Putting AI to work on real infrastructure

NetApp IT connects AI agents to ONTAP through Model Context Protocol, cutting incident triage from over an hour to under five minutes in production.

There are dream scenarios in IT shops around the world, and this might be one of them.

Picture the moment every IT team dreads: It’s the middle of the night, something’s broken, and no one can agree on what. Storage points to the network. The network points to compute. Compute points back to storage. Engineers are buried in logs, senior leaders are demanding answers, and the clock keeps running. Everyone’s working hard, but the system itself has no way to connect the dots.

Now picture that same incident resolving itself in under five minutes, with a full explanation of what went wrong and exactly what to do next.

That’s not a hypothetical. NetApp is running it in production today, cutting incident triage from more than an hour to under five minutes while helping engineers spend less time hunting through logs and more time solving problems.

The problem AI couldn’t solve on its own

AI has become remarkably good at reasoning through complex problems. But reasoning alone doesn't run enterprise infrastructure.

A model doesn’t automatically understand your ONTAP clusters, your replication relationships, your storage topology, or the decades of “we’ll clean that up later” decisions buried in a global environment. Without that context, AI guesses. It searches documentation. It infers intent. It makes recommendations it can’t back up.

That’s the gap Model Context Protocol (MCP) was built to close.

Toby Cherasaro, storage engineering manager for NetApp IT, puts it this way: “I think of it like the TCP/IP of AI, as it provides a common way to connect different tools.”

MCP gives AI agents a structured way to understand and interact with systems like ONTAP. It supplies the commands, the capabilities, and the operational knowledge an agent needs to do real work instead of leaning on assumptions. Think of it as a translator between AI and infrastructure. And the learning curve difference is staggering.

“It took me years to master storage engineering. One protocol a day, week after week,” Cherasaro said. “AI learns it all at machine speed, then delivers results very quickly.”

From “what if?” to “we’re doing it”

What sets this story apart isn’t just the technology. It’s that NetApp IT is running it on real infrastructure, at full scale, in production.

“We’re an IT department just like you,” Cherasaro said. NetApp IT manages hundreds of petabytes across every NetApp platform, using the same tools NetApp ships to customers: ONTAP, StorageGRID, E-Series, Amazon FSx for NetApp ONTAP, Cloud Volumes ONTAP, and more.

Same platforms. Same incidents. Same operational pressure.

That’s what makes the proof credible. When NetApp IT says something works, it’s because they’ve already run it on the same infrastructure you’re running today.

Cherasaro started by connecting an AI agent to an ONTAP simulator and typing plain-English requests. Create volumes. Resize a volume. Build replication relationships. Show me what changed.

“I hadn't operated ONTAP in a decade at least when I came back to NetApp,” he said. “I focused on being able to connect up LLMs to ONTAP and start creating volumes.” He was managing storage through intent, in natural language, with no command line muscle memory required.

Then it got interesting. When he asked the agent to resize a volume, a command MCP didn’t have, the agent didn’t quit. Given the right context, it wrote a script in the NetApp IT preferred language and delivered the payload. The agent then used the same script for subsequent resize operations by just changing one line of code that specified the new volume size. Very efficient.

“The agent is showing a capability beyond what the MCP was programed to do., If AI delivers non-deterministic results by reasoning through the problem, and leveraging the vast coding knowledge in the model to reach its objective.” Cherasaro said.

That's the paradigm shift.

Incident response at machine speed

Getting storage to respond to plain-English commands was just the beginning. The deeper test is what happens when something breaks.

The old pattern: A ServiceNow ticket comes in, an engineer starts reading logs, and the clock starts running.

“In most cases, it’s taking usually more than an hour just for engineers to sift through logs,” said Rob Rubin, Senior Director of Developer Platform Engineering at NetApp IT. “They may be chasing down the wrong thing. It can be a nightmare.”

The new pattern: A ticket triggers an agentic workflow. A coordinator agent reads the problem statement and routes to the right domain, whether Kubernetes, database, network, or storage. The domain agent uses MCP to inspect the environment, correlate findings, and post a full root cause analysis back to the ticket. Severity level. Confidence score. Recommended actions.

Rob’s team demonstrated it live: a crashing pod, a bare-bones description, and a full root cause analysis delivered back in seconds.

“We're averaging full triage with under five minutes,” Rubin said. Then he drew the line that matters: “We are not replacing human engineers here. We’re trying to help increase their productivity by being able to respond to more tickets in a much faster fashion.”

That philosophy runs throughout. Keep a human in the loop, especially when an action could harm a production environment.

