V5.7

.github/workflows/build-containers.yml

@@ -123,3 +123,21 @@ jobs:
           push: true
           tags: ${{ steps.meta-devportal.outputs.tags }}
           labels: ${{ steps.meta-devportal.outputs.labels }}
+
+      # Build and push MCP container
+      - name: Extract metadata (tags, labels) for MCP container
+        id: meta-mcp
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-mcp
+          tags: |
+            type=sha
+            type=raw,value=latest
+
+      - name: Build and push MCP image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        with:
+          context: contrib/mcp/.
+          push: true
+          tags: ${{ steps.meta-mcp.outputs.tags }}
+          labels: ${{ steps.meta-mcp.outputs.labels }}

.github/workflows/build-pr.yml

@@ -82,3 +82,10 @@ jobs:
         with:
           context: contrib/devportal/redocly/.
           push: false
+
+      # Build MCP container
+      - name: Build MCP image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        with:
+          context: contrib/mcp/.
+          push: false

.github/workflows/build-release.yml

@@ -130,3 +130,23 @@ jobs:
           push: true
           tags: ${{ steps.meta-devportal.outputs.tags }}
           labels: ${{ steps.meta-devportal.outputs.labels }}
+
+      # Build and push MCP container
+      - name: Extract metadata (tags, labels) for MCP container
+        id: meta-mcp
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-mcp
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+
+      - name: Build and push MCP image
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        with:
+          context: contrib/mcp/.
+          push: true
+          tags: ${{ steps.meta-mcp.outputs.tags }}
+          labels: ${{ steps.meta-mcp.outputs.labels }}

.gitignore

@@ -20,9 +20,11 @@ Thumbs.db
 =======
 /.idea/
 /venv/
+/tests/__pycache__/
 /src/__pycache__/
 /src/v5_5/__pycache__/
 /src/v5_6/__pycache__/
+/src/v5_7/__pycache__/
 /tests/__pycache__/
 /v5_4/__pycache__/
 /contrib/devportal/redocly/src/__pycache__/

Dockerfile

@@ -9,10 +9,9 @@ COPY etc/ etc/
 COPY src/ src/
 COPY templates/ templates/
 
-RUN python3 -m venv /deployment/env/ && \
-    source /deployment/env/bin/activate && \
-    pip3 install --no-cache --upgrade pip setuptools virtualenv && \
-    pip3 install -r src/requirements.txt
+RUN python3 -m venv /deployment/env && \
+    /deployment/env/bin/pip install --no-cache-dir --upgrade pip setuptools virtualenv && \
+    /deployment/env/bin/pip install --no-cache-dir -r src/requirements.txt
 
 WORKDIR /deployment/src
 CMD ["/deployment/env/bin/python3", "./main.py"]

README.md

@@ -21,6 +21,7 @@ This tool is ideal for managing NGINX in **modern, dynamic infrastructures** suc
 - ✅ **Error Reduction**: Built-in validation for accurate and optimized configurations.
 - ✅ **Dynamic Updates**: Handle frequent configuration changes in highly dynamic environments.
 - ✅ **Seamless Scalability**: Simplifies managing NGINX setups in high-scale distributed architectures.
+- ✅ **MCP Server**: Provides the ability to configure NGINX using natural language.
 
 
 GitOps integration is supported: source of truth is checked for updates (F5 WAF for NGINX policies, TLS certificates, keys and chains/bundles, Swagger/OpenAPI definitions, snippets) and NGINX configurations are automatically kept in sync.
@@ -45,12 +46,13 @@ A **blog article** to automate NGINX API Gateway management from OpenAPI schemas
 
 ## 🚀 Supported releases
 
-- [F5 NGINX Instance Manager 2.20+](https://docs.nginx.com/nginx-instance-manager/)
-- [F5 NGINX One Console](https://docs.nginx.com/nginx-one/)
-- [F5 NGINX Plus R33+](https://docs.nginx.com/nginx/)
-- [F5 WAF for NGINX](https://docs.nginx.com/waf/)
+| API Version | F5 NGINX Instance Manager | F5 NGINX One Console | F5 NGINX Plus | F5 WAF for NGINX |
+|-------------|---------------------------|----------------------|---------------|------------------|
+| v5.5        | 2.20+                     | January 2026         | R33+          | 5.x              |
+| v5.6        | 2.20+                     | January 2026         | R33+          | 5.x              |
+| v5.7        | 2.22+                     | August 2026          | R35+          | 5.x              |
 
-**Note**: F5 NGINX Plus R33 and above [require a valid license](https://docs.nginx.com/solutions/about-subscription-licenses/) and the `.output.license` section in the declarative JSON is required.
+>**Note**: F5 NGINX Plus R33 and above [require a valid license](https://docs.nginx.com/solutions/about-subscription-licenses/) and the `.output.license` section in the declarative JSON is required.
 
