S2 Netbox MCP

Name: S2 Netbox MCP
Author: J-MaFf

by J-MaFfversion 0.3.0i★ –iRuns on your computer

Registry nameio.github.J-MaFf/s2-netbox-mcp

Install

Overview

Description from the maker (original English)

MCP server for LenelS2 S2 NetBox access control via the NBAPI. Read-only by default.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 52/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: NETBOX_BASE_URL, NETBOX_USERNAME, NETBOX_PASSWORD

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: NETBOX_BASE_URL, NETBOX_USERNAME, NETBOX_PASSWORD, NETBOX_ENABLE_WRITES, NETBOX_ENABLE_DESTRUCTIVE

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "s2-netbox": {
      "command": "npx",
      "args": [
        "-y",
        "s2-netbox-mcp"
      ],
      "env": {
        "NETBOX_BASE_URL": "your-value",
        "NETBOX_USERNAME": "your-value",
        "NETBOX_PASSWORD": "your-value",
        "NETBOX_ENABLE_WRITES": "your-value",
        "NETBOX_ENABLE_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add s2-netbox --env NETBOX_BASE_URL=your-value --env NETBOX_USERNAME=your-value --env NETBOX_PASSWORD=your-value --env NETBOX_ENABLE_WRITES=your-value --env NETBOX_ENABLE_DESTRUCTIVE=your-value -- npx -y s2-netbox-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "s2-netbox": {
      "command": "npx",
      "args": [
        "-y",
        "s2-netbox-mcp"
      ],
      "env": {
        "NETBOX_BASE_URL": "your-value",
        "NETBOX_USERNAME": "your-value",
        "NETBOX_PASSWORD": "your-value",
        "NETBOX_ENABLE_WRITES": "your-value",
        "NETBOX_ENABLE_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "s2-netbox": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "s2-netbox-mcp"
      ],
      "env": {
        "NETBOX_BASE_URL": "your-value",
        "NETBOX_USERNAME": "your-value",
        "NETBOX_PASSWORD": "your-value",
        "NETBOX_ENABLE_WRITES": "your-value",
        "NETBOX_ENABLE_DESTRUCTIVE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

NETBOX_BASE_URL required env
Base URL of the S2 NetBox controller's web interface, e.g. https://netbox.example.internal (no trailing slash or path)
NETBOX_USERNAME required env
NBAPI session-login username
NETBOX_PASSWORD secret required env
NBAPI session-login password
NETBOX_ENABLE_WRITES env
Set to true/1/yes to register the write tools (lock/unlock, add/modify/delete). Unset keeps the server strictly read-only.
NETBOX_ENABLE_DESTRUCTIVE env
Set to true/1/yes together with NETBOX_ENABLE_WRITES to additionally register the 11 destructive (delete/remove) tools

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account J-MaFf, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18444 servers in this category
Published to the registry more recently than 46% of the other 18444 servers in this category
Basic checks equal to or better than 100% of the other 18444 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is S2 Netbox MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: NETBOX_BASE_URL, NETBOX_USERNAME, NETBOX_PASSWORD

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.3.0) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Egovframe Scaffold MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

by formulahendryEarly↓ 66/wk★ 440Updated 14 months ago

Runs on your computer

Install

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

by desktop-commanderGrowing★ 211Updated 3 days ago

Runs in the cloud✓ desktopcommander.app

Install

Egovframe Scaffold MCP

eGovFrame (전자정부 표준프레임워크) projects: templates, components, CRUD, build, 5.x migration, dependencies

by EricSeokgonEarly↓ 1.4K/wkUpdated today

Runs on your computer

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

s2-netbox-mcp

A local MCP server that exposes LenelS2 S2 NetBox NBAPI operations — persons/credentials, access levels, portals/readers/outputs, time specs, holidays, portal/reader groups, threat levels, events/activity, and partitions/UDF lists — as MCP tools usable from any MCP-compatible client (Claude, Gemini/Antigravity, etc.).

Not the open-source netboxlabs.com "NetBox" DCIM/IPAM tool. This targets

LenelS2's S2 NetBox physical access-control appliance and its NBAPI

(Web-Based API for S2 NetBox and S2 Global, LenelS2 doc #API-UG-14).

Newer NBAPI v1 (doc #API-UG-22, April 2024) and v2 (doc #API2-UG-8,

April 2025) guides also exist — see docs/reference/

for reference copies. Both have now been diffed against this server's tool

surface command by command and parameter by parameter:

docs/reference/nbapi-command-diff.md

records the result, including which documented commands are deliberately

not implemented and why.