Attacking the “inhuman” problems

Some problems aren’t hard because they’re complex. They’re hard because they’re sprawling, repetitive, and just tedious enough that no one ever gets around to them.

Take auditing local accounts across dozens of ONTAP clusters and hundreds of nodes. Last-login data doesn’t live on the account; it’s buried in security logs. A human has to collect the exports, merge the data, review timestamps, and assemble a report by hand. It’s error-prone and rarely gets done at all.

With ONTAP MCP, you ask in plain language and get fleet-wide analysis in minutes. Same for aging snapshots, stranded replication destinations, configuration drift, and missing protection relationships. The stuff that sits unresolved for years because chasing it manually isn’t worth the sanity.

The difference isn’t a one-time cleanup. It’s a persistent workflow that keeps checking, so nothing slips back into disorder. NetApp IT is shifting from reactive maintenance to continuous hygiene, where the environment stays clean because something is always watching.

One result surprised even the team. Onboarding new sites with complex fan-out replication, they needed accurate topology diagrams.

“AI did all of the topology diagrams for us,” Cherasaro said. A SnapMirror show output across hundreds of nodes is nearly unreadable to a human. As a diagram? Every relationship, visible at a glance.

Doing it safely

Moving fast on infrastructure without the right controls in place isn’t progress; it’s just a more efficient path to breaking something critical. That’s why NetApp IT made safety the foundation, not an afterthought.

Prompts and results stay sovereign, routed through an LLM proxy so data never leaves our Virtual Private Cloud (VPC). Most early workflows are read-only. Read-only is low-stakes and high-impact. Point an engineer to what changed and what’s misconfigured, and you’ve already transformed response time.

Then there’s the supply-chain risk. A malicious actor can clone a vendor’s MCP, hide instructions in matching-font whitespace, and tell the agent to conceal results. Cherasaro’s guidance is direct: Use a vendor with an official MCP server you can trust, control access through an AI gateway, monitor tool usage for anomalies, and never allow ad hoc tooling against production. Break work into composable pieces. Let the AI hand an engineer a payload, the engineer reviews and delivers.

The role that’s changing (yours)

Engineers aren’t disappearing. The nature of their work is shifting.

“They aren’t necessarily going out and manually logging into CLIs and web GUIs and checking this or checking that,” Cherasaro said. “They’re writing policies and governance into documents that AIs read, and AIs go out into the environment, check and validate, and report back to you.”

That shift turns the engineer into an orchestrator: reviewing findings, validating recommendations, and setting the quality bar for AI-assisted operations. Storage engineers will command fleets of agents that inspect, analyze, correlate, and eventually remediate at a scale no human could match by hand.

The engineers who learn these tools will multiply their impact. Those who stay locked into manual workflows will struggle to keep pace.

Why this matters now

For the first time, the operational layer of the data center is being rewritten. MCP is the bridge connecting AI reasoning to real infrastructure action. Without it, AI stays an assistant. With it, AI becomes an operational force multiplier.

Some of these solutions were aspirational late last year. Today they’re in production, built in days, running across compute, virtualization, cloud, middleware, databases, Kubernetes, and every environment NetApp IT touches worldwide.

This isn’t theoretical. It isn’t a roadmap promise. It’s running now.

And the best part isn’t the speed, the scale, or the automation. It’s that the conversation between humans and infrastructure has finally become a real one.

Interested in discovering more?

For more Customer One stories around how we are using our own technology to deliver real transformation visit: NetAppIT.com

The official ONTAP MCP is available for teams ready to connect AI reasoning to real infrastructure.

Frequently asked questions

Is AI replacing IT engineers at NetApp?

No. NetApp IT keeps a human in the loop for any action that could affect a production environment. As Rubin put it, the goal is to help engineers "respond to more tickets in a much faster fashion," not to remove them from the process. The people stay. The repetitive, time-consuming work goes.

Does NetApp use its own AI infrastructure tools internally?

Yes. NetApp IT runs MCP-connected AI agents on the same production platforms it ships to customers, including ONTAP, StorageGRID®, and E-Series, managing hundreds of petabytes at full scale. No separate stack. No lab environment. The same systems, under real operational load.

What is Model Context Protocol (MCP)?

MCP is a standard that gives AI agents a structured way to understand and act on systems like ONTAP. Instead of guessing, agents receive the commands, capabilities, and operational context they need to do real work. Cherasaro compares it to "the TCP/IP of AI"—the connective layer between agents and the tools they operate.