Skip to content

Product Overview

Last update: June 4, 2026

Product: AI-Bridge for Cisco UC
Version: v202606
Author: SARL SOURDEAU CONSULTING

Project Overview

What is AI-Bridge for Cisco UC

AI-Bridge for Cisco UC is a Model Context Protocol (MCP) server that bridges AI/LLM platforms to Cisco Unified Communications on-premises infrastructure. It enables any MCP-compatible AI agent — such as Claude Desktop, VS Code, Open Code, Cursor, or custom LLM-based tools — to interact directly with Cisco UC systems through a secure, authenticated, and auditable interface.

The server exposes Cisco UC operations (using the product API) as MCP tools, along with guided workflows as MCP prompts and reference documentation as MCP resources. AI agents consume these capabilities using the standard MCP protocol over Streamable HTTPS transport.


Key value proposition:

  • 🗣️ Natural Language Control — empower Cisco UC administrators and operators with AI-assisted operations driven by natural language through your AI agent — configuration queries, security audits, health checks, report generation, and troubleshooting.
  • 🚀 Faster AI Integration — a single solution to interconnect all Cisco UC products with any MCP-compatible AI agent. No Cisco UC expertise required — the MCP server provides all the context, tools, and domain-specific prompts the AI needs to interact correctly with UC products.
  • 🔒 Enterprise Security & Governance — integrating the most demanding security features makes AI-Bridge suitable for regulated environments, government networks, and any organization where data sovereignty and high security are requirements.
  • 🔗 Cross-Platform Workflows — orchestrate complex multi-product operations in a single natural-language request, spanning all supported Cisco UC platforms.


Use-case examples — what you can ask your AI agent:

  • " Create user Marie C., assigning her a phone, a voicemail, a Jabber client, and a personal video conference room "
  • " Add speed dials to Peter D.'s phone for Marie C. and David B. "
  • " Create a secure video conference room named — Crisis Room - Executive Committee — "
  • " Perform a security audit of all European CUCM clusters "
  • " Send the following message to all phones in the Orion building: Telephone system maintenance starting at 10:00pm — "
  • " Help me analyze John R.'s call issue yesterday at 9:50am "

Deployment Model


Hosting

AI-Bridge for Cisco UC runs on any Linux distribution with Docker support.

Recommended deployment: a Docker container hosted on your infrastructure (VMware vSphere, Hyper-V, Proxmox, Docker Engine, or equivalent).


On-premises design - Compatible air-gapped

AI-Bridge for Cisco UC is designed for fully on-premises, compatible with air-gapped deployment:

  • No cloud dependency — the server runs entirely on the customer's infrastructure. No data is sent to any external service. No telemetry, no analytics, no phone-home mechanism.
  • No outbound connections — the server only connects to the Cisco UC nodes explicitly configured. It never initiates connections to the internet.
  • Offline licensing — licenses are RS256-signed JWT files issued offline by the editor and installed locally. No license server or online activation is required.
  • Offline upgrades — upgrade packages are delivered as signed .tar.gz archives. Package integrity is verified via DNS-published SHA-512 checksums and RSA-PSS digital signatures.
  • Offline AI operation — the MCP protocol runs over the local network between the AI agent and the MCP server. If the AI agent itself runs locally (e.g., a local LLM), the entire chain operates without any internet connectivity.
  • Reverse proxy support (optional) — a web reverse proxy (e.g., Nginx, Apache, HAProxy) can be placed in front of the MCP server for TLS termination and network segmentation.
  • High availability — AI-Bridge supports redundancy based on the virtualization platform hosting it (e.g., VMware HA, Hyper-V failover clustering, Proxmox HA). No application-level clustering is required.


Standard deployment model

The standard deployment model is:

