Skip to content
Agentmart
Submit a tool

Network AIops

Governed network device ops (NAPALM) — 33 MCP tools with audit/undo.

Connector by AIops-tools · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/aiops-tools-network-aiops

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Governed network device ops (NAPALM) — 33 MCP tools with audit/undo.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
27 read · 5 write · 1 delete
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Tools by what they do 33

Read from the source code; the running server may list different tools.

Read 27 · Look things up without changing anything.

  • bgp_neighbor_rca
  • config_diff
  • device_facts
  • device_health
  • get_arp_table
  • get_bgp_neighbors
  • get_bgp_neighbors_detail
  • get_environment
  • get_interfaces
  • get_interfaces_counters
  • get_interfaces_ip
  • get_lldp_neighbors
Show 15 more tools
  • get_lldp_neighbors_detail
  • get_mac_address_table
  • get_network_instances
  • get_ntp_servers
  • get_ntp_stats
  • get_optics
  • get_route_to
  • get_snmp_information
  • get_users
  • get_vlans
  • interface_health_rca
  • netbox_device_interfaces
  • netbox_get_device
  • netbox_list_devices
  • undo_list

Write 5 · Create, change, send or run things.

  • config_backup
  • config_merge
  • config_replace
  • confirm_commit
  • undo_apply

Delete 1 · Delete, drop, revoke or wipe things.

  • config_rollback

Network hosts it talks to 3

  • anthropic.com · found in code
  • github.com · found in code
  • glama.ai · found in code

Files it touches

  • ~/.network-aiops/.env
  • ~/.network-aiops
  • ~/.network-aiops/audit.db
  • ~/.network-aiops/config.yaml
  • ~/.network-aiops/secrets.enc
  • ~/.network-aiops/undo.db
  • Any path the agent passes to its tools

Tools (33)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • bgp_neighbor_rca

    [READ] Flag BGP neighbors that are down, shut, recently reset, or route-less. Pulls get_bgp_neighbors and reports worst-first findings, each citing the session state (is_up / is_enabled) or uptime, with a cause and an action (check peer reachability / ACL / MD5 auth). Args: target: Device name from config; omit to use the default device.

  • config_backup

    [READ] Return the device running config, credential values masked by default. Password/secret hashes, SNMP communities, SNMPv3 auth+priv keys, IKE pre-shared keys and RADIUS/TACACS/keychain keys are replaced with "<redacted>"; every other line comes back untouched, so interface, routing and policy config reads exactly as the device wrote it. The result always carries a "redaction" block saying how many lines were changed. Redaction is pattern-based across five vendor syntaxes, so it REDUCES exposure rather than guaranteeing none remains — in particular it cannot see multi-line PKI key blocks…

  • config_diff

    [READ] DRY-RUN: stage a candidate, return the diff, then discard it. Nothing is committed. This is the dry-run primitive for previewing a change. The diff is credential-redacted like config_backup, and for the same reason: a diff that ADDS 'snmp-server community X' contains X, and one that removes a line quotes the credential the device already had. The result carries a "redaction" block with the count. Args: config_text: The configuration snippet (merge) or full config (replace). replace: True to diff as a full-config replacement; False (default) to merge. include_secrets: True…

  • config_merge

    [WRITE] Merge a config snippet and commit under a device-side revert timer. The device REVERTS the change by itself after ``revert_in`` seconds unless confirm_commit follows — so a change that severs your own management access heals without anyone having to reach the box. Verify reachability, THEN call confirm_commit. Check ``commit.safetyNet`` in the result: drivers that cannot arm a timer commit permanently and say so in ``commit.warning``. Returns ``diff`` and a ``backup`` digest (size + sha256). The full config is deliberately NOT returned — it carries credential hashes and PSKs — but th…

  • config_replace

    [WRITE] Replace the full config and commit under a revert timer. HIGH RISK. Same commit-confirm contract as config_merge: the device reverts after ``revert_in`` seconds unless confirm_commit follows. Verify reachability first, then confirm. Check ``commit.safetyNet`` — when no timer could be armed the change is permanent on landing. Returns ``diff`` and a ``backup`` digest; the raw pre-change config is kept in undo.db (0600) for the recorded rollback, not echoed back here. The ``diff`` is credential-redacted with no opt-out (see the ``redaction`` block); use config_diff(include_secrets=True)…

  • config_rollback

    [WRITE] Revert the last committed change via NAPALM rollback(). No undo. Device support varies (rollback depth is platform-dependent). dry_run=True cannot predict the resulting config without the device, so it opens a session (verifying reachability) and reports a digest of the current running config — the state rollback would replace — without rolling back. Args: dry_run: If True, verify reachability and state what rollback would attempt. target: Device name from config.

  • confirm_commit

    [WRITE] Confirm a pending commit-confirm change, cancelling its revert timer. The second half of the commit-confirm workflow. Run it only AFTER verifying the device is still reachable and healthy — doing nothing is the safe alternative, because the device then reverts on its own. dry_run=True reads whether a commit-confirm is actually pending (nothing is confirmed; the revert timer keeps running). Args: dry_run: If True, report whether a pending commit exists without confirming. target: Device name from config.

  • device_facts

    [READ] Core device facts: hostname, vendor, model, OS version, serial, uptime. Also returns the interface name list. Use get_interfaces for per-interface state/speed. Args: target: Device name from config; omit to use the default device.

