| client_listA | [READ] Clients seen on a network within a look-back window. Args:
network_id: Meraki network id (from network_list).
timespan: Look-back window in seconds (7200..2592000, default 86400).
target: Target name from config; omit for the default.
|
| client_getA | [READ] One client's detail (description, MAC, IP, VLAN, manufacturer). Args:
network_id: Meraki network id.
client_id: Client id/MAC (from client_list).
target: Target name from config; omit for the default.
|
| client_usageA | [READ] A client's usage history rolled up to total sent/received KB. Args:
network_id: Meraki network id.
client_id: Client id/MAC (from client_list).
target: Target name from config; omit for the default.
|
| client_connectivityC | [READ] A client's connection-quality stats (assoc/auth/dhcp/dns/success). Args:
network_id: Meraki network id.
client_id: Client id/MAC (from client_list).
target: Target name from config; omit for the default.
|
| device_inventoryA | [READ] Org device inventory, optionally filtered by model family. Buckets devices by Meraki model prefix (MX security appliance, MS switch, MR
wireless AP, MV camera, MG cellular gateway) and returns per-family counts.
Args:
org_id: Meraki organization id; omit to use the target's default org.
model: Model family/prefix to filter (e.g. 'MS', 'MR46'); omit for all.
limit: Max rows in the returned list (default 500). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
target: Target name from config; omit for the default.
|
| device_statusA | [READ] One device's availability status (online/offline/alerting/dormant). Args:
serial: Device serial (e.g. Q2XX-XXXX-XXXX).
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| device_uplinksA | [READ] Appliance/gateway uplink statuses across the org (WAN interfaces). Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| switch_portsB | [READ] Switch (MS) port configuration for a device by serial. Args:
serial: MS switch serial.
target: Target name from config; omit for the default.
|
| wireless_ssidsA | [READ] Wireless (MR) SSIDs configured on a network (number, name, enabled). Args:
network_id: Meraki network id (from network_list).
target: Target name from config; omit for the default.
|
| uplink_loss_and_latency_rcaA | [READ] Rank the worst MX WAN uplinks by loss + latency, map cause + action. The flagship uplink RCA: pulls per-uplink loss/latency across the org (MX
security appliances), ranks the worst uplinks by a composite of average loss
and latency, flags each degraded uplink against the thresholds, and attaches
a likely cause and a recommended action. Every ranking carries its numbers,
not a black-box verdict. Pass 'records' for pure analysis, or an org/target
to pull live.
Args:
loss_pct: Avg loss %% at/above which an uplink is degraded (default 5.0).
latency_ms: Avg latency ms at/above which an uplink is degraded (default 150).
records: Injected uplink series — {serial, networkId, uplink, ip,
timeSeries:[{lossPercent, latencyMs}]}; skips live collection.
org_id: Meraki organization id for live pull; omit to use target default.
limit: Max rows in the ranked list (default 100). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
target: Target name from config; omit for the default.
Returns dict: {uplinksEvaluated, degradedCount, thresholds, worst:[{serial,
networkId, uplink, ip, avgLossPct, maxLossPct, avgLatencyMs, maxLatencyMs,
degraded, cause, action}], returned, limit, truncated, note}.
|
| network_health_scoreA | [READ] Composite fleet health score per network (0-100), worst-first. Folds device online %%, uplink health %%, and an alert-severity penalty into
one weighted score per network (0.5 / 0.3 / 0.2), every component returned so
the number is explainable. Pure analysis over injected rows — no live pull.
Args:
device_statuses: rows {serial, networkId, status, productType} (e.g. from
org_device_statuses' 'devices').
uplinks: optional rows {networkId, status} (active/ready = healthy).
alerts: optional rows {networkId, severity} (critical/warning/info).
limit: Max rows in the ranked list (default 100). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
Returns dict: {networksEvaluated, fleetScore, summary:{healthy, degraded,
critical}, weights, worst:[{networkId, score, band, devicesOnline,
devicesTotal, onlinePct, uplinkHealthPct, alertPenalty}], returned,
limit, truncated, note}.