 ## 🛠️ Architecture
 
@@ -59,27 +61,27 @@ A **blog article** to automate NGINX API Gateway management from OpenAPI schemas
 title: NGINX Declarative API architecture
 ---
 stateDiagram-v2
-    DevOps: User
-    Client: REST Client
-    Pipeline: CI/CD Pipeline
+    Client: **REST Client**
+    Pipeline: **CI/CD Pipeline**
     NIM: NGINX Instance Manager
     N1: NGINX One Console
     AGENT1: NGINX Agent
     NGINX1: NGINX
     AGENT2: NGINX Agent
     NGINX2: NGINX
-    INPUT: Input
     SOT: Source of Truth
     NDAPI: NGINX Declarative API
     DEVP: Developer Portal Service
     OUTPUT: Output
     REDIS: Redis
     3RDPARTY: 3rd Party integrations
+    MCP: MCP Server
+    MCPC: **MCP Client**
 
-    DevOps --> Pipeline
-    Pipeline --> INPUT
-    Client --> INPUT
-    INPUT --> NDAPI
+    MCPC --> MCP
+    MCP --> NDAPI
+    Pipeline --> NDAPI
+    Client --> NDAPI
     NDAPI --> OUTPUT
     NDAPI --> SOT
     SOT --> NDAPI
@@ -202,12 +204,22 @@ end
 
 See the [features list](/FEATURES.md)
 
+### 🤖 MCP server (Model Context Protocol)
+
+[contrib/mcp](/contrib/mcp) provides an MCP server that lets LLMs (Claude Desktop, Claude Code, or any MCP-compatible client) drive the NGINX Declarative API using
+natural language.
+
+Creating, updating, retrieving, and deleting declarations, and checking asynchronous submission status, without the user hand-writing JSON or REST calls.
+
+See the [MCP Server README](/contrib/mcp/README.md) for setup.
+
 ## 🔧 How to use
 
 Usage details and JSON schema are available here:
 
-- [API v5.6](/USAGE-v5.6.md) - latest
-- [API v5.5](/USAGE-v5.5.md) - stable
+- [API v5.7](/USAGE-v5.7.md) - latest
+- [API v5.6](/USAGE-v5.6.md) - stable
+- [API v5.5](/USAGE-v5.5.md) - deprecated
 
 A sample Postman collection and usage instructions can be found [here](/contrib/postman)
 

