network-lab
Summary: Network Lab MCP is a local stdio MCP server that gives an AI client structured lab context plus controlled, human-observable terminal access to real network lab devices — without ever exposing device credentials to the AI.
get_active_topology— Return the active topology: which devices and links exist and where work is performed; settings and topology YAML are reloaded from disk on every call.get_execution_instructions— Return operating principles, the active scenario (what to accomplish), and active reference knowledge (reusable engineering guidance); also reloaded per call.terminal_open— Open or reuse a tmux-backed SSH/Telnet session for a device by logical name; the server resolves private access-info internally and auto-answers the device's own login prompt with its stored credentials.terminal_send— Send input to an open session with fixed, deterministic ordering: literaltextfirst, thenkeys(e.g.C-c,Tab,Up), then Enter ifenter=true.terminal_read— Capture recent terminal output (default 100 lines) to inspect prompts, command output, password/interactive prompts, paging, or errors.terminal_list— List every managed production session, including stale sessions no longer in the active topology; local validation sessions are excluded.terminal_close— Close a device's production session, including stale ones, without requiring the device to still be in the active topology.Guardrails — Exactly seven auditable tools; credentials never cross the MCP boundary or appear in results/errors/logs;
terminal_send/terminal_readrefuse sessions whose device has left the active topology; a host-key or otherwise unresolvable prompt is left for the AI to handle interactively.
Drives real network lab devices through managed tmux-backed ssh/telnet terminal sessions, using an IOS XR-compatible convention set: an IOS XR-style candidate/commit CLI for defining topologies, private access-info, scenarios, and references, plus seven tools that let an agent read a device's topology, fetch its operating instructions, and open/send/read/list/close terminal sessions against IOS XR / classic-IOS style devices (including auto-answering the device's own Username:/Password: login sequence with private credentials that are never exposed).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@network-labInvestigate why BGP session to 10.0.0.1 is flapping and show evidence."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Network Lab MCP
An AI Network Engineer Workspace for real network labs.
Network Lab MCP gives an MCP-capable AI client a safe, observable way to investigate real network lab devices while keeping the engineer in control.
The AI client performs the reasoning: it decides what to inspect, which MCP tool to call, how to interpret the evidence, and what to do next. Network Lab MCP provides the structured engineering context and controlled terminal access that make that investigation possible, without exposing device credentials to the AI.
Human provides intent. AI investigates and proposes. Human reviews and commits.
The architecture is vendor-neutral. The included public sample and platform guidance are Cisco-oriented, with registered device types for Cisco IOS XR, IOS XE, classic IOS, and NX-OS.
Jump to: Demo · Use cases · Quick Start · Architecture · MCP tools · CLI reference
Demo
Traffic Loss Validation with Network Lab MCP
This short demo shows an AI-assisted validation workflow: live terminal monitoring, scenario execution, traffic measurement, result analysis, and final report generation.
Related MCP server: MCP-Telecom
Why I built it
As a network engineer, I often want to validate something in a lab but do not have enough time to perform every investigation manually. Customer work, troubleshooting, meetings, documentation, and other responsibilities usually come first.
That led to a simple question:
What if I could ask AI to carry out the time-consuming parts of network lab investigation for me?
Not just run a command, but understand the topology, connect to the right devices, inspect the current state, compare evidence, investigate problems, and report back.
At the same time, I do not want the AI to become a black box. I still want to see what it is doing and make the final engineering decisions.
Network Lab MCP is the result.
What Network Lab MCP does
Network Lab MCP is not a fixed test-automation framework and it is not a network-engineering reasoning engine.
The AI client performs the reasoning. Network Lab MCP provides two complementary capabilities:
Structured engineering context — Principles, Topology, Scenario, and References give the AI the rules, environment, task intent, and reusable engineering knowledge needed for the current investigation.
Controlled execution — managed terminal sessions provide real, general-purpose SSH/Telnet access to lab devices without exposing private connection information to the AI.
The AI decides what command to run next, how to interpret the output, and when the investigation is complete.