Example: network_health_score(device_statuses=[
{"networkId":"N1","status":"online"},
{"networkId":"N1","status":"offline"}]).
|
| config_template_driftA | [READ] For networks bound to a config template, list drifted settings. Compares each network bound to the template against the template's settings
by exact value and reports expected-vs-actual for every drifted key. Pure
analysis over injected data — no live pull.
Args:
template: {id, name, settings:{key: value}} — the config template.
networks: rows {networkId, name, boundTemplateId, settings:{key: value}};
only those whose boundTemplateId matches template['id'] are checked.
limit: Max rows in the drifted list (default 100). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
Returns dict: {templateId, templateName, boundNetworks, driftedCount,
compliantCount, settingsChecked, driftedNetworks:[{networkId, name,
deviations:[{setting, expected, actual}]}], returned, limit, truncated,
note}.
Example: config_template_drift(
template={"id":"T1","name":"branch","settings":{"timezone":"UTC"}},
networks=[{"networkId":"N1","boundTemplateId":"T1",
"settings":{"timezone":"PST"}}]).
|
| network_listA | [READ] Networks in the organization (id, name, productTypes, tags). Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| network_getA | [READ] One network by id (name, product types, timezone, bound template). Args:
network_id: Meraki network id (from network_list).
target: Target name from config; omit for the default.
|
| network_vlansA | [READ] Appliance VLANs configured on a network (id, subnet, appliance IP). Args:
network_id: Meraki network id (from network_list).
target: Target name from config; omit for the default.
|
| network_alertsA | [READ] Current network health alerts, summarised by severity. Args:
network_id: Meraki network id (from network_list).
limit: Max rows in the returned list (default 200). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
target: Target name from config; omit for the default.
|
| network_trafficA | [READ] Application/protocol traffic mix for a network, top apps by bytes. Args:
network_id: Meraki network id (from network_list).
timespan: Look-back window in seconds (7200..2592000, default 86400).
limit: Max rows in the returned list (default 25). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
target: Target name from config; omit for the default.
|
| overviewA | [READ] One-shot fabric fleet health: networks + device status/product rollup. Call this first to triage a Meraki organization before drilling into a
specific network or device.
Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| org_listB | [READ] Organizations visible to the API key (id, name, url, apiEnabled). Args:
target: Target name from config; omit for the default.
|
| org_getA | [READ] One organization by id (name, url, api access, cloud region). Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| org_licensingA | [READ] Org licensing overview: status, expiration, per-device-type counts. Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| org_adminsA | [READ] Dashboard administrators for the org (name, email, access level). Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| org_device_statusesA | [READ] Org-wide device availability rolled up by status + product type. Args:
org_id: Meraki organization id; omit to use the target's default org.
limit: Max rows in the returned list (default 500). The result carries
'returned'/'limit'/'truncated'; re-run with a higher limit when
'truncated' is true rather than treating the list as complete.
target: Target name from config; omit for the default.
|
| org_api_requestsA | [READ] Org API-request usage overview (response-code counts, 429 rate-limits). Args:
org_id: Meraki organization id; omit to use the target's default org.
target: Target name from config; omit for the default.
|
| reboot_deviceA | [WRITE][risk=high] Reboot a device (no safe inverse). Records the device's prior status for the audit trail; a reboot cannot be
undone, so no undo descriptor is offered. Pass dry_run=True to preview.
Args:
serial: Device serial to reboot.
dry_run: If True, preview without rebooting.
target: Target name from config; omit for the default.
|
| blink_device_ledsA | [WRITE][risk=medium] Blink a device's locator LEDs to find it physically. No configuration change (a locate aid), so no undo is recorded. It is still
a POST to the controller, so it is tiered as a write: ``risk_level="low"``
is what marks a tool as a *read*. Tiering this "low" would misreport a POST
as a read in the audit trail, contradicting its own [WRITE] tag.
Args:
serial: Device serial.
duration: Blink duration in seconds (5..120, default 20).
target: Target name from config; omit for the default.
|
| update_deviceA | [WRITE][risk=medium] Update device attributes (name/tags/address/notes). Captures the changed keys' prior values before the change, so the harness
records an undo (restore the prior values) and a faithful audit trail. Pass
dry_run=True to preview.
