How to Leverage Itential Configuration Manager with MCP for AI-Driven Compliance

Misconfigurations aren’t just operational headaches anymore, they’re compliance liabilities.

As networks sprawl across data centers, clouds, and edge locations, and as regulations like PCI DSS, NIST, HIPAA, SOX, and ISO evolve, it’s no longer realistic to rely on manual effort and spreadsheets to keep configurations aligned with policy. Teams are asked to interpret hundreds of pages of standards, translate them into vendor-specific configs, enforce them across thousands of devices, and then prove it all at audit time.

That’s exactly where Itential Configuration Manager and Itential MCP (Model Context Protocol) come together. By combining governed AI with Golden Configurations and policy-aware automation, you can move from “we think we’re compliant” to ongoing, provable compliance at scale.

From Policy to Proof: Automating the Compliance Chain

At the core of Itential’s approach is Configuration Manager, which automates configuration compliance across:

• Network devices (routers, switches, firewalls)
• API-driven controllers
• Cloud and virtual infrastructure

Itential’s Configuration Manager enforces Golden Configurations – reusable, standardized templates that encode your organization’s policy baseline. Instead of one-off configs scattered across the network, you get a structured, consistent model of how things should look.

Now add Itential MCP to the mix.

MCP acts as the control plane for AI, connecting large language models (LLMs) like Claude to your existing Itential environment. It allows AI to:

• Read and interpret dense policy documents.
• Extract security and network requirements.
• Propose modular configuration components.
• Build out Golden Config templates inside Configuration Manager.

Crucially, it does all of this inside your governance model, not around it.

Governed AI, Not Guesswork

A lot of AI stories in infrastructure sound powerful but scary: bots writing configs and pushing changes directly to production. That’s not the Itential model.

With MCP:

• AI never acts directly on the network.
• All AI-generated outputs are logged, reviewed, and version-controlled.
• Approvals, validations, and rollbacks still flow through your existing change-control processes.

Think of MCP as a bridge between policy and platform:

• You give it context: a framework like PCI DSS or NIST, plus your target domains (e.g., Cisco IOS, multi-vendor network, firewalls).
• The LLM, via MCP, reads the standard and extracts controls and requirements.
• MCP uses its understanding of the Itential Platform to create Golden Config trees and templates that are immediately usable inside Configuration Manager.

AI handles the heavy reading and mapping work. Your teams keep the authority and oversight.

How It Works: From 400 Pages to Golden Configs

Here’s what the lifecycle looks like in practice.

Parse Policy into Actionable Controls

Using MCP with your preferred LLM, you feed in the policy – PCI DSS 4.0, a NIST guideline, a HIPAA standard, or all of the above. The AI:

• Reviews the documentation (often hundreds of pages).
• Identifies controls related to areas like AAA, logging, encryption, segmentation, and secure configuration.
• Returns structured recommendations that align to configuration domains.

Instead of “Section 8.3 requires X, Y, Z,” you get “here’s what we need in AAA, ACLs, VLANs, crypto, and logging.”

Build a Golden Config Tree

Those extracted controls are converted into a Golden Config tree inside Itential Configuration Manager. The tree is:

• Modular: Broken into logical nodes (e.g., Network Security Controls, Secure Configuration, Data Protection, Strong Cryptography, Authentication, Logging and Monitoring).
• Vendor-Aware: Templates can target specific platforms like Cisco IOS today, then be extended to Juniper, Arista, firewalls, SD-WAN controllers, and cloud APIs.
• Parameterized: With variables for IP addresses, VLAN IDs, server names, device roles, and more, so the same standard can be applied across many environments.

You end up with a clean, design-friendly structure that’s actually maintainable over time.

Validate and Approve Inside Your Governance

Every AI suggestion stays inside your existing guardrails. In the Itential Platform, you can:

• Review and refine the generated templates.
• Run automated validations and checks.
• Route changes through approvals and change tickets.
• Keep full version history, including who changed what and why.

AI speeds up the creation and evolution of standards, but your governance decides what goes live.

Audit Continuously, Not Once or Twice a Year

Once Golden Configs are in place, Itential’s Configuration Manager can:

• Schedule compliance checks daily, hourly, or per change.
• Compare running configurations and API objects against your Golden Config tree.
• Flag drift as soon as it appears.
• Record configuration history and posture over time.

Instead of scrambling before an audit, you have ongoing visibility into what’s compliant and what’s not.

Remediate and Collect Proof

When drift or misconfigurations are detected, you can:

• Trigger guided remediation workflows for operators.
• Automate low-risk changes via Itential workflows.
• Push corrections out across single devices or entire fleets.

Configuration Manager then helps you generate clean, audit-ready evidence that links:

• Policy intent (the standard and specific controls)
• Enforcement templates (Golden Config tree)
• Actual device posture (what’s compliant, what’s not)
• Time-stamped results (when checks ran, what changed)

This is the bridge from “we think we’re aligned to PCI/NIST/etc.” to “here’s proof.”

Inside the Demo: PCI DSS Compliance at AI Speed

In a recent demo, I joined Principal Solution Architect Ankit Bhansali to walk through this approach live using PCI DSS as the example.

We started in Claude’s interface, connected to the Itential MCP server, and issued a straightforward prompt:

• Research PCI DSS 4.0.
• Understand the network and security requirements.
• Build a Golden Configuration tree in the Itential Platform for Cisco IOS devices.
• Design it to be modular and easy to maintain.

From there, the LLM:

• Pulled from multiple PCI resources.
• Interpreted the control objectives.
• Created a new Golden Config tree in Itential.
• Automatically organized nodes for network security controls, secure configuration, data protection, strong cryptography, authentication, logging, and monitoring.

In Itential Configuration Manager, the tree was there – with templated configs, variables, and example policies that lined up with PCI DSS requirements.

Then, we drilled into nodes like Network Segmentation and ACLs to show:

• How VLANs (e.g., management VLANs, DMZ VLANs) were modeled.
• How ACL structures reflected PCI-driven access control policies.
• How AAA/TACACS, logging, and session settings were represented in a consistent, reusable way.

The key takeaway:

What used to take months of research, design, and documentation by a team was generated in minutes, then refined to fit the organization’s environment.

From there, we showed how the same structure can power:

• Multi-vendor compliance runs (e.g., IOS, IOS-XR, NX-OS, Arista, Juniper).
• Ongoing, scheduled reports.
• Integration with ITSM and documentation tools for tickets, tracking, and audit evidence.