The repository also includes an independent IOS XR-style human CLI (./run_cli.sh) for selecting the active lab context, editing lab definitions, discovering topology, using candidate/commit configuration semantics, and monitoring AI terminal activity live.
Use cases
Network Lab MCP is designed for AI-assisted engineering tasks where the investigation path cannot be reduced to one fixed script.
Typical use cases include:
Topology discovery and validation — discover LLDP/CDP relationships and review the candidate topology before committing it.
Troubleshooting and evidence collection — inspect multiple devices, compare state, follow symptoms, and gather supporting command output.
Failure and resiliency validation — observe network behavior before, during, and after a planned lab fault.
Traffic and service validation — combine device state with external test/measurement results and produce an engineering conclusion.
Repeated lab investigation — reuse Scenarios and References instead of rediscovering the same engineering knowledge for every task.
Human-observable AI operations — watch the exact terminal activity used by the AI while the investigation is in progress.
The included sample configuration is Cisco-oriented. Topology discovery currently supports Cisco IOS XR, IOS XE, and classic IOS as described in Supported device types.
What makes it different
AI is the reasoning layer. Network Lab MCP does not try to replace the AI client with a fixed reasoning engine.
Exactly seven controlled MCP tools. The interface stays deliberately small and auditable.
Credentials never cross the MCP boundary. The AI works with logical device names; private access information is resolved internally.
Real terminals remain observable. Engineers can monitor the same managed terminal sessions used by the AI.
Engineering context is explicit. Principles, Topology, Scenario, and References separate rules, environment, task intent, and reusable knowledge.
Human authority is preserved. Definition and selection changes use candidate/commit semantics; the AI proposes, while the engineer reviews and commits.
How Network Lab MCP organizes engineering context
You do not need to author YAML first. Start with your intent:
Tell me what you want to build, investigate, or validate.
Network Lab MCP organizes work with four running-config concepts:
Concept | Meaning |
| how to connect |
| what network/environment exists |
| what the AI should accomplish |
| reusable engineering knowledge |
Scenario answers "what should be accomplished for the current task?" Reference answers "what reusable engineering knowledge can help accomplish it?" A Reference can support multiple investigations, validations, operations, or Scenarios. It is not a one-time task description, a replacement for the always-applied principles or for onboarding, and it is not active unless selected.
For example, the Scenario "validate EVPN traffic forwarding while a link is disconnected" could be supported by References holding EVPN engineering knowledge, Cisco platform applicability guidance, and operating knowledge for the test/measurement equipment in use.
Examples of reusable engineering knowledge:
SR-MPLS design and validation knowledge
EVPN behavior and troubleshooting knowledge
time synchronization and timing-network knowledge, such as PTP and SyncE
industrial or utility network engineering knowledge
operating procedures for test and measurement equipment
These are illustrations of suitable content, not bundled files or implemented features.
Scenario and reference knowledge evolves by reuse → refine → create: the AI discovers stored scenarios and references (a catalog is returned with the execution instructions, and relevant non-active ones can be inspected read-only), reuses existing knowledge, and when it is incomplete or missing proposes a refined or new Scenario/Reference. Definition changes are reviewed and committed through the CLI; the AI never writes them directly.
A fresh installation (cp lab/settings.example.yaml lab/settings.yaml) starts with:
access-info:
sample_lab— how the system connects to the fictional public sample labtopology:
sample_lab— what network/environment that sample lab containsscenario:
getting_started— what the AI should accomplish; the default onboarding Scenarioreference:
cisco_platform_guidance— reusable engineering knowledge; the default supporting Reference
The architecture is vendor-neutral; the included sample configuration is Cisco-oriented and ships with a Cisco supporting Reference. This is not a vendor requirement: other environments can select other References.
These are fresh-install defaults only. Existing lab/settings.yaml files are
never rewritten or migrated: your current selections and descriptions stay as
they are. See docs/scenario_format.md for the
Scenario / Reference boundary.