Args:
serial: Device serial.
attrs: Attributes to set — allowed keys: name, tags, address, notes,
lat, lng, floorPlanId.
dry_run: If True, preview without changing.
target: Target name from config; omit for the default.
|
| update_network_vlanA | [WRITE][risk=medium] Update an appliance VLAN, capturing its prior values. Captures the changed keys' prior values before the change (undo restores
them). Pass dry_run=True to preview.
Args:
network_id: Meraki network id.
vlan_id: VLAN id to update.
attrs: Attributes to set — allowed keys: name, subnet, applianceIp,
groupPolicyId, dhcpHandling.
dry_run: If True, preview without changing.
target: Target name from config; omit for the default.
|
| claim_devices_into_networkA | [WRITE][risk=high] Claim devices into a network. Inverse: remove them. Records the claimed serials so the harness can offer an undo (remove them).
Pass dry_run=True to preview.
Args:
network_id: Meraki network id to claim into.
serials: Device serials to claim.
dry_run: If True, preview without claiming.
target: Target name from config; omit for the default.
|
| remove_device_from_networkA | [WRITE][risk=high] Remove device(s) from a network. Inverse: claim back. The devices' current network is captured for undo, so the undo token is
genuinely applicable — but claiming a device back restores MEMBERSHIP, not
CONFIGURATION. A removed device is reset to an unconfigured state; it
returns with the network's defaults, without the name, tags, address, notes
or switch-port settings it carried before. Read those with device_status /
switch_ports first if you will need them back.
Pass dry_run=True to preview. Accepts a single ``serial`` or a ``serials``
list — the list form is how claim_devices_into_network's undo replays.
Args:
network_id: Meraki network id the devices are bound to.
serial: One device serial to remove (or use ``serials``).
serials: Device serials to remove (mutually exclusive with ``serial``).
dry_run: If True, preview without removing.
target: Target name from config; omit for the default.
|
| bind_network_to_templateA | [WRITE][risk=high] Bind a network to a config template, capturing prior binding. REFUSES when the network is unbound and carries local VLANs: the bind
overwrites them with the template's, unbinding does not put them back, and
this tool has no VLAN-create operation — so the undo would report success
having restored nothing.
Undo, precisely: rebind to the prior template when there was one (a faithful
restore — the configuration was template-derived either way); unbind when
the network was unbound with a VERIFIED empty VLAN set (restores the binding
state only, NOT firewall rules / group policies / static routes); and NO
undo at all when the prior VLAN set could not be read.
Pass dry_run=True to preview. The preview runs the same refusal check
(reads only), so it never previews green a bind the real call would refuse.
Args:
network_id: Meraki network id to bind.
template_id: Config template id to bind to.
auto_bind: Auto-bind switch/AP profiles (Meraki autoBind flag).
dry_run: If True, preview without binding.
target: Target name from config; omit for the default.
|
| unbind_network_from_templateA | [WRITE][risk=high] Unbind a network from its config template. Inverse: rebind. Captures the template the network was bound to, so undo rebinds to it. Pass
dry_run=True to preview.
Args:
network_id: Meraki network id to unbind.
dry_run: If True, preview without unbinding.
target: Target name from config; omit for the default.
|
| undo_listA | [READ] List recorded, not-yet-applied undo tokens (most recent first). Each entry names the original tool, the inverse tool that ``undo_apply``
would run, and a human note. Use the ``undoId`` with ``undo_apply``.
One extra row is fetched so ``truncated`` is **measured**, not guessed from
the returned count happening to equal the limit — a capped list that cannot
say "there is more" invites a weak model to report it as the whole story.
Each entry carries ``effectVerified``. False means the original write
lost its response, so the change it reverses is PROBABLE, not confirmed —
check the live state before applying, and do not report the result as a
restore of a state that may never have been reached.
Args:
limit: Max rows to return (default 50).
target: Unused (undo state is host-local); accepted for CLI uniformity.
|
| undo_applyA | [WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool. The inverse runs through its own governed tool, so its real risk tier is
recorded there. Pass dry_run=True to preview the inverse call without
executing it. A token can only be applied once.
Args:
undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result).
dry_run: If True, preview the inverse tool + params without running it.
target: Passed through to the inverse tool when it accepts a target.
|