USAGE-v5.7.md

@@ -0,0 +1,72 @@
+# Usage for NGINX Declarative API v5.7
+
+Version 5.7 supports:
+
+- [NGINX Instance Manager](https://docs.nginx.com/nginx-instance-manager/) 2.22+
+- [NGINX One Console](https://docs.nginx.com/nginx-one-console/)
+- [NGINX Plus](https://docs.nginx.com/nginx/) R37+
+- [F5 WAF for NGINX](https://docs.nginx.com/waf/) with precompiled [policy bundles](https://docs.nginx.com/nginx-app-protect-waf/v5/admin-guide/compiler/)
+
+The JSON schema is self explanatory. See also the [sample Postman collection](/contrib/postman) for usage examples
+
+- `.output.license` defines the JWT license to use
+  - `.output.license.endpoint` the usage reporting endpoint (defaults to `product.connect.nginx.com`). NGINX Instance Manager address or FQDN can be used here
+  - `.output.license.token` the JWT license token. If this field is omitted, it is assumed that a `/etc/nginx/license.jwt` token already exists on the instance and it won't be replaced
+  - `.output.license.ssl_verify` set to `false` to trust all SSL certificates (not recommended). Useful for reporting to NGINX Instance Manager without a local PKI.
+  - `.output.license.grace_period` Set to 'true' to begin the 180-day reporting enforcement grace period. Reporting must begin or resume before the end of the grace period to ensure continued operation
+  - `.output.license.proxy` The optional explicit forward proxy `IP_address:port` or `FQDN:port` for usage reporting
+  - `.output.license.proxy_username` The optional explicit forward proxy authentication username for usage reporting
+  - `.output.license.proxy_password` The optional explicit forward proxy authentication password for usage reporting
+- `.output.type` defines how NGINX configuration will be returned:
+  - *nms* - NGINX configuration is published as a Staged Config to NGINX Instance Manager
+    - `.output.nms.url` the NGINX Instance Manager URL
+    - `.output.nms.username` the NGINX Instance Manager authentication username
+    - `.output.nms.password` the NGINX Instance Manager authentication password
+    - `.output.nms.instancegroup` the NGINX Instance Manager instance group to publish the configuration to
+    - `.output.nms.synctime` **optional**, used for GitOps autosync. When specified and the declaration includes HTTP(S) references to NGINX App Protect policies, TLS certificates/keys/chains, the HTTP(S) endpoints will be checked every `synctime` seconds and if external contents have changed, the updated configuration will automatically be published to NGINX Instance Manager
+    - `.output.nms.synchronous` **optional**, when set to `True` (default) the NGINX Declarative API waits for NGINX Instance Manager successful reply after publishing the NGINX configuration. Setting this to `False` enqueues the request, supporting multiple JSON declarations to be submitted at the same time/from multiple clients. Currently supported for `PATCH` operations only.
+    - `.output.nms.modules` an optional array of NGINX module names (ie. 'ngx_http_app_protect_module', 'ngx_http_js_module','ngx_stream_js_module')
+  - *nginxone* - NGINX configuration is published to a NGINX One Console config sync group
+    - `.output.nginxone.url` the NGINX One Console URL
+    - `.output.nginxone.namespace` the NGINX One Console namespace
+    - `.output.nginxone.token` the authentication token
+    - `.output.nginxone.configsyncgroup` the NGINX One Console config sync group name
+    - `.output.nginxone.synctime` **optional**, used for GitOps autosync. When specified and the declaration includes HTTP(S) references to WAF policies, TLS certificates/keys/chains, the HTTP(S) endpoints will be checked every `synctime` seconds and if external contents have changed, the updated configuration will automatically be published to NGINX One Cloud Console
+    - `.output.nms.synchronous` **optional**, when set to `True` (default) the NGINX Declarative API waits for NGINX One Console successful reply after publishing the NGINX configuration. Setting this to `False` enqueues the request, supporting multiple JSON declarations to be submitted at the same time/from multiple clients. Currently supported for `PATCH` operations only.
+    - `.output.nginxone.modules` an optional array of NGINX module names (ie. 'ngx_http_app_protect_module', 'ngx_http_js_module','ngx_stream_js_module')
+- `.declaration` describes the NGINX configuration to be created
+  - `.declaration.http` NGINX HTTP definitions
+    - `.declaration.http.policies[]` an optional array of WAF security policies
+      - `.declaration.http.policies[].type` the policy type ('app_protect')
+      - `.declaration.http.policies[].name` the policy name (ie. 'prod-policy')
+      - `.declaration.http.policies[].active_tag` the policy tag to enable among all available versions (ie. 'v1')
+      - `.declaration.http.policies[].versions[]` array with all available policy versions
+      - `.declaration.http.policies[].versions[].tag` the policy version's tag name
+      - `.declaration.http.policies[].versions[].displayName` the policy version's display name
+      - `.declaration.http.policies[].versions[].description` the policy version's description
+      - `.declaration.http.policies[].versions[].contents` this can be either base64-encoded or be a HTTP(S) URL that will be fetched dynamically from a source of truth
+    - `.declaration.http.log_profiles[]` an optional array of WAF log profiles
+      - `.declaration.http.log_profiles[].type` the log profile type ('app-protect')
+      - `.declaration.http.log_profiles[].app_protect` F5 WAF for NGINX log profile configuration
+  - `.declaration.layer4` NGINX TCP/UDP definitions
+  - `.declaration.resolvers` DNS resolvers definitions
+  - `.declaration.certificates` an optional array of TLS certificates/keys/chains to be published
+    - `.declaration.certificates[].type` the item type ('certificate', 'key', 'chain')
+    - `.declaration.certificates[].name` the certificate/key/chain name with no path/extension (ie. 'test-application')
+    - `.declaration.certificates[].contents` the content: this can be either base64-encoded or be a HTTP(S) URL that will be fetched dynamically from a source of truth
+  - `.declaration.authentication` Client and server authentication profiles definitions
+  - `.declaration.authorization` Client authorization profiles definitions
+
+### API endpoints
+
+- `GET /v5.7/schema` - Get Declarative API JSON schema
+- `POST /v5.7/config` - Publish a new declaration
+- `PATCH /v5.7/config/{config_uid}` - Update an existing declaration
+  - Per-HTTP server CRUD
+  - Per-HTTP upstream CRUD
+  - Per-Stream server CRUD
+  - Per-Stream upstream CRUD
+  - Per-WAF policy CRUD
+- `GET /v5.7/config/{configUid}/submission/{submissionUid}` - Retrieve a submission (asynchronous `PATCH` request) status
+- `GET /v5.7/config/{config_uid}` - Retrieve an existing declaration
+- `DELETE /v5.7/config/{config_uid}` - Delete an existing declaration

contrib/README.md

@@ -5,4 +5,5 @@
 - [GitOps examples](gitops-examples) - sample source of truth objects
 - [Helm Chart](helm) - Helm chart for Kubernetes
 - [Kubernetes](kubernetes) - to run NGINX Declarative API on Kubernetes
+- [MCP Server](mcp) - Model Context Protocol server to use the NGINX Declarative API with natural language
 - [Postman](postman) - Sample Postman collection to test and run NGINX Declarative API

contrib/devportal/redocly/Dockerfile

@@ -6,10 +6,8 @@ COPY src src/
 
 RUN apk update && \
     apk add --update --no-cache bash python3 && \
-    python3 -m venv /deployment/env/ && \
-    . /deployment/env/bin/activate && \
-    pip3 install --no-cache --upgrade pip setuptools virtualenv && \
-    python3 -m pip install --upgrade pip && \
-    pip3 install -r /deployment/src/requirements.txt
+    python3 -m venv /deployment/env && \
+    /deployment/env/bin/pip install --no-cache-dir --upgrade pip setuptools && \
+    /deployment/env/bin/pip install --no-cache-dir -r /deployment/src/requirements.txt
 
 ENTRYPOINT [ "/deployment/src/start.sh" ]

contrib/devportal/redocly/src/requirements.txt

@@ -1,4 +1,2 @@
-typing
 uvicorn
 fastapi
-uuid