Standard deployment model

Text version (click to expand) 
┌─────────────────────────────────────────────────────────────────────────────────────┐
│                                       Customer Network                              │
│                                                                                     │
│  ┌─────────────┐        ┌──────────┐        ┌─────────────┐                         │
│  │     LLM     │  API   │ AI Agent │        │    Web      │                         │
│  │ (OpenAI,    │◄──────►│ (Claude, │───────►│  Reverse-   │                         │
│  │  Anthropic, │        │  Copilot,│        │   Proxy     │                         │
│  │  Local LLM) │        │  etc.)   │        │ (optional)  │                         │
│  └─────────────┘        └──────────┘        └──────┬──────┘                         │
│   Cloud or Local                                   │                                │
│                                                    │                                │
│                                                    ▼                                │
│                                             ┌──────────────┐                        │
│                                             │  AI-Bridge   │                        │
│                                             │  Instance 1  │                        │
│                                             │ (MCP Server) │                        │
│                                             └──────┬───────┘                        │
│                                                    │                                │
│          ┌────────────┬────────────┬───────────┬───┴────────┬────────────┐          │
│          ▼            ▼            ▼           ▼            ▼            ▼          │
│    ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐    │
│    │   CUCM   │ │   IMP    │ │   CUC    │ │   EXP    │ │   CUBE   │ │ CMS/CMM  │    │
│    └──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘    │
│                                                                                     │
└─────────────────────────────────────────────────────────────────────────────────────┘

Products Compatibility

AI-Bridge for Cisco UC currently supports the following Cisco UC products:

Product Full Name Multi-Cluster Query Protocols Supported Versions
CUCM Cisco Unified Communications Manager ✅ AXL/SOAP
RIS
SSH		 14
15
IMP Cisco IM & Presence Service ✅ AXL/SOAP
SSH		 14
15
CUC Cisco Unity Connection ✅ CUPI
SSH		 14
15

Multi-cluster support: the server can manage credentials and execute operations against multiple independent clusters simultaneously.

Add-ons Compatibility Matrix

AI-Bridge for Cisco UC supports a modular add-on system. Add-ons are AI-guided workflows that leverage the server's tools and embedded reference resources to perform complex multistep operations.

Add-on Description CUCM IMP CUC Status
Security Audit Automated configuration security audit based on Cisco Security Guide Release 15. Report with PDF export. ✅ ✅ ✅ GA
Health Check System health verification 🔜 🔜 🔜 Planned
Troubleshooting AI-powered diagnostic assistance 🔜 🔜 🔜 Planned
Certificate Renewal Automated certificate lifecycle management: inventory, expiry monitoring, CSR generation, renewal workflow. 🔜 🔜 🔜 Planned
Upgrade Upgrade planning: version compatibility checks, pre-upgrade audit, COP file management, scheduling. 🔜 🔜 🔜 Planned

Built-in modules:

Module Description
Reports Markdown report generation with 9 chart types (pie, bar, donut, radar, gauge, treemap, grouped bars, waterfall, severity matrix) and PDF export via WeasyPrint.
Infra HTTP endpoints for health check, Prometheus metrics, server status, and OAuth token management.
License Verification RS256-signed JWT license verified at startup and monitored periodically by a background watchdog.
Automatic Backups Periodic encrypted backups (RSA-4096 + AES-256-GCM) with local retention, optional SFTP export, and interactive restore.
Packaged-Upgrades Signed package-based upgrade system with --dry-run preview, .env key merge, and automatic pre-upgrade backup.

Standards & RFC Compliance

AI-Bridge for Cisco UC implements a comprehensive set of industry standards across its security, authentication, cryptography, and transport layers, including:

  • OAuth 2.0 / 2.1 — RFC 6749 (Authorization Framework), RFC 6750 (Bearer Tokens), RFC 7009 (Token Revocation), RFC 7617 (HTTP Basic Auth), RFC 8414 (Server Metadata Discovery), RFC 9068 (JWT Access Tokens), RFC 9700 / BCP 212 (Security Best Practices)
  • JWT & Cryptography — RFC 7519 (JWT), RFC 7518 (JWA / RS256), RFC 8017 (RSA-PSS & RSA-OAEP), RFC 2898 / RFC 8018 (PBKDF2), NIST FIPS 180-4 (SHA-256/512), NIST SP 800-38D (AES-256-GCM)
  • TLS & HTTP Security — RFC 5280 (X.509), RFC 8446 / RFC 5246 (TLS 1.3 / 1.2), RFC 9110 (HTTP Semantics), RFC 6585 (HTTP 429)
  • Logging & Integrity — RFC 8259 (JSON), RFC 5424 (Syslog Levels), CWE-117 (Log Injection Prevention), RFC 4251–4254 (SSH/SFTP)

For the complete compliance matrix with implementation details, see the Reference page.

Roadmap

202608 202610 Backlog
Cisco Meeting support Cisco ISR / CUBE / CME support Assistant for troubleshooting
Cisco Expressway support Assistant for certificate renewal
Syslog support Assistant for upgrades
CUC CUMI Support (voicemail interactions)

*ETA subject to change.