  • device_health

    [READ] Aggregated health: facts + interface up/down counts + environment. Resilient to drivers lacking get_environment (that section becomes a note). Returns a 'healthy' flag and an 'issues' list summarising attention points. Args: target: Device name from config; omit to use the default device.

  • get_arp_table

    [READ] ARP table entries: interface, IP, MAC, age. Args: target: Device name from config.

  • get_bgp_neighbors

    [READ] BGP neighbors per VRF: peer, remote AS, up state, prefix counts. Args: target: Device name from config.

  • get_bgp_neighbors_detail

    [READ] Detailed BGP neighbors per VRF: state, router id, AS, prefix stats. Args: target: Device name from config; omit to use the default device.

  • get_environment

    [READ] Hardware environment: fans, temperature, power, CPU, memory. Args: target: Device name from config; omit to use the default device.

  • get_interfaces

    [READ] Interfaces with up/down state, enabled flag, speed, and description. Args: target: Device name from config.

  • get_interfaces_counters

    [READ] Per-interface traffic + error counters (octets, packets, errors, discards). Args: target: Device name from config.

Show 18 more tools
  • get_interfaces_ip

    [READ] Per-interface IPv4/IPv6 addresses and prefix lengths. Args: target: Device name from config.

  • get_lldp_neighbors

    [READ] LLDP neighbors: local port, remote hostname, remote port. Args: target: Device name from config.

  • get_lldp_neighbors_detail

    [READ] Detailed LLDP neighbors: chassis id, system name/description, capabilities. Args: target: Device name from config.

  • get_mac_address_table

    [READ] MAC address table: MAC, interface, VLAN, static/active flags. Args: target: Device name from config.

  • get_network_instances

    [READ] Network instances (VRFs): name, type, state, member interfaces. Args: target: Device name from config.

  • get_ntp_servers

    [READ] Configured NTP servers. Args: target: Device name from config.

  • get_ntp_stats

    [READ] NTP peer synchronization stats (stratum, offset, jitter, reachability). Args: target: Device name from config.

  • get_optics

    [READ] Optical transceiver levels per interface/channel (rx/tx power, bias). Args: target: Device name from config.

  • get_route_to

    [READ] Routing-table lookup for a destination prefix (optionally by protocol). Args: destination: The destination prefix to look up (e.g. 10.0.0.0/24). protocol: Optional protocol filter (e.g. bgp, ospf, static). target: Device name from config.

  • get_snmp_information

    [READ] SNMP metadata: chassis id, contact, location. Community strings redacted. Args: target: Device name from config.

  • get_users

    [READ] Local users and privilege levels. Password hashes are NOT returned. Args: target: Device name from config.

  • get_vlans

    [READ] VLANs: id, name, and member interfaces (driver support varies). Args: target: Device name from config.

  • interface_health_rca

    [READ] Flag admin-up/oper-down, erroring, discarding, or flapping interfaces. Pulls get_interfaces + get_interfaces_counters and reports worst-first findings — each citing the measured number (error/discard count, last-flap seconds) that tripped it, with a cause and a concrete action. Args: target: Device name from config; omit to use the default device.

  • netbox_device_interfaces

    [READ] List a NetBox device's interfaces (name, type, enabled, description). The intended interface inventory from source-of-truth — compare against live device state (get_interfaces) to spot drift. Returns ``{"interfaces": [...], "returned": N, "limit": L, "truncated": bool}``. Do NOT report drift from a truncated list — re-run with a higher ``limit``. Args: device: Exact NetBox device name (see netbox_list_devices). limit: Maximum interfaces to return (default 100).

  • netbox_get_device

    [READ] Return a single NetBox device by exact name. Args: name: Exact NetBox device name (see netbox_list_devices).

  • netbox_list_devices

    [READ] List NetBox devices (name, role, site, status, primary IP). Requires a configured NetBox block. Use this to confirm intended state before pushing config to a device. Returns ``{"devices": [...], "returned": N, "limit": L, "truncated": bool}``. When ``truncated`` is true the estate is larger than what you were shown — re-run with a higher ``limit`` before concluding anything about coverage. Args: name: Optional name filter (contains match). limit: Maximum devices to return (default 50).

  • undo_apply

    [WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so its real risk tier is recorded in that tool's audit row. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once. Args: undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

  • undo_list

    [READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply`` would run, and a human note. Use the ``undoId`` with ``undo_apply``. Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. ``truncated`` is *measured* (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher ``limit`` rather than reporting the list as complete. Each entry carries ``effectVerified``. False means the original write lost its response, …

Signals

Stars
0
Forks
0
Open issues
0
Weekly downloads
199
Last commit
Oct 15, 2026 (13 days ago)
Last release
Oct 15, 2026 (13 days ago)
Last package publish
Oct 15, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.AIops-tools/network-aiops
Version
0.14.0
Auth
No auth
Packages
pypi network-aiops
License
MIT
Repository
github.com/AIops-tools/Network-AIops
First seen
Oct 24, 2026
Last checked
Oct 25, 2026
Source
Official MCP Registrygithub-graphql

More from AIops-tools

Cite this page

Network AIops MCP server. Agent Mart. https://agentmart.dev/connectors/aiops-tools-network-aiops (last updated 2026-10-25)