MCP Server (Beta)

The Peresvet ST MCP server connects an AI client to the system—for example, Codex, Claude, a local LLM shell, or another tool that supports MCP Streamable HTTP. Once connected, a user can describe a task in natural language. The AI client retrieves the current Peresvet ST schema, reads the library, selects recipes, builds and validates task drafts, and runs actions through a controlled workflow.

Public beta server endpoint:

https://portal.peresvet.it/mcp

Copy code to clipboard

Access is protected by a Peresvet portal account. Use the same email address and password that you use to sign in at portal.peresvet.it.

Beta

The MCP interface is currently in beta. The set of tools, recipe names, and diagnostic response format may change.

Why Use It

The MCP server lets an AI client work from the system's actual schema instead of relying on memory or a verbal description of the interface.

It can:

• identify which agents, networks, certificates, dictionaries, PCAPs, CVEs, and user files are available in the library;
• select a suitable scenario for your test objective: NGFW, WAF, Anti-DDoS, TLS/IPsec, PCAP Replay, Dynamic Applications, Control Plane, or Access Plane;
• build a task draft with the correct fields and references to library objects;
• validate the task before saving it and provide clear guidance when a network, file, certificate, or parameter is missing;
• create, start, or stop a task, or run an action within a task, only after explicit confirmation;
• retrieve a report, metric summary, Control Plane events, and an execution analysis.

MCP Server Capabilities

The available capabilities follow a safe workflow.

Group	Purpose
Schema and plugins	Shows current fields, available plugins, the task structure, and Control/Access Plane rules
Recipes	Suggests ready-to-use workflows for common tasks and explains which questions must be clarified
Library	Shows object metadata for networks, agents, certificates, dictionaries, files, PCAPs, CVEs, and other collections
Drafts	Builds and validates a task draft and explains errors before creation
Tasks	Creates, starts, and stops tasks through two-step confirmation
Actions	Runs in-task actions, such as an Access Plane flap or a Control Plane protocol flap/schedule
Analysis	Returns a task report, metric summary, convergence report, and Control Plane events

Operations that change system state have two steps:

1. prepare_* validates the action and returns a short-lived approval token.
2. confirm_* executes the action only when supplied with that token.

This sequence lets the AI client first show the user exactly what will happen and then execute the action after confirmation.

Note

Stopping a task does not delete it. The task remains in history, where its results and reports can be viewed and analyzed again.

Connecting

An AI Agent Can Configure the Connection

You can give this page and your portal credentials to your AI agent. If the agent can modify its own MCP client configuration, it can add the https://portal.peresvet.it/mcp endpoint, configure authentication, and test the connection for you. You do not have to configure MCP manually from scratch.

Add the MCP server as an HTTP MCP endpoint:

https://portal.peresvet.it/mcp

Copy code to clipboard

The way you configure authentication depends on the client.

Clients That Support Basic Auth

Specify:

Username: <your portal email address>
Password: <your portal password>

Copy code to clipboard

Clients That Support Only HTTP Headers

Generate a Basic Auth header value:

printf '%s' '<email>:<password>' | base64

Copy code to clipboard

Then add the header:

Authorization: Basic <base64(email:password)>

Copy code to clipboard

Codex Example

In ~/.codex/config.toml:

[mcp_servers.peresvet-st]
url = "https://portal.peresvet.it/mcp"
http_headers = { Authorization = "Basic <base64(email:password)>" }

Copy code to clipboard

After changing the configuration, restart Codex so that the native MCP tools appear in a new session.

Testing Access

You can test access with the JSON-RPC initialize method:

curl -u '<email>:<password>' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  --data '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-03-26",
      "capabilities": {},
      "clientInfo": {
        "name": "peresvet-smoke",
        "version": "1.0.0"
      }
    }
  }' \
  https://portal.peresvet.it/mcp

Copy code to clipboard

A successful response contains serverInfo.name with the value controller-agent-gateway.

If the username or password is incorrect, the server returns:

HTTP/2 401
Unauthorized

Copy code to clipboard

Typical Workflow

Recommended sequence:

1. Describe your testing objective in natural language.
2. Ask the AI client to inspect the schema, recipes, and library.
3. Provide any missing parameters: agents, networks, duration, intensity, files, certificates, and TLS/IPsec profiles.
4. Build a task draft.
5. Validate the draft.
6. Create the task with prepare_task_create and confirm_task_create.
7. Start the task with prepare_task_start and confirm_task_start.
8. Request a report or results analysis after the task completes.

Example user prompt:

I want to test an NGFW. Select an HTTP/TLS scenario using two agents,
check the available networks and certificates, create a five-minute task draft,
and show me what I need to confirm before it starts.

Copy code to clipboard

The AI client should first ask for missing parameters or suggest safe defaults. It should then display the draft and create and start the task only after confirmation.

Example Prompts

List Available Objects

Show me which agents, networks, certificates, and PCAP files are available in the library.

Copy code to clipboard

Create a Task from a Description

I need to test a WAF: HTTP/1.1, 1,000 RPS, 10 minutes, with the client and server
on different agents. Select a suitable recipe, create a draft, and validate it.

Copy code to clipboard

Check PCAP Replay Options

Find the PCAP files in the library and suggest either a stateful or stateless scenario.
Before creating the task, explain which networks and agents will be used.

Copy code to clipboard

Analyze Results

Analyze task 1234: status, errors, key metrics, Control Plane events,
and a link to the result in the interface.

Copy code to clipboard

Test Convergence

For the running task, prepare a BGP flap, run it after confirmation,
and then show the convergence report.

Copy code to clipboard

Security and Limitations

• Use individual portal accounts. Do not place an administrator password in shared configuration files or public demonstration environments.
• If the AI client runs in the cloud, consider your organization's policy: prompts and tool responses may be processed by an external service.
• The MCP server returns library metadata but must not expose certificate private keys.
• MCP file upload is intended for small files and is limited to 8 MiB of decoded content.
• Before starting high-intensity tasks, check the networks, port ranges, session counts, and available agent resources.

Air-Gapped Environments

For on-premises installations without Internet access, the MCP server is deployed within the customer's infrastructure. While this capability remains in beta, the engineer responsible for your integration will determine the deployment architecture. Contact that engineer if you need a dedicated MCP server in an air-gapped environment.

Troubleshooting

Symptom	What to check
401 Unauthorized	Portal username/password, the Authorization header, and extra whitespace in the base64 value
MCP tools do not appear in the client	Restart the MCP client after changing its configuration
The client does not support Basic Auth	Use Authorization: Basic <base64(email:password)> if the client supports HTTP headers
The client can see the endpoint but cannot call tools	Confirm that the client supports Streamable HTTP MCP, not only stdio MCP
The task cannot be created	Ask the AI client to validate the draft and explain the missing fields
An air-gapped deployment is required	Contact the engineer responsible for your integration; during beta, local MCP server deployment is configured individually