Core design
The configuration model deliberately separates five kinds of information:
Concept | Purpose | Exposed to the AI? |
| Selects which topology, access-info, scenario, and references are active | Indirectly |
| Private connection information: address, transport, port, username, password | Never |
| Logical devices and connectivity | Yes |
| What should be accomplished for the current task | Yes |
| Reusable engineering knowledge and operational guidance | Yes |
In short:
access-info = HOW TO ACCESS DEVICES = private
topology = WHAT EXISTS / CONNECTIVITY
scenario = WHAT TO DO
reference = REUSABLE KNOWLEDGE
running-config = WHICH DEFINITIONS ARE ACTIVErunning-config is a selection, not a definition. Editing a topology, scenario, or reference does not make it active. The active selection changes only after an explicit commit.
See docs/architecture.md for the complete model.
Key design principles
Exactly seven MCP tools.
get_active_topology,get_execution_instructions,terminal_open,terminal_send,terminal_read,terminal_list, andterminal_close.Real, human-observable terminals. Sessions run in a dedicated tmux environment.
Credentials never cross the MCP boundary. The AI opens a terminal by logical device name; private access information is resolved internally.
Candidate / commit configuration. Human CLI changes remain candidate state until an explicit
commit.Discovery is candidate-first.
discover topologynever auto-commits and never auto-selects the discovered topology.Fail closed instead of guessing. Missing access information, ambiguous resolution, type mismatches, and invalid state produce explicit errors.
Human judgment stays authoritative. AI can investigate and report, but the engineer remains responsible for the final technical decision.
Quick Start
Prerequisites
Linux
Python 3.10 or newer
tmuxOpenSSH client
telnetclient only if Telnet devices are usedan MCP-capable client such as Claude Code or Codex CLI
macOS is likely compatible because the project relies on Python, tmux, OpenSSH, and a POSIX shell, but formal macOS validation has not yet been completed. Native Windows is not supported; WSL2 may work but is not formally validated.
Install
git clone https://github.com/eiuemura/network-lab-mcp.git
cd network-lab-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .Network Lab MCP currently supports a local editable checkout. A normal wheel or package-index installation is not supported because the repository-local lab/ directory is part of the operational model.
Create your local running-config
cp lab/settings.example.yaml lab/settings.yamlRegister Network Lab MCP with an AI client
Network Lab MCP is a local stdio MCP server. Register the executable from this repository's virtual environment with the AI client you use.
Replace /path/to/network-lab-mcp in the examples below with the absolute path to your local checkout.
Using the absolute path to .venv/bin/network-lab-mcp ensures that the AI client uses the intended Network Lab MCP installation regardless of the directory from which the client is started.
Claude Code
Register Network Lab MCP at user scope:
claude mcp add network-lab -s user -- \
/path/to/network-lab-mcp/.venv/bin/network-lab-mcpVerify the registration:
claude mcp listYou should see Network Lab MCP reported as connected:
network-lab: /path/to/network-lab-mcp/.venv/bin/network-lab-mcp - ✔ ConnectedCodex CLI
Register the local stdio MCP server:
codex mcp add network-lab -- \
/path/to/network-lab-mcp/.venv/bin/network-lab-mcpVerify the registration:
codex mcp listYou should see an enabled network-lab MCP server:
Name Command Args Env Cwd Status Auth
network-lab /path/to/network-lab-mcp/.venv/bin/network-lab-mcp - - - enabled UnsupportedAuth: Unsupported is expected for this local stdio MCP server. It refers to MCP-level authentication between Codex and the MCP server; device authentication is handled internally by Network Lab MCP through the private access-info configuration.
Codex approval setting
In the tested Codex CLI setup, registering the server alone was not sufficient for the terminal workflow to proceed to lab-device access.
Edit:
vi ~/.codex/config.tomland configure the Network Lab MCP server as follows:
[mcp_servers.network-lab]
command = "/path/to/network-lab-mcp/.venv/bin/network-lab-mcp"
default_tools_approval_mode = "approve"Then restart Codex and verify the MCP registration again:
codex mcp listThe default_tools_approval_mode = "approve" setting above reflects the configuration verified with Network Lab MCP in the tested Codex CLI environment.
Start the human CLI
./run_cli.shUseful commands:
help
help claude
show version
show running-config
configureStart an AI client from any task workspace
The task workspace does not need to be inside the Network Lab MCP repository.
