[READ] Return the device running config, credential values masked by default.

Password/secret hashes, SNMP communities, SNMPv3 auth+priv keys, IKE pre-shared keys and RADIUS/TACACS/keychain keys are replaced with ""; every other line comes back untouched, so interface, routing and policy config reads exactly as the device wrote it.

The result always carries a "redaction" block saying how many lines were changed. Redaction is pattern-based across five vendor syntaxes, so it REDUCES exposure rather than guaranteeing none remains — in particular it cannot see multi-line PKI key blocks.

Prefer the CLI's '-o ' flag over include_secrets when a human needs the real config: it writes the raw text to a file instead of into this transcript.

Args: include_secrets: True to return the verbatim config, credentials and all. Every secret in it then lives wherever this result is stored. target: Device name from config; omit to use the default device.

[READ] DRY-RUN: stage a candidate, return the diff, then discard it.

Nothing is committed. This is the dry-run primitive for previewing a change.

The diff is credential-redacted like config_backup, and for the same reason: a diff that ADDS 'snmp-server community X' contains X, and one that removes a line quotes the credential the device already had. The result carries a "redaction" block with the count.

Args: config_text: The configuration snippet (merge) or full config (replace). replace: True to diff as a full-config replacement; False (default) to merge. include_secrets: True to return the verbatim diff — use when verifying that the literal key you are pushing is the one that will land. target: Device name from config.

[WRITE] Merge a config snippet and commit under a device-side revert timer.

The device REVERTS the change by itself after revert_in seconds unless confirm_commit follows — so a change that severs your own management access heals without anyone having to reach the box. Verify reachability, THEN call confirm_commit. Check commit.safetyNet in the result: drivers that cannot arm a timer commit permanently and say so in commit.warning.

Returns diff and a backup digest (size + sha256). The full config is deliberately NOT returned — it carries credential hashes and PSKs — but the raw text is retained in undo.db for the recorded rollback. The diff is credential-redacted with no opt-out (see the redaction block); use config_diff(include_secrets=True) first if you must verify a literal key.

dry_run=True stages the candidate, returns the diff, discards it, and runs the SAME refusal the real commit would — so a green preview is never followed by a refusal.

Args: config_text: The configuration snippet to merge. revert_in: Device-side revert timer in seconds (default 300). 0 disables it, leaving the recorded undo as the only rollback path. dry_run: If True, preview the diff + safety assessment without committing. target: Device name from config.

[WRITE] Replace the full config and commit under a revert timer. HIGH RISK.

Same commit-confirm contract as config_merge: the device reverts after revert_in seconds unless confirm_commit follows. Verify reachability first, then confirm. Check commit.safetyNet — when no timer could be armed the change is permanent on landing.

Returns diff and a backup digest; the raw pre-change config is kept in undo.db (0600) for the recorded rollback, not echoed back here. The diff is credential-redacted with no opt-out (see the redaction block); use config_diff(include_secrets=True) first if you must verify a literal key.

dry_run=True previews the diff and runs the same refusal the real commit would, so the preview can never disagree with the commit.

Args: config_text: The full replacement configuration. revert_in: Device-side revert timer in seconds (default 300). 0 disables it, leaving the recorded undo as the only rollback path. dry_run: If True, preview the diff + safety assessment without committing. target: Device name from config.

[WRITE] Confirm a pending commit-confirm change, cancelling its revert timer.

The second half of the commit-confirm workflow. Run it only AFTER verifying the device is still reachable and healthy — doing nothing is the safe alternative, because the device then reverts on its own.

dry_run=True reads whether a commit-confirm is actually pending (nothing is confirmed; the revert timer keeps running).

Args: dry_run: If True, report whether a pending commit exists without confirming. target: Device name from config.

[WRITE] Revert the last committed change via NAPALM rollback(). No undo.

Device support varies (rollback depth is platform-dependent).

dry_run=True cannot predict the resulting config without the device, so it opens a session (verifying reachability) and reports a digest of the current running config — the state rollback would replace — without rolling back.

Args: dry_run: If True, verify reachability and state what rollback would attempt. target: Device name from config.

