Cisco Duo MCP

MCP server · by Servosity

Developer Tools mcpb v0.1.0

Fix Duo MFA lockouts and see every MSP subaccount at once, from your AI agent.

View source ↗ Generate config for multiple servers More servers

Install

Run one of the commands below, then pick your client in the next section.

mcpb
https://github.com/Servosity/msp-skills/releases/download/cisco-duo-v0.1.0/cisco-duo-mcp.mcpb

Setup by client

Pick your client — the config below is generated for this server.

This server ships as a downloadable bundle: https://github.com/Servosity/msp-skills/releases/download/cisco-duo-v0.1.0/cisco-duo-mcp.mcpb

Format verified against the official Claude Desktop docs ↗.

Environment variables

Defined in the server's official registry manifest. Required secrets are shown as <YOUR_…> placeholders in the configs above.

  • CISCO_DUO_API_HOST required — Your Duo API hostname, e.g. api-XXXXXXXX.duosecurity.com (Duo Admin Panel > Applications > your Admin API application). For an MSP, use the parent account's hostname.
  • CISCO_DUO_IKEY required secret — Admin API integration key (ikey) from the same Admin API application.
  • CISCO_DUO_SKEY required secret — Admin API secret key (skey). Used only to sign each request; it is never sent to Duo.
  • CISCO_DUO_ACCOUNT_ID — Default customer subaccount for every call (account ID, or exact name from accounts list); a tool call that names its own account-id overrides it. Leave blank to act on the account the keys belong to; the fleet tools alw
  • CISCO_DUO_MCP_READ_ONLY — Set to 1 for a read-only server: lockout fix, phone-swap, enrollment chase, sync, import and export are hidden, and the API execute tool refuses every non-GET call. Leave blank for the full tool set.
  • CISCO_DUO_BASE_URL — Overrides the full API root (for a test server). Leave blank; CISCO_DUO_API_HOST is the normal setting.
  • CISCO_DUO_MCP_HTTP_TOKEN secret — Bearer token that cisco-duo-mcp --transport http requires from every HTTP client (Authorization: Bearer). Leave blank for the default stdio transport, which Claude Desktop uses and which never reads it.
  • CISCO_DUO_USER_AGENT — Overrides the User-Agent the CLI sends on Duo requests. Leave blank to use the CLI's own built-in User-Agent.

About this server

Distributed as mcpb, listed under Developer Tools. Review our MCP security guide before granting access to real data.

Frequently asked questions

How do I install Cisco Duo MCP?

Run the install command shown above, then paste the config for your client (Claude Desktop, Claude Code, Cursor, VS Code or Windsurf) into its MCP settings and restart the client.

Is Cisco Duo MCP free to use?

The MCP server itself is free to install. The source is public on https://github.com/servosity/msp-skills. Any third-party service it calls may require its own API key and account.

Which clients support Cisco Duo MCP?

Any MCP-compatible client can use it, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and custom agents.

Add this badge

Publish this server? Link back with a badge on your README or site — copy either snippet.

Listed on MCPNav

Markdown

[![Listed on MCPNav](https://mcpnav.net/badge/cisco-duo-mcp.svg)](https://mcpnav.net/server/cisco-duo-mcp/)

HTML

<a href="https://mcpnav.net/server/cisco-duo-mcp/"><img src="https://mcpnav.net/badge/cisco-duo-mcp.svg" alt="Listed on MCPNav" height="20"></a>