Claude Code
cd ~/work/my-lab-task
claudeAdvanced / isolated-lab-only:
claude --permission-mode bypassPermissionsskips Claude Code's own approval prompts. Use it only in an isolated lab environment you fully control.
Codex CLI
cd ~/work/my-lab-task
codexAdvanced / isolated-lab-only: The following commands disable Codex approval prompts. Use them only in an isolated lab or task environment that you fully control.
codex --sandbox workspace-write --ask-for-approval neverOr, to keep the normal terminal screen and scrollback available:
codex --sandbox workspace-write --ask-for-approval never --no-alt-screen
--sandbox workspace-write lets Codex work inside the task workspace while keeping the session sandboxed.
--ask-for-approval never disables Codex approval prompts.
--no-alt-screen is optional and keeps the normal terminal screen and scrollback available.
Example workflow
The tracked sample files use documentation-only addresses and cannot connect to real devices.
Create your own private access-info definition:
cp lab/access-info/sample_lab.yaml lab/access-info/my_lab.yamlA typical topology-discovery flow looks like this:
network-lab# configure
network-lab(config)# discover topology
Discovering topology from access-info 'my_lab'...
Discovery complete.
Access-info: my_lab
IOS XR targets: 2
IOS XE targets: 0
IOS targets: 0
Connected: 2
LLDP observations: 4
CDP observations: 0
Managed links: 2
Unresolved neighbors: 0
Topology candidate: my_lab
network-lab(config-topology-my_lab)# show configuration
...
network-lab(config-topology-my_lab)# commit
Commit complete.
network-lab(config-topology-my_lab)# root
network-lab(config)# running-config
network-lab(config-running)# topology my_lab
network-lab(config-running)# commit
Commit complete.Discovery commits only the topology definition. Selecting that topology as active remains a separate explicit running-config operation.
Once the active topology and instructions are selected, a typical AI workflow is:
get_active_topology()
get_execution_instructions()
terminal_open(...)
terminal_send(...)
terminal_read(...)
...Human-observable terminals
An engineer can watch the exact terminal activity used by the AI:
network-lab# terminal monitor R1
RP/0/RP0/CPU0:R1#show version
...
RP/0/RP0/CPU0:R1#
--------------------------------------------------------------------------------
Monitoring terminal R1 | Read-only | Source: managed | Status: active | q: quit
--------------------------------------------------------------------------------terminal monitor <device-id> is EXEC-only, strictly read-only, independent from the AI session, and able to follow normal managed sessions and Discovery sessions.
Terminal activity is also persisted under:
logs/terminal/<device-id>/*.logPlatform-aware knowledge
Network Lab MCP can use reusable References to decide whether technical knowledge applies to the target device. Protocol concepts may be reusable across platforms, but configuration syntax, operational behavior, feature support, limitations, YANG models, telemetry paths, and release-specific behavior must be verified for the applicable platform.
The included cisco_platform_guidance Reference is one concrete example. It
provides reusable guidance for determining whether Cisco-specific knowledge
applies to the target platform, software release, feature, and question type,
for the Cisco device types registered in the device.type enum (iosxr,
iosxe, ios, nxos). It is the default supporting Reference of the
included Cisco-oriented sample configuration, selected by the sample settings
only; it is not universal, system-wide, or mandatory. The AI can also discover
and inspect it like any stored Reference. It is guidance only: nothing is
searched, fetched, or detected automatically.
User intent
↓
Target device
↓
Platform / operating system
↓
Software release when relevant
↓
Feature domain
↓
Question type
↓
Applicable knowledge / source
↓
Lab validation when appropriateFor YANG and model-driven telemetry, the guidance points to the YangModels Cisco YANG repository (the repository Cisco documentation refers users to), says telemetry paths should be derived from the applicable model hierarchy rather than guessed, and notes that platform and release matter and that the models a device actually supports should be verified when practical.
Security model
See SECURITY.md for the full trust model, risks, and vulnerability-reporting guidance.
