进建议

______________________________________________________________________

对话示例

“显示我们网络中的内容”

→ explore_network(depth="full")
→ Returns hierarchical tree: IP spaces → address blocks → subnets with utilization %

“在prod空间中为web服务器创建/24子网”

→ manage_network(resource_type="subnet", action="create", address="10.20.3.0/24", space="prod", comment="Web servers")
→ Resolves space name → ID, validates CIDR, creates subnet

“在产品空间中设置一个名为web-prod-01的新主机”

→ provision_host(hostname="web-prod-01", space="prod", subnet="10.20.3.0/24", zone="example.com", view="default")
→ Auto-assigns next available IP (10.20.3.50), creates IPAM host + DNS A/PTR atomically

“配置web-prod-02，但我想单独管理DNS记录”

→ provision_host(hostname="web-prod-02", ip="10.20.3.51", space="prod", zone="example.com", auto_dns=False)
→ Creates IPAM host, then A and PTR records as separate API calls

“DNS不适用于api.example.com”

→ diagnose_dns(domain="api.example.com")
→ Returns zone status, records found, security blocks, and fix recommendations

“为新数据库服务器保留10.20.3.100”

→ manage_ip_reservation(action="reserve", address="10.20.3.100", space="prod", hostname="db-01", mac="AA:BB:CC:DD:EE:FF")
→ Checks availability, validates MAC, creates fixed address reservation

“关闭所有低优先级安全见解”

→ triage_security_insight(action="bulk_triage", priority_filter="low", status="CLOSED", dry_run=True)
→ DRY RUN: Shows 15 insights that would be closed
→ triage_security_insight(action="bulk_triage", priority_filter="low", status="CLOSED", dry_run=False)
→ Bulk closes 15 insights

“如果我停用web-prod-01会发生什么？”

→ decommission_host(identifier="web-prod-01", dry_run=True)
→ "Would delete: 1 host, 1 A record, 1 PTR, release IP 10.20.3.50"

______________________________________________________________________

Docker部署

# Build
make docker-build        # or: docker build -t infoblox-ddi-mcp .

# Run standalone
make docker-run          # or: docker run --rm -p 4005:4005 -e INFOBLOX_API_KEY=... infoblox-ddi-mcp

# Run with compose (reads .env)
make docker-up           # or: docker compose up -d
make docker-down         # or: docker compose down

Docker镜像：

• 用途 多阶段构建 （小最终图像）
• 运行为 非根 用户
• 有一个 健康检查 内置
• 绑定到 0.0.0.0:4005 默认情况下
• 通过环境变量接受所有配置

开放遥测（可选）

分布式跟踪是可选的额外功能：

pip install infoblox-ddi-mcp[otel]

通过设置启用 OTEL_EXPORTER_OTLP_ENDPOINT:

export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
python mcp_intent.py --http

所有MCP工具调用都会自动跟踪服务名称 infoblox-ddi-mcp。可与Jaeger、Grafana Tempo、Datadog或任何兼容OTLP的后端配合使用。如果未安装软件包，服务器将正常运行而不进行跟踪。

______________________________________________________________________

生产部署

API网关后面（推荐）

对于生产环境，请在API网关后面运行MCP服务器，以进行TLS终止、速率限制和集中身份验证。

Production Deployment

MCP服务器在内部运行纯HTTP。网关处理TLS和外部身份验证。集 MCP_AUTH_TOKEN 作为网关和服务器之间的共享秘密，以提供额外的安全层。

Kubernetes/Docker编写

# docker-compose.prod.yml
services:
  infoblox-mcp:
    image: infoblox-ddi-mcp:latest
    restart: always
    environment:
      - INFOBLOX_API_KEY=${INFOBLOX_API_KEY}
      - INFOBLOX_BASE_URL=${INFOBLOX_BASE_URL:-https://csp.infoblox.com}
      - MCP_HOST=0.0.0.0
      - MCP_PORT=4005
      - MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN}
    ports:
      - "127.0.0.1:4005:4005"   # bind to localhost only — gateway handles external traffic
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4005/mcp')"]
      interval: 30s
      timeout: 5s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

Nginx反向代理示例

upstream mcp_backend {
    server 127.0.0.1:4005;
}

server {
    listen 443 ssl;
    server_name mcp.example.com;

    ssl_certificate     /etc/ssl/certs/mcp.crt;
    ssl_certificate_key /etc/ssl/private/mcp.key;

    location /mcp {
        proxy_pass http://mcp_backend/mcp;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Authorization "Bearer ${MCP_AUTH_TOKEN}";

        # Rate limiting
        limit_req zone=mcp burst=20 nodelay;
    }
}

AWS API网关

1. 在API网关中创建HTTP API
2. 添加路线： POST /mcp → 与端口4005上的ECS/EKS服务集成
3. 附加Lambda授权器或Cognito用户池进行身份验证
4. 启用CloudWatch日志记录以进行审计跟踪

Kubernetes部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: infoblox-mcp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: infoblox-mcp
  template:
    metadata:
      labels:
        app: infoblox-mcp
    spec:
      containers:
        - name: mcp
          image: infoblox-ddi-mcp:latest
          ports:
            - containerPort: 4005
          env:
            - name: INFOBLOX_API_KEY
              valueFrom:
                secretKeyRef:
                  name: infoblox-secrets
                  key: api-key
            - name: MCP_AUTH_TOKEN
              valueFrom:
                secretKeyRef:
                  name: infoblox-secrets
                  key: mcp-token
          livenessProbe:
            httpGet:
              path: /mcp
              port: 4005
            initialDelaySeconds: 10
            periodSeconds: 30
          resources:
            limits:
              memory: "512Mi"
              cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: infoblox-mcp
spec:
  selector:
    app: infoblox-mcp
  ports:
    - port: 4005
      targetPort: 4005

部署检查表

______________________________________________________________________

生成文件目标

make install        Install dependencies with uv
make dev            Install in editable mode
make run            Run MCP server (stdio)
make run-http       Run MCP server (HTTP)
make lint           Run ruff linter
make format         Run ruff formatter
make test           Run test suite (163 tests)
make docker-build   Build Docker image
make docker-run     Run Docker container
make docker-up      Start with docker compose
make docker-down    Stop docker compose
make check          Verify syntax
make clean          Remove build artifacts

______________________________________________________________________

建筑

Architecture

______________________________________________________________________

项目结构

infoblox-ddi-mcp/
├── mcp_intent.py              ← MCP server entry point (run this)
├── services/
│   ├── infoblox_client.py     ← Infoblox DDI API client (90 methods)
│   ├── insights_client.py     ← SOC Insights API client (13 methods)
│   ├── atcfw_client.py        ← DNS Security API client (12 methods)
│   └── metrics.py             ← Internal metrics collection
├── tests/                     ← 163 tests (validators, resolvers, tools, resources)
│   ├── conftest.py
│   ├── test_validation.py
│   ├── test_resolvers.py
│   ├── test_tools.py
│   └── test_resources.py
├── examples/                  ← Integration examples
│   ├── anthropic_sdk.py
│   ├── openai_agents.py
│   ├── langchain_example.py
│   └── curl_test.sh
├── .github/workflows/
│   ├── ci.yml                 ← Lint + test (3.10-3.13) + Docker
│   └── publish.yml            ← PyPI publishing on v* tags
├── pyproject.toml             ← Package metadata (uv/pip install)
├── requirements.txt           ← Pinned dependencies
├── Dockerfile                 ← Production container image
├── docker-compose.yml         ← One-command deployment
├── Makefile                   ← Developer shortcuts
├── .pre-commit-config.yaml    ← Ruff + pre-commit hooks
├── CHANGELOG.md
├── SECURITY.md
├── .env.example
└── README.md

______________________________________________________________________

故障排除

“JSON后出现意外的非空格字符” → 有东西正在写入stdout。此服务器将所有日志记录路由到stderr。如果添加了自定义打印语句，请使用 print(..., file=sys.stderr).

“Infoblox客户端未初始化” → INFOBLOX_API_KEY 缺失或无效。检查你的 .env 文件或环境变量。

“未找到IP空间'prod'” → 空间名称不完全匹配。使用 explore_network() 查看可用空间名称。

“找不到DNS区域'example.com'” → Infoblox中不存在该区域。使用 manage_dns_zone(action="list") 查看可用区域，或 manage_dns_zone(action="create", fqdn="example.com") 创建一个。

工具未出现在Claude Desktop中 → 编辑后重新启动Claude Desktop claude_desktop_config.json.检查路径 mcp_intent.py 是绝对的。

HTTP服务器没有响应 → 从...开始 python mcp_intent.py --http.测试： curl -X POST http://127.0.0.1:4005/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

模拟运行混乱 → 所有破坏性操作（删除、释放、批量分流）默认为 dry_run=True他们展示了什么 *会* 不做任何改变。集 dry_run=False 执行。

令牌溢出/响应太大 → Use limit 参数以减小结果大小。意图层已经截断了大型结果，但特定查询返回的数据较少。