[READ] Flag admin-up/oper-down, erroring, discarding, or flapping interfaces.

Pulls get_interfaces + get_interfaces_counters and reports worst-first findings — each citing the measured number (error/discard count, last-flap seconds) that tripped it, with a cause and a concrete action.

Args: target: Device name from config; omit to use the default device.

[READ] Flag BGP neighbors that are down, shut, recently reset, or route-less.

Pulls get_bgp_neighbors and reports worst-first findings, each citing the session state (is_up / is_enabled) or uptime, with a cause and an action (check peer reachability / ACL / MD5 auth).

Args: target: Device name from config; omit to use the default device.

[READ] Hardware environment: fans, temperature, power, CPU, memory.

Args: target: Device name from config; omit to use the default device.

[READ] Optical transceiver levels per interface/channel (rx/tx power, bias).

Args: target: Device name from config.

[READ] Configured NTP servers.

Args: target: Device name from config.

[READ] NTP peer synchronization stats (stratum, offset, jitter, reachability).

Args: target: Device name from config.

[READ] Local users and privilege levels. Password hashes are NOT returned.

Args: target: Device name from config.

[READ] SNMP metadata: chassis id, contact, location. Community strings redacted.

Args: target: Device name from config.

[READ] Network instances (VRFs): name, type, state, member interfaces.

Args: target: Device name from config.

[READ] Core device facts: hostname, vendor, model, OS version, serial, uptime.

Also returns the interface name list. Use get_interfaces for per-interface state/speed.

Args: target: Device name from config; omit to use the default device.

[READ] Interfaces with up/down state, enabled flag, speed, and description.

Args: target: Device name from config.

[READ] Per-interface IPv4/IPv6 addresses and prefix lengths.

Args: target: Device name from config.

[READ] BGP neighbors per VRF: peer, remote AS, up state, prefix counts.

Args: target: Device name from config.

[READ] LLDP neighbors: local port, remote hostname, remote port.

Args: target: Device name from config.

[READ] ARP table entries: interface, IP, MAC, age.

Args: target: Device name from config.

[READ] Aggregated health: facts + interface up/down counts + environment.

Resilient to drivers lacking get_environment (that section becomes a note). Returns a 'healthy' flag and an 'issues' list summarising attention points.

Args: target: Device name from config; omit to use the default device.

[READ] Per-interface traffic + error counters (octets, packets, errors, discards).

Args: target: Device name from config.

[READ] MAC address table: MAC, interface, VLAN, static/active flags.

Args: target: Device name from config.

[READ] VLANs: id, name, and member interfaces (driver support varies).

Args: target: Device name from config.

[READ] Routing-table lookup for a destination prefix (optionally by protocol).

Args: destination: The destination prefix to look up (e.g. 10.0.0.0/24). protocol: Optional protocol filter (e.g. bgp, ospf, static). target: Device name from config.

[READ] Detailed BGP neighbors per VRF: state, router id, AS, prefix stats.

Args: target: Device name from config; omit to use the default device.

[READ] Detailed LLDP neighbors: chassis id, system name/description, capabilities.

Args: target: Device name from config.

[READ] List NetBox devices (name, role, site, status, primary IP).

Requires a configured NetBox block. Use this to confirm intended state before pushing config to a device.

Returns {"devices": [...], "returned": N, "limit": L, "truncated": bool}. When truncated is true the estate is larger than what you were shown — re-run with a higher limit before concluding anything about coverage.

Args: name: Optional name filter (contains match). limit: Maximum devices to return (default 50).

[READ] Return a single NetBox device by exact name.

Args: name: Exact NetBox device name (see netbox_list_devices).

[READ] List a NetBox device's interfaces (name, type, enabled, description).

The intended interface inventory from source-of-truth — compare against live device state (get_interfaces) to spot drift.

Returns {"interfaces": [...], "returned": N, "limit": L, "truncated": bool}. Do NOT report drift from a truncated list — re-run with a higher limit.

Args: device: Exact NetBox device name (see netbox_list_devices). limit: Maximum interfaces to return (default 100).

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so its real risk tier is recorded in that tool's audit row. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.