Credentials stay private from the AI
Real access-info definitions may contain management addresses, transport/port, usernames, passwords, and optional jump-host information.
No MCP tool returns access-info.
terminal_open(device) receives only a logical device name. Network Lab MCP resolves the selected private access-info internally and performs the connection.
Passwords are not intentionally returned in MCP tool results, terminal-send responses, or generated errors, and are not placed on subprocess command lines.
This is a credential boundary, not output sanitization. Terminal logs are raw transcripts: Network Lab MCP does not redact device output, and anything the remote side prints or echoes can appear in them. Treat terminal output and logs as potentially sensitive; Network Lab MCP does not guarantee they are free of secrets. See SECURITY.md for details.
Important local CLI behavior
When a human explicitly displays access-info configuration locally with commands such as show running-config or show configuration, passwords are shown in clear text. Treat that terminal output as sensitive.
SSH and Telnet authentication
Managed sessions support SSH key/agent authentication, SSH password authentication, and classic IOS-style Telnet username/password authentication.
Telnet remains unencrypted and should be used only in an isolated lab.
SSH jump host support
A device may reference a single OpenSSH ProxyJump host from the same access-info definition. Multi-hop jump-host chains are not supported.
Supported device types
Type | Meaning | Topology Discovery |
| Cisco IOS XR | LLDP + CDP |
| Cisco IOS XE | LLDP + CDP |
| Classic Cisco IOS | CDP |
| Cisco NX-OS | Not currently supported |
| Generic host / endpoint | Skipped |
Discovery is read-only. It does not enable LLDP/CDP, change device configuration, auto-commit, or auto-select the result.
External YAML editing
Topology, scenario, and reference definitions can be edited through an external editor selected in this order:
$VISUAL$EDITORVim fallback
When a confirmed Vim executable is used, Network Lab MCP enables Vim paste mode automatically for the editing session.
Access-info remains structured-CLI editing only.
Real-lab tests
Real-lab tests are deliberately opt-in:
NETWORK_LAB_REAL_TESTS=1 pytest tests/test_real_lab_iosxr.py -v --tb=lineAvoid --showlocals when running tests against real credentials.
Repository layout
network-lab-mcp/
├── pyproject.toml
├── README.md
├── LICENSE
├── run_cli.sh
├── src/
│ └── network_lab_mcp/
│ ├── __init__.py
│ ├── mcp_server.py
│ ├── lab.py
│ ├── terminal.py
│ ├── discovery.py
│ └── cli/
│ ├── main.py
│ ├── config.py
│ ├── grammar.py
│ └── editor.py
├── lab/
│ ├── settings.example.yaml
│ ├── principles.yaml
│ ├── access-info/
│ ├── topologies/
│ ├── scenarios/
│ └── references/
└── docs/
├── images/
│ └── network-lab-mcp-concept.png
├── architecture.md
├── mcp_tools.md
├── cli_reference.md
└── scenario_format.mdPublic-repository safety
Real lab files can contain sensitive information.
The repository's .gitignore deliberately excludes local operational files by default while preserving tracked fictional sample definitions.
This reduces the risk of accidentally committing real lab data, but it is not a complete security boundary. Always review changes before pushing to a public repository.
Current limitations
Topology discovery supports IOS XR, IOS XE, and classic IOS, but not NX-OS discovery.
No SNMP, NETCONF, RESTCONF, or generic discovery plugin framework.
No automatic stale-link pruning after Discovery.
L3 enrichment records only directly observed IPv4 address + VRF.
Non-editable / wheel installation is not supported.
Access-info does not currently support external-editor editing.
SSH ProxyJump is single-hop only.
Scenario/reference schema remains intentionally flexible.
Some identifier classes do not yet have case-only collision protection.
Documentation
Issues and suggestions
Issues, bug reports, and improvement suggestions are welcome through GitHub Issues.
Version and license
Run show version in the human CLI to display the running version, release date, Git revision, branch, platform, MCP SDK version, and license.
Network Lab MCP is licensed under the GNU General Public License v3.0. See LICENSE.