Versions & End-of-Life Policy

AI-Bridge for Cisco UC follows a calendar-based versioning scheme: vYYYYMM (e.g., v202606 for the June 2026 release).

Current release status:

Release Status End of Life
v202605 ✅ GA TBD
v202606 ✅ GA TBD
v202608 🔜 Alpha (Next) TBD

Support policy:

  • GA releases receive security patches, bug fixes, and compatibility updates.
  • End of Life (EOL) dates are announced at least 12 months in advance.
  • Only the latest GA release is actively supported. Customers are encouraged to upgrade promptly using the built-in upgrade system.
  • License validity is version-agnostic — a valid license continues to work across upgrades.

For feature requests, bug reports, or EOL inquiries: support@sourdeau.com

Licensing

How Licensing Works

AI-Bridge for Cisco UC uses a simple, offline licensing model — no license server, no internet activation, no subscription portal.

A license is a digitally signed JWT file (license.jwt) issued by the editor and installed locally on the server. The server verifies the license signature at startup and periodically in the background — entirely offline.

What a License Contains

Field Description
Customer Organization name
Tier License tier (e.g., demo, standard, professional)
Products List of enabled product modules (e.g., cucm, imp, cuc)
Max clients Maximum number of simultaneous configured AI clients
Hostname binding The license is bound to a specific server hostname — it cannot be reused on another host
Expiry date License validity end date
Grace period Extra period after expiry during which the server continues to operate (default: 30 days)

License States

The server monitors its license continuously and operates in one of four states:

State Meaning Server behavior
✅ VALID License is current and all checks pass Full operation
⚠️ GRACE License has expired but within the grace period Full operation — renewal reminder logged
❌ EXPIRED License has expired and grace period is over Product modules disabled — infra and common modules still available
🚫 INVALID License file is missing, tampered, or hostname mismatch Product modules not loaded

How to Obtain a License

Licenses are issued by SARL SOURDEAU CONSULTING. To request a license:

  1. Contact contact@sourdeau.com with your organization name and intended deployment scope.
  2. You will receive a license.jwt file by secure transfer, along with installation instructions.
  3. Drop the file into secrets/license.jwt — the server picks it up at next startup or on the next watchdog cycle (no restart required for renewal).

License validity is version-agnostic — a valid license continues to work across upgrades.

Demo license

A time-limited demo license is available on request to evaluate the product in your environment before purchase.

Renewal

License renewal follows the same process: contact the editor, receive a new license.jwt, and replace the file. The server automatically detects the new license within 24 hours without any restart.

Architecture & Design

High-Level Architecture

The following diagram illustrates the full internal architecture of AI-Bridge for Cisco UC, from the AI agent connection through the security layers down to the Cisco UC backends:

High-Level Architecture

Text version (click to expand) 
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
│                                    AI Agent (MCP Client)                                     │
│                       Claude Desktop / GitHub Copilot / Cursor / Custom                      │
└────────────────────────────────────────────┬─────────────────────────────────────────────────┘
                                             │
                                             │
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
│                                     WEB Reverse-Proxy                                        │
│                                         (optional)                                           │
└────────────────────────────────────────────┬─────────────────────────────────────────────────┘
                                             │
                                             │ MCP over Streamable HTTP (HTTPS)
                                             ▼
┌──────────────────────────────────────────────────────────────────────────────────────────────┐
│                             AI-Bridge for Cisco UC (MCP Server)                              │
│                                                                                              │
│ ┌──────────┐ ┌────────────────────────────────────────────────────────────────┐ ┌──────────┐ │
│ │          │ │                    Transport & Security Layer                  │ │          │ │
│ │          │ │      TLS 1.2+ │ DNS Rebinding │ Host/Origin/Content-Type       │ │ Watch-   │ │
│ │  AUDIT   │ └────────────────────────────────────────────────────────────────┘ │ dogs     │ │
│ │    &     │ ┌────────────────────────────────────────────────────────────────┐ │          │ │
│ │MIDDLEWARE│ │                 Authentication & Authorization                 │ │──────────│ │
│ │          │ │ JWT (RS256) │ OAuth 2.1 │ RBAC Profiles │ Rate Limit │ Fail2Ban│ │          │ │
│ │          │ └────────────────────────────────────────────────────────────────┘ │ License  │ │
│ │          │ ┌───────────────┬───────────────┬───────────────┬───────────────┐  │          │ │
│ │ app.log  │ │               │               │               │               │  │──────────│ │
│ │ audit.log│ │      UC       │      UC       │    Common     │ Infra Module  │  │          │ │
│ │          │ │    Module 1   │    Module 2   │    Module     │               │  │ Integrity│ │
│ │          │ │               │               │               │ HTTP Routes   │  │          │ │
│ │          │ │               │               │ Reports       │ /health       │  │──────────│ │    ┌────────────┐
│ │          │ │               │               │ Charts        │ /metrics      │  │          │ │    │            │
│ │          │ │               │               │ PDF Export    │ /status       │  │ Backup   │ │───►│    SFTP    │
│ │          │ │               │               │               │ /token        │  │          │ │    │   Server   │
│ │          │ │               │               │               │ /revoke       │  │          │ │    │            │
│ └──────────┘ └───────────────┴───────────────┴───────────────┴───────────────┘  └──────────┘ │    └────────────┘
│                                                                                              │
└────────────────────────────────────────────────┬─────────────────────────────────────────────┘
          ┌───────────────┬───────────────┬──────┴────────┬───────────────┬──────────────┐
          ▼               ▼               ▼               ▼               ▼              ▼
    ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌────────────┐
    │            │  │            │  │            │  │            │  │            │  │            │
    │    CUCM    │  │    IMP     │  │    CUC     │  │ Expressway │  │    CUBE    │  │  CMS/CMM   │
    │            │  │            │  │            │  │            │  │            │  │            │
    └────────────┘  └────────────┘  └────────────┘  └────────────┘  └────────────┘  └────────────┘

Modules

The following table describes all the architecture components, from the external clients down to the built-in security layers and background subsystems.

External components — not part of AI-Bridge, provided by the customer environment:

Component Description
LLM Large Language Model used by the AI agent (e.g., OpenAI GPT, Anthropic Claude, or a local model). Hosted in the cloud or on-premises.
MCP Client AI agent that communicates with AI-Bridge over the MCP protocol (e.g., Claude Desktop, GitHub Copilot, Cursor, VS Code, custom agent).
Web Reverse Proxy Optional component placed in front of AI-Bridge for TLS termination, or network segmentation (e.g., Nginx, Apache, HAProxy).
SFTP Server SFTP repository to export the application backups

Security & middleware layers — always active, built into the server:

Component Description
Transport Security ASGI middleware enforcing TLS 1.2+, DNS rebinding protection, and Host / Origin / Content-Type header validation on every incoming request.
Authentication & Authorization JWT (RS256) verification, OAuth 2.1 client credentials flow, RBAC profile enforcement, per-client rate limiting, and Fail2Ban IP blocking.
Audit & Middleware MCP-level middleware logging every tool call, resource read, and prompt request to audit.log with client identity, source IP, and result.

Product modules — loaded conditionally based on license entitlements:

Module Namespace MCP Tools Description
CUCM cucm_ 20 Full management of Cisco Unified Communications Manager clusters: credentials, AXL/SOAP operations, RIS real-time queries, VOS CLI commands, Phone Web Access, connectivity diagnostics.
IMP imp_ 14 Management of Cisco IM & Presence Service nodes: credentials, AXL/SOAP operations, VOS CLI commands, connectivity diagnostics.
CUC cuc_ 13 Management of Cisco Unity Connection nodes: credentials, CUPI REST operations (users, mailboxes, call handlers, distribution lists, restriction tables), VOS CLI commands, SSH diagnostics.

Built-in modules — always loaded, not license-gated:

Module Namespace MCP Tools Description
Common common_ 3 Cross-product report engine: Markdown report read/write, 9 chart types (pie, bar, donut, radar, gauge, treemap, grouped bars, waterfall, severity matrix), PDF export.
Infra infra_ 10 Server infrastructure: session bootstrap, RBAC self-discovery, documentation discovery, license state, plus HTTP endpoints /health, /metrics (Prometheus), /status, /token, /revoke.

Background watchdogs — independent threads running after startup:

Watchdog Interval Description
License 24 h Check licensing compliance - Periodically re-verifies the RS256-signed license JWT
Integrity 24 h Check server integrity - Periodically re-runs manifest verification and signature check
Backup 24 h Backup execution - Periodically creates encrypted backup archives with optional SFTP export