Provides read-only MCP tools for inspecting and diagnosing Cisco IOS, IOS-XE, and NX-OS network devices, including interfaces, VLANs, routes, neighbors, BGP, OSPF, VPN state, configuration, topology, and MAC-address observations.
Provides read-only MCP tools for inspecting and diagnosing Fortinet FortiOS network devices, including device state, interfaces, routes, VPN state, and configuration.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@NERD MCP check BGP neighbor state on edge-router-01 and flag anything down"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
NERD (Network Engineering Reconnaissance & Discovery) is designed by network engineers for network engineers. It provides a natural-language and command-line interface for querying network inventory, inspecting devices, diagnosing network conditions, and deploying controlled configuration changes.
NERD connects to network devices over SSH and exposes read-only Model Context Protocol (MCP) tools. Its MCP server can be used by your preferred LLM client when that client supports local stdio MCP servers. The included terminal chat currently uses the OpenAI Responses API. Configuration deployment remains a local CLI capability with explicit write enablement, review, approval, verification, and separate save controls.
Import and search CSV or XLSX inventories stored in local SQLite.
Inspect interfaces, VLANs, routes, neighbors, BGP, OSPF, VPN state, and configuration.
Discover topology and MAC-address observations.
Capture one baseline per device and compare current configuration.
Use terminal chat through the OpenAI Responses API.
Plan typed configuration changes with preview, approval, verification, rollback, and separate save approval.
Platform | Inspection | Diagnosis | Configuration writes |
Cisco IOS / IOS-XE | Yes | Yes | Experimental, CLI opt-in |
Cisco NX-OS | Yes | Yes | Read-only until validation |
Aruba AOS-CX | Yes | Yes | Read-only until validation |
Aruba AOS-Switch | Yes | Yes | Read-only until validation |
Fortinet FortiOS | Yes | Yes | Read-only |
MCP is always read-only. Writes exist only in the local CLI, are disabled by default, and require --enable-writes plus exact approval phrases.
Related MCP server: Network Incident MCP
git clone https://github.com/MickalSpeller/nerd-mcp.git
cd nerd-mcp
py -3.11 -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e ".[full]"
python -m nerd_mcp devices import .\devices.example.csv
python -m nerd_mcp devices list
python -m nerd_mcp inspect edge-router-01 get_device_info --mock
python -m nerd_mcp --versionLinux and macOS users activate with source .venv/bin/activate. Mock inspection needs no device, credentials, or OpenAI account.
name,host,port,credential_profile
edge-router-01,192.0.2.10,22,defaultAll examples are synthetic and use reserved documentation networks.
Credentials come from Windows Credential Manager or environment variables and never belong in inventory or SQLite. SSH host keys must be verified and enrolled. Terminal chat transmits relevant device output to the configured OpenAI API; use direct CLI or MCP inspection when output must remain local.
Start with INSTALL.md. See command examples, inventory, CLI, MCP, controlled changes, architecture, and troubleshooting. Contributions and security reports are covered by CONTRIBUTING.md and SECURITY.md.
Licensed under Apache-2.0.
This server cannot be deployed
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Read-only MCP tools for AI agent discovery, structured resources, and NIULAI information.
Read-only MCP server for Muovi, Argentina's trust-first local services marketplace (6 tools).
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