Available Tools
7 toolsget_active_topologyA
Return the currently active lab topology: where the work is performed and which devices and links exist. Settings and the topology YAML are reloaded from disk on every call, so editing lab/settings.yaml takes effect immediately without restarting this server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds valuable context by noting that settings and YAML are reloaded from disk on every call, so edits take effect immediately. This reveals the tool's fresh-read behavior and implies it is non-mutating, though it does not explicitly state side-effect safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The main purpose is front-loaded in the first sentence, and the second sentence adds a single, relevant behavioral note about reloading. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with no parameters and no output schema, the description covers the key points: what it returns and a notable behavioral characteristic. It does not specify the exact return format (e.g., JSON structure), but the mention of 'topology YAML' gives a hint. Overall, it is sufficiently complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain parameter semantics since none exist, and it correctly omits any param-related details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb 'Return' and the resource 'currently active lab topology', and explains what it contains (where work is performed, devices, links). It distinguishes itself from sibling tools like terminal operations by being the only topology-fetching tool, so an agent can easily identify its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when you need the active topology) but does not explicitly contrast with alternatives or state exclusions. Siblings are unrelated to topology, so the lack of explicit routing is less critical, but the guidance remains implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_execution_instructionsA
Return the operating principles, the active scenario, and the active reference knowledge for the current task: how to behave, what to accomplish, and what reusable knowledge is available. Reloaded from disk on every call.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it adds a meaningful behavioral detail: 'Reloaded from disk on every call,' indicating fresh data each invocation. The use of 'Return' also implies a read-only operation, though side effects, authorization, and error behavior are not explicitly disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff: it front-loads the returned content and adds the reload behavior in a single closing clause. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description is mostly complete: it names all three content areas and explains their purpose. It does not specify the exact structure of the returned data, but for this simple introspection tool that is a minor gap rather than a blocker.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description focuses on what the call returns rather than parameters, which is appropriate for a parameterless retrieval tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and names three concrete resources: operating principles, active scenario, and active reference knowledge. This makes the tool's purpose immediately clear and distinguishes it from terminal-focused siblings and get_active_topology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for the current task' conveys when to use this tool: when the agent needs behavioral guidance, task context, or reusable knowledge. It does not explicitly discuss alternatives or exclusions, but the sibling tools have clearly different functions, so usage context is reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_closeA
Close a device's managed production terminal session. Only ever targets the production session namespace; cannot affect validation sessions. Deliberately does not require the device to still be present in the active topology, so a stale session left over from before the active topology changed can always be closed.
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It reveals non-obvious behavior: it only targets the production session namespaceĺ and deliberately works even when the device is absent from the active topology. It does not mention result/error behavior, but the key operational limits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the action is stated first, followed by a critical exclusion and a useful stale-session edge case. Slightly wordy in the third sentence, but every sentence contributes meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema incl, the description covers target, scope, and an important edge case. It does not explain success/error responses or whether an open session must exist, but an agent can generally invoke the tool correctly with the provided information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, device, is minimally described by the schema. The description clarifies that the device owns the session being closed, but it does not specify the identifier format or where to source it. With 0% schema coverage, this is only partial compensation, though reasonable for a single string parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Close a device's managed production terminal session.' It also immediately distinguishes itself from related terminal tools by scoping to the production session namespace and explicitly stating it cannot affect validation sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: closing production terminal sessions, including stale sessions from before a topology change. It also states what it cannot do (affect validation sessions), which helps an agent avoid misusing it, though it does not explicitly name a sibling alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_listA
