I made a quick MCP tool for interacting with OpenZiti Management API

I work on the https://github.com/openziti project at NetFoundry, and worked with Claude to build a quick MCP server for OpenZiti. It's in my personal repo (https://github.com/smilindave26/mcp-ziti), but if it turns out there's genuine interest in this, we'll create a fully supported version as part of the OpenZiti project.

[ If you don't already know what OpenZiti is, it's an open-source (Apache 2.0) zero-trust overlay platform. Services have zero public endpoints, so they're invisible to anything without a cryptographic identity. No open inbound ports, no port forwarding, works through NAT... ]

We often get feedback (including in this sub) that OpenZiti can be painful to learn/get started. One of the things I like about this MCP server is that it helps with that. You can ask things like:

• "I want my phone and laptop to securely reach my NAS and Home Assistant without opening any ports, what should I configure?" It'll recommend the identities, services, and policies you need, explain why, and create them for you.
• "Show me all policies and explain which identities can access which services"
• "My laptop identity can't reach the 'home-assistant' service, help me figure out why." It'll inspect your policies, check role attributes, look at sessions, and tell you what's missing.

https://i.redd.it/byquh2tm4gng1.gif

To try it (no existing OpenZiti network required):

Grab the latest ziti binary from https://github.com/openziti/ziti/releases

Run a local quickstart:

ziti edge quickstart --home ./my-network

1. Download ziti-mcp from https://github.com/smilindave26/mcp-ziti/releases (single binary, no dependencies)
2. Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

​

{ "mcpServers": { "ziti": { "command": "/path/to/ziti-mcp" } } }

1. In Claude, say something like: "Connect to ziti at https://localhost1280 with username admin and password admin" and start exploring. (The quickstart creds are just for local testing. For anything real, you'd use one of the other https//github.com/smilindave26/mcp-ziti#authentication-methods: identity file, client cert, OIDC, etc.)

Anyway - curious what people think and if we should put more time into this...