A read-only MCP server for monitoring Meraki networks.
The Meraki Monitor MCP server has significant quality gaps across naming, descriptions, schemas, and error handling. While all 16 tools are explicitly defined with names following verb_noun patterns (get_*), the implementation suffers from critical issues: (1) Most tools accept no parameters or undocumented parameters (8 tools have empty input schemas with zero parameter descriptions). (2) Tool descriptions are present but generic and lack actionable context about when to use each tool vs. alternatives. (3) Output schemas are completely undocumented, responses are returned as raw JSON.dumps() with no type information. (4) Error handling is minimal: some tools check for missing env vars and return JSON error objects, but most lack recovery guidance. (5) All tools are read-only, mitigating some risk, but the lack of pagination, rate limiting, and output constraints means large API responses can blow context windows. (6) The server uses environment variables for configuration (MERAKI_API_KEY, MERAKI_ORG_ID, MERAKI_NETWORK_ID) which is correct for secret injection, but hard-codes many API calls to a single organization/network, limiting flexibility.
Retrieves assurance alerts for the organization in the .env file.
Fetches detailed information about a single client on the network in the .env file.
Gets the currently applied policy for a specific client on the network in the .env file.
Retrieves the data usage history for a specific client on the network in the .env file.
Retrieves a list of clients that have been active on the network in the .env file.
Retrieves detailed information for a single device using its serial number.
Missing output schemas for all tools. Tools return raw json.dumps() output with no documented structure. LLMs cannot plan downstream calls or extract specific fields without parsing unstructured JSON.
Eight tools have empty input schemas with no parameter descriptions: get_organizations, get_organization_details, get_networks, get_devices, get_organization_status, get_organization_inventory, get_organization_license, get_network_details, get_network_devices. Descriptions lack context about when to use each tool and what data is returned.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 44 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Retrieves a list of all devices across all networks in the organization specified in the .env file.
Provides detailed configuration and status for the network specified in the .env file.
Lists all Meraki devices that are part of the network specified in the .env file.
Provides a traffic analysis summary for the network in the .env file.
Retrieves a list of all networks within the organization specified in the .env file.
Fetches details for the organization specified in the .env file.
Retrieves the hardware inventory for the organization specified in the .env file.
Fetches the current license state for the organization specified in the .env file.
Gets the status and health of the organization specified in the .env file.
Retrieves a list of all Meraki organizations the user has access to.
No pagination support. Tools like get_devices, get_organization_devices, get_clients can return hundreds of items without page/limit/offset parameters or total counts. Large responses can exhaust LLM context windows.
Hard-coded organization and network IDs from .env file limit tool flexibility. Tools cannot query multiple organizations or networks. Descriptions repeatedly say 'specified in the .env file' rather than explaining what data is returned, forcing LLMs to guess about output structure.
Minimal error handling and no recovery guidance. Some tools check for missing env vars and return JSON error objects (e.g., get_network_details), but most do not. No actionable error messages to guide LLM retry logic or user correction.
Parameter descriptions for timespan_days, timespan, client_id, serial are present but minimal (under 100 chars). No range constraints, format specs, or examples of expected values. LLMs may pass invalid values without validation feedback.
No tool annotations (readOnlyHint, idempotentHint) to signal to clients which tools are safe and which require caution. All tools are read-only, but clients cannot parse this from definitions.
No rate limiting or request throttling. An LLM in a retry loop could generate thousands of API calls per minute, overwhelming Meraki API or causing account throttling.