List every currently managed production terminal session, regardless of whether each device is still present in the active topology -- including a stale session left over from before the active topology changed, so it remains visible and closeable via terminal_close() even though terminal_send()/terminal_read() will refuse to use it. Local validation sessions are never included, regardless of whether a device happens to be named similarly to a validation identifier.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses important edge-case behavior: stale sessions remain visible and closeable, terminal_send()/terminal_read() will refuse them, and validation sessions are always excluded. This is substantial behavior disclosure, though it does not mention output format or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and then expands on meaningful edge cases. It is somewhat dense and long-winded, but each clause adds essential selection and invocation context, so the length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with no output schema, the description is nearly complete: it defines what is included, what is excluded, and how results relate to sibling operations. It could be more complete by stating the return shape, but the core semantics are fully covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty input schema, so there is no parameter semantics to clarify. The description correctly focuses on behavior rather than parameters, and the baseline of 4 applies because no argument documentation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List every currently managed production terminal session.' It clearly differentiates itself from get_active_topology by noting it includes sessions regardless of active topology, and from terminal_send/read/close by specifying stale sessions are closeable but not usable for I/O.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong contextual cues: use it to see stale sessions and close them via terminal_close(), and it confirms local validation sessions are excluded. However, it never explicitly states when to choose this over get_active_topology or when not to use it, so the guidance remains implied rather than direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_openA
Open (or reuse) a terminal session for a device in the active topology, launching ssh or telnet inside a dedicated tmux environment. The active topology is reloaded from disk before opening the session. An interactive login prompt from the device itself is answered automatically using the active access-info definition's own private credentials, once it can be safely confirmed to belong to the target device (never a jump host) -- credentials are never returned by this tool or any other. This works for SSH (the client's own password prompt) and for Telnet (a classic-IOS-style Username:/Password: sequence); which one applies depends on the device's own configured transport. A host-key confirmation prompt, or any other situation this cannot safely resolve on its own, is still left for terminal_read()/terminal_send() to handle interactively.
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It reveals that credentials are never returned, that topology is reloaded, that login prompts are auto-answered with private credentials, that it avoids jump hosts, and that it handles both SSH and Telnet. This is exceptionally transparent, leaving no critical ambiguity about what the tool does.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but each sentence adds essential detail about security, transport handling, and fallback behavior. The core purpose is front-loaded, and the complexity justifies the length. It avoids redundancy, though it could be slightly tightened without losing substance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the opening behavior, authentication, and fallback handling, but does not mention what the tool returns (e.g., a session identifier or status) and does not explain error conditions or what happens if the device is not found. With no output schema, this information is missing, leaving the agent uncertain about the tool's result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'device' has no schema description (0% coverage), and the description only says 'for a device in the active topology' without specifying how the device is identified (e.g., by name, ID, or IP). It does not add format or value guidance beyond what the schema already provides. Given the low schema coverage, the description should compensate but does not sufficiently clarify the parameter's semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: open or reuse a terminal session for a device in the active topology, launching ssh or telnet in tmux. It distinguishes itself from sibling tools like terminal_send and terminal_read by focusing on session opening rather than interactive I/O. The verb and resource are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on when to use this tool (to establish a session) and explicitly routes interactive prompts that the tool cannot safely resolve (host-key confirmations) to terminal_read()/terminal_send(). However, it does not explicitly state when not to use this tool, such as for simply sending a command without opening a session, though this is implied by sibling tool names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_readA
Capture recent terminal output for a device, so the caller can inspect
the current prompt, command output, a password/interactive prompt, paging
state, or unexpected errors. lines limits how much recent scrollback is
returned (default 100); the underlying tmux session retains a much larger
history buffer. The device must still be present in the active topology,
reloaded from disk on every call -- an already-open session does not
stay readable if the active topology changes to no longer include this
device.
