Skip to main content
Controller and CoPilot already hold the answer to most network and security questions your team asks: what does this SmartGroup cover, is there an active IPS alert, why is this S2C tunnel down. Getting that answer today means opening a dashboard, navigating to the right view, and cross-referencing policy against topology by hand. The Aviatrix MCP for Enterprise Fabrics server gives your AI agent direct, authenticated access to that same data, so it can answer the question in a single turn instead of sending you back to the UI.

​
What This Is

The Aviatrix MCP Server is an Aviatrix-hosted MCP server at platform.mcp.aviatrix.com that gives AI agents authenticated access to your Controller and CoPilot data across topology, policy, flow intelligence, and diagnostics. It calls the same Controller and CoPilot APIs the UI uses, so there are no gateway changes, no Terraform changes, and no new version requirement to adopt it.
This server is generally available. Aviatrix continues to expand its tool coverage (see What’s Next for the current roadmap).

​
What Your Agent Can Do

The server exposes 51 tools across four domains: Ask your agent a question in natural language, for example “What DCF policies cover the production VPCs, and are there any IPS alerts in the last 24 hours?” The agent queries groups, policies, and intrusion data in a single turn and can follow up with an action like running FlightPath between two spokes.

​
Permission Scoping

API keys are issued with an explicit scope at creation time, and scope is enforced server-side, not by agent instruction:
  • controller:read (default): 50 read-only tools covering inventory, policy, flow intelligence, and diagnostics.
  • controller:write: adds one operational tool, aviatrix_reset_s2c_connection. A controller:read key cannot invoke aviatrix_reset_s2c_connection regardless of what the agent requests.
Only issue a controller:write key to an agent or user that needs to reset S2C connections. Default to controller:read for all other use cases.
The set of tools gated behind controller:write is expected to grow as Aviatrix adds more operational capabilities to the server. Review the tool list for any key with write scope after an MCP server update, rather than assuming its capabilities are fixed at issuance time.

​
Security

  • Transport: All communication between your MCP client and the Aviatrix MCP Server uses TLS over HTTPS (Streamable HTTP transport).
  • Authentication: OAuth 2.1 with PKCE. Your agent authenticates on every session.
  • Credential storage: Your Controller and CoPilot credentials are encrypted inside the Bearer token itself using AES-256. They are never stored in a database. The plaintext exists only in memory for the duration of an API call.
  • API keys: Encrypted at rest using AES-256. Revoke a key at any time from the login portal.
  • Scope enforcement: Unauthorized tools are absent from the tool list, not marked as “access denied.” A controller:read key cannot discover write-only tools.
  • Session lifecycle: CoPilot sessions expire after approximately one hour. OAuth-capable clients (Claude Code, Claude Desktop) re-authenticate automatically with no user action required.
  • Tool-call logging: Each tool call writes one structured JSON line to CloudWatch in Aviatrix’s AWS account. The line holds the tool name, timing, outcome, the CoPilot username used to sign in, the Controller hostname, and your organization’s name where Aviatrix has it on record. Tool arguments are not logged. The line holds a hash of them instead. Error messages returned by your Controller are logged and can include gateway names or IP addresses. Sign-in events record the CoPilot URL, username, and source IP. Logs are kept for 90 days, and customers do not have access to them.

​
Network Requirements

The Aviatrix MCP Server connects to your Controller and CoPilot from a static IP address. Allow inbound HTTPS (port 443) from the following address on both your Controller and CoPilot network security groups:
Both Controller and CoPilot must allow this IP. The MCP Server calls CoPilot for policy, flow, and topology data, and calls Controller directly for diagnostics such as syslog retrieval, ping, and traceroute.

​
Connect Your Agent

1

Request access

Contact your Aviatrix account team to enable the Aviatrix MCP Server for your Controller and CoPilot. Aviatrix allowlists your environment before any API key can be issued.
2

Provision an API key

Once your environment is enabled, go to the Aviatrix MCP login portal and create an API key. Choose controller:read unless your use case requires resetting S2C connections or running BGP diagnostics.
3

Configure your MCP client

Add the Aviatrix MCP Server endpoint to your MCP client configuration. In Claude Code, run:
Any MCP-compatible client works, including Claude Code, Claude Desktop, and Cursor.
4

Authenticate

Your agent completes an OAuth 2.1 with PKCE authentication flow on connection. Approve the request when prompted.
5

Ask a question

Ask your agent about your environment, for example “What is the current Blast Radius for the production AI workload VPCs?” The agent selects and calls the relevant tools and returns a structured answer.

​
What’s Next

​
Security FAQ

No. Your credentials are encrypted inside the Bearer token and decrypted only by the Aviatrix MCP Server at runtime. The AI model receives structured tool results (gateway lists, policy data, diagnostic output), never credentials.
Inside the encrypted Bearer token itself, not in a database. The token uses AES-256 encryption. The plaintext password exists only in Lambda memory for the duration of an API call (typically under one second), then is discarded.
With a controller:read key (the default), no. Read-only keys expose 50 tools that can query data but cannot change state. The only state-changing tool (aviatrix_reset_s2c_connection) requires an explicit controller:write key and is hidden from read-only sessions.
The key is invalidated immediately. Any in-flight or subsequent requests using that Bearer token will fail authentication. No grace period.
No. The MCP Server does not store conversation content, and tool results are not written to its logs. Two asynchronous tools are the exception: the BGP diagnostic and the gateway syslog download store their result in a database so your client can collect it when it is ready. That record expires after one hour and is deleted automatically, typically within a few days of expiring. Each tool call also writes a log line with the tool name, timing, and outcome, kept for 90 days.
The MCP Server connects to your Controller and CoPilot on port 443 only, from a single static IP (3.134.16.45). All other outbound ports are blocked by policy. The server cannot reach any other hosts in your environment.Outside your environment, the server calls one third-party service, ipinfo.io, over HTTPS to identify who owns an IP address. It sends the public source IP of each client that connects to the MCP Server, and, from the flow analysis and IP lookup tools, IP addresses outside the RFC 1918 private ranges. If any of your internal networks use addresses outside RFC 1918, those can be included. No gateway names, credentials, or other data are sent.
Tool results (gateway lists, firewall logs, diagnostic output) are returned to the MCP client over TLS in a single response, and the server does not index them. Most results exist only in Lambda memory for the duration of the request. The asynchronous BGP diagnostic and gateway syslog download are the exception: they store their result in an encrypted database so your client can collect it, and that record expires after one hour, as described above. Error messages returned by your Controller are written to the server’s logs and can include gateway names or IP addresses.
For guidance on securing the MCP servers your own team deploys (not the Aviatrix MCP Server itself), see AI Agent Workload Containment and MCP Server Security Through Containment Architecture .