[!WARNING]

This connects to a real physical security system. With the wrong

configuration, an AI agent using this server could unlock doors or modify

access-control data on a live building. It is read-only by default —

writes and destructive operations (lock/unlock, add/modify/delete) each

require their own explicit opt-in environment variable (see **Write

access** below) — but you are responsible for what you enable and which

MCP client/model you point at it. See SECURITY.md before deploying

anything beyond read-only against a production controller.

Install

Three steps, plus an optional fourth: check the requirements, install the server, register it with your MCP client, and optionally add the workflow skill. Before the first real call, also check the controller prerequisites.

Requirements

Node.js >= 18.17 (tested on Node 24), which includes npm. If Node.js isn't installed, on Windows you can install it with winget, then open a new terminal so node/npm are on your PATH:

  winget install OpenJS.NodeJS.LTS

An S2 NetBox controller reachable from wherever this server runs, with the NBAPI enabled and configured for session-login authentication (not MAC authentication — see the spec for why that's out of scope for v1)
A NetBox operator account with API access and read permission on the resources you want to query

Install the MCP server

Two ways to get the server:

Option A — npm (no clone needed):

npm install -g s2-netbox-mcp

This installs the s2-netbox-mcp binary; point your MCP client's command at s2-netbox-mcp directly (no node dist/index.js needed).

Option B — clone and build:

npm install

npm run build

Either way, copy .env.example to .env and fill in real values (or provide the same variables directly in your shell / in the Claude Code MCP server config's env block — see below). Never commit `.env` — it's already gitignored.

cp .env.example .env

edit .env

Keeping the password out of plaintext (1Password). NETBOX_PASSWORD may be a 1Password secret reference such as op:// / /password, both in .env and in an MCP client's env block. Launch the server (or any script that talks to the controller) under op run, which resolves the reference into a real environment variable before node starts. For an MCP client, make op run the command and the node invocation its arguments:

op run --account <account> --no-masking -- node /path/to/s2-netbox-mcp/dist/index.js

dotenv never overrides a variable that is already set, so the resolved value wins over the literal op://… text in .env. Without op run, that literal text is sent as the password and login fails with NBAPI error 5 (authentication failure).

Start the server directly to sanity-check it boots (it just waits on stdio for an MCP client — Ctrl+C to stop; this also sends Logout if a session was opened):

npm start

Registering with an MCP client

This server works with any MCP client that speaks the standard mcpServers stdio config shape — Claude Code, Antigravity, and Gemini CLI have all been verified against it directly. Which JSON to use depends on which install option you picked above:

If you installed via npm (Option A above):

"mcpServers": { "s2-netbox-mcp": { "command": "s2-netbox-mcp", "env": { "NETBOX_BASE_URL": "https://netbox.example.internal", "NETBOX_USERNAME": "svc-account", "NETBOX_PASSWORD": "REPLACE_ME", "NETBOX_ALLOW_INSECURE_TLS": "false" } } } }

If you cloned and built locally (Option B above):

"mcpServers": { "s2-netbox-mcp": { "command": "node", "args": ["/absolute/path/to/s2-netbox-mcp/dist/index.js"], "env": { "NETBOX_BASE_URL": "https://netbox.example.internal", "NETBOX_USERNAME": "svc-account", "NETBOX_PASSWORD": "REPLACE_ME", "NETBOX_ALLOW_INSECURE_TLS": "false" } } } }

Replace the args path with the actual absolute path to dist/index.js on your machine, and replace the env values with your real controller details (or omit env entirely and rely on a .env file next to the project if you prefer — either works, since src/index.ts loads .env via dotenv before reading process.env). Run npm run build first so dist/index.js exists.

Where to put that JSON depends on the client:

Client	Config file	Notes
Claude Code	`.mcp.json` in your project, or `claude_desktop_config.json`	Or add non-interactively via `claude mcp add-json s2-netbox-mcp ' '`
Antigravity	`~/.gemini/config/mcp_config.json` (Windows: `%USERPROFILE%\.gemini\config\mcp_config.json`)	Global — applies to every Antigravity session
Gemini CLI	`~/.gemini/settings.json`, under its own `mcpServers` key	Or add non-interactively via `gemini mcp add s2-netbox-mcp [args] -e KEY=value`

All three use the identical mcpServers object shape shown above — only the surrounding file and location differ.

Install the workflow skill (optional)

The s2-netbox-workflows Agent Skill adds step-by-step onboard, offboard, event-unlock, and badge-denied workflows on top of this server's tools. It needs the server registered above.

Install in Claude Code (plugin):

/plugin marketplace add J-MaFf/s2-netbox-mcp

/plugin install s2-netbox-workflows@s2-netbox-mcp

The plugin, in plugins/s2-netbox-workflows/, ships only the skill. It doesn't bundle or launch the MCP server, so it won't start a second server next to the one you already registered. To pick up a newer version, run claude plugin marketplace update s2-netbox-mcp, then claude plugin update s2-netbox-workflows@s2-netbox-mcp, then restart Claude Code.

Install manually (Claude Code or any agent that reads Agent Skills): copy or symlink plugins/s2-netbox-workflows/skills/s2-netbox-workflows/ into your agent's skills directory. For Claude Code that's ~/.claude/skills/ for every project, or .claude/skills/ in a single project. The skill loads on its own when a request matches it, for example "onboard Jane Doe with card 12345", "unlock the lobby Friday 8 to 5", or "why was badge 4471 denied at the dock door?".

Controller prerequisites

Before this server can talk to your controller, on the NetBox web UI go to Configuration → Site Settings → Network Controller → Data Integration and confirm all three of these are checked:

Enable V2
Use Authentication
Use login username/password for authentication (requires setup privilege)

The NBAPI user account also needs a role with NBAPI read access (see the NBAPI doc's "Setting Up User Roles for the API" section) — a login that succeeds but can't read the resources this server queries will surface as FAIL or APIERROR responses per tool call. If you set NETBOX_ENABLE_WRITES, that role needs Read-Write API privilege instead (Configuration → Site Settings → User Roles → API Privilege) — Read-Only suffices only for the read tools.

Troubleshooting

"Login succeeds but every other command returns `APIERROR 5`." This is the live-observed symptom of the *Use login username/password for authentication (requires setup privilege)* checkbox being unticked, which puts the controller in MAC-authentication mode instead of session-login mode (MAC auth is out of scope for this server — see the spec). Login still returns SUCCESS with a session ID, but every subsequent command — including Logout — fails with APIERROR 5. Fix: tick that checkbox on the *Data Integration* tab. This server's client detects this exact pattern (a successful re-login followed by another APIERROR 5) and surfaces a tool error naming the checkbox directly.
"HTTP 410 Gone." The configured NETBOX_API_PATH is not served by this controller. NetBox 6.x serves the NBAPI at /nbws/goforms/nbapi (the default this server uses); the 2020 doc's /goforms/nbapi path is deregistered on 6.x and returns 410 for every request. If you're on a pre-6.x controller, set NETBOX_API_PATH=/goforms/nbapi explicitly; if you're on 6.x and still see this, double-check NETBOX_API_PATH isn't set to something else by mistake.

Environment variables

Variable	Required	Default	Description
`NETBOX_BASE_URL`	Yes	—	Base URL of the NetBox controller's web interface, e.g. `https://netbox.example.internal`. No trailing slash or path — the client appends `NETBOX_API_PATH` itself.
`NETBOX_USERNAME`	Yes	—	NBAPI session-login username.
`NETBOX_PASSWORD`	Yes	—	NBAPI session-login password. Never logged, never written to any tracked file.
`NETBOX_ALLOW_INSECURE_TLS`	No	`false`	Set to `true`/`1`/`yes` to accept a self-signed/on-prem TLS certificate. Explicit opt-in only — any other value (including unset) keeps normal certificate verification.
`NETBOX_API_PATH`	No	`/nbws/goforms/nbapi`	The NBAPI path appended to `NETBOX_BASE_URL`. The default is the verified path on NetBox 6.x controllers. Only set this to override the default — e.g. to the legacy, pre-6.x path `/goforms/nbapi`, which returns HTTP 410 Gone on 6.x controllers (see Controller prerequisites below). A value without a leading `/` has one added automatically.
`NETBOX_ENABLE_WRITES`	No	`false`	Set to `true`/`1`/`yes` to register the write tools (see Write access below). Unset (or any other value) leaves the server strictly read-only.
`NETBOX_ENABLE_DESTRUCTIVE`	No	`false`	Set to `true`/`1`/`yes`, together with `NETBOX_ENABLE_WRITES`, to additionally register the 11 destructive tools (see Write access below).
`NETBOX_EVENT_API_PATH`	No	tracks `NETBOX_API_PATH`	Request path used only for `trigger_event`. Unset/empty tracks whatever `NETBOX_API_PATH` resolves to; a non-empty override is used verbatim (leading `/` added if missing) — e.g. the doc's pre-6.x Event API path `/appd/nbapi`, if your controller serves it separately.

| NETBOX_UNLOCK_HOLIDAY_GROUPS | No | 8,7,6 | The holiday groups reserved for the m

Only the beginning is shown; read the rest in the repo

S2 Netbox MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Egovframe Scaffold MCP

README from the maker

s2-netbox-mcp

Install

Requirements

Install the MCP server

edit .env

Registering with an MCP client

Install the workflow skill (optional)

Controller prerequisites

Troubleshooting

Environment variables