| Name | Required | Description | Default |
|---|---|---|---|
| lines | No | ||
| device | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It explicitly states that the device must be present in the active topology, that sessions are reloaded from disk on every call, and that an open session becomes unreadable if the topology changes. This is significant behavioral context that helps the agent avoid stale-state mistakes. However, it does not mention what happens if the device is not present (error type), nor whether this operation has side effects (it appears read-only, but not explicitly stated). Thus a 4, not 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise but packs significant information. It opens with a clear purpose statement, then details the 'lines' parameter, and ends with a critical caveat about topology. The sentences are purposeful and front-load the most important info. The caveat is placed at the end, which is acceptable. No filler. A 4 because it is slightly long and could be more concise, but each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a read operation on a terminal session with a topology dependency), the description covers the key usage and behavioral aspects. It doesn't have an output schema, so it doesn't explain the return format, but that might be inferable. The description is complete enough for an agent to call it correctly: it knows the tool reads output, the 'lines' limit, and the topology dependency. The only missing piece is what happens when the device is absent, which could be inferred as an error. Thus a 4.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage (no parameter descriptions in the schema), so the description must compensate. It explains the 'lines' parameter: 'limits how much recent scrollback is returned (default 100)'. It does not explain 'device' beyond the tool's purpose, but the purpose makes it clear that 'device' identifies which device's output to capture. This adds some meaning beyond the schema's raw type and default, but not exhaustive – e.g., no information about acceptable formats for device IDs. Thus a 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: capturing recent terminal output for a device, and explicitly enumerates the kinds of output it can capture (prompt, command output, interactive prompts, paging, errors). This distinguishes it from sibling tools like terminal_send (which sends input) and terminal_open (which opens a session). The verb 'Capture' is specific and the resource is 'terminal output'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use the tool: to inspect terminal output for a device during interactive sessions or after commands. It also gives a crucial exclusion: the device must be in the active topology, and the session does not remain readable if topology changes. This helps the agent choose this tool over alternatives like terminal_list (which lists sessions) and terminal_open (which creates a session).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_sendA
Send input to a device's open terminal session. The device must still be present in the active topology, reloaded from disk on every call -- an already-open session does not stay usable if the active topology changes to no longer include this device.
Execution order is fixed and deterministic: if text is given it is sent
literally first, then any keys (e.g. "C-c", "Tab", "Up") are sent in the
supplied order, then Enter is sent last if enter is true. Nothing is
deduplicated: passing keys=["Enter"] together with enter=true sends Enter
twice. text is delivered to the pane without ever passing through a
subprocess's own argv or appearing in an error message, and this MCP
server does not separately log or echo it back in any tool result. It
is not hidden from the device's own terminal transcript, though: this
project intentionally records the raw pane output via tmux pipe-pane
(see show logging), and if the remote endpoint echoes back what it
received, that echo may naturally appear in that transcript like any
other terminal output.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | No | ||
| text | No | ||
| enter | No | ||
| device | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and excels at it. It discloses fixed execution order, no deduplication, that text bypasses argv and error messages, that the server does not log or echo input, and that tmux pipe-pane still records raw pane output. This is unusually transparent for a side-effecting tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but dense, with no filler. It front-loads the primary purpose and then adds necessary behavioral, ordering, and logging caveats. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers prerequisites, ordering, logging, and privacy nuances almost completely. The only notable gap is return-value semantics: there is no output schema, and the description references 'tool result' only in passing without explaining what the agent receives on success.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates fully by explaining the semantics of device, text, keys, and enter, including ordering and the duplicate-Enter edge case. It adds meaning well beyond the bare parameter names in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Send input to a device's open terminal session') and clearly differentiates the tool from siblings such as terminal_read, terminal_list, and terminal_open by focusing on sending input. It also narrows the scope to open sessions within the active topology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides strong operational context: the device must still be present in the active topology and the session is reloaded from disk on every call. However, it does not explicitly name sibling alternatives or state when not to use this tool, so the guidance is clear but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
get_active_topology - First observed
get_execution_instructions - First observed
terminal_close - First observed
terminal_list - First observed
terminal_open - First observed
terminal_read - First observed
terminal_send
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: two retrieve context (topology, instructions) and five handle terminal session lifecycle (open, send, read, list, close). There is no overlap or ambiguity between any of them.
Tool names follow a consistent snake_case convention with a clear pattern: `get_*` for information retrieval and `terminal_*` for terminal operations. This makes the naming predictable and easy to navigate.
With 7 tools, the server is well-scoped for its purpose: two context-gathering tools and five terminal management tools cover the necessary actions without unnecessary bloat or gaps.
The terminal session lifecycle is fully covered: open, send, read, list, and close. The topology and instructions tools provide sufficient context for the agent to operate. No obvious missing operations exist for the stated domain.
Maintenance
Related MCP Connectors
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Real Linux labs your AI agent deploys, routes and runs, with domains, TLS, DBs and an audