MCP Roles

These commands create a role and user account for the MCP. Please note that these privileges are not as specific as you can make them. You may narrow the scope further by adding more to the -cmddirname field. This is a starting point and allows you to not use the admin role.

Creating Role:

To create a role for the MCP, start out with this command:

security login role create -role MCP -cmddirname DEFAULT -access readonly

This grants the role MCP read only access to all commands.

Choose from the following table the actions you wish the MCP to be able to change. There are more actions available, see the documentation for details.

Access to	Command
Volume	security login role create -role MCP -cmddirname volume -access all
CIFS shares	security login role create -role MCP -cmddirname "vserver cifs share" -access all
Export policies	security login role create -role MCP -cmddirname "vserver export-policy" -access all
QoS	security login role create -role MCP -cmddirname "qos" -access all
Snapmirror	security login role create -role MCP -cmddirname "snapmirror" -access all
LIFs	security login role create -role MCP -cmddirname "network interface" -access all
LUNs	security login role create -role MCP -cmddirname "lun" -access all
iSCSI	security login role create -role MCP -cmddirname "vserver iscsi" -access all
FCP	security login role create -role MCP -cmddirname "vserver fcp" -access all
NVMe	security login role create -role MCP -cmddirname "vserver nvme" -access all

Creating User Account:

security login create -user-or-group-name mcp -application http -authentication-method password -role MCP

Documentation:

RBAC: https://docs.netapp.com/us-en/ontap/authentication/workflow-concept.html

Command Reference: https://docs.netapp.com/us-en/ontap-cli/security-login-role-create.html

NetApp ONTAP MCP Claude Desktop Extension: https://github.com/thestorageden/NetApp-ONTAP-MCP-Claude-Desktop-Extension

Multi-Admin Verification

This Docs page shows what commands are available for each ONTAP version: https://docs.netapp.com/us-en/ontap/multi-admin-verify

There must be at least two users in an approval group.

Creating the secureadmin user account:

security login create -user-or-group-name secureadmin -application http -authentication-method password -role admin

security login create -user-or-group-name secureadmin -application ssh -authentication-method password -role admin

Optional: security login create -user-or-group-name secureadmin -application console -authentication-method password -role admin

Create the approval group:

security multi-admin-verify approval-group create -name approval -approvers admin,secureadmin -enable-notifications true -email test@test.com

Create MAV rules:

Review what commands are available in your version of ONTAP and create rules that best fit your security needs. Below are a few, depending on your version, that might be a good starting point to use with ONTAP MCP.

Operaton	Command
lun delete	security multi-admin-verify rule create -operation "lun delete"
volume delete	security multi-admin-verify rule create -operation "volume delete"
volume rename	security multi-admin-verify rule create -operation "volume rename"
snapshot delete	security multi-admin-verify rule create -operation "volume snapshot delete"
snapshot rename	security multi-admin-verify rule create -operation "volume snapshot rename"
SVM delete	security multi-admin-verify rule create -operation "vserver delete"
SVM stop	security multi-admin-verify rule create -operation "vserver stop"

If you want to allow a command to be used in some cases, such as deleting a volume if it starts with test add -query:

security multi-admin-verify rule create -operation "volume delete" -query "-volume !test*"

Ensure you have rename operations restricted, otherwise there is a loophole.

Enable MAV

security multi-admin-verify modify -enabled true

Disable MAV

security multi-admin-verify modify -enabled false

Documentation:

https://docs.netapp.com/us-en/ontap/multi-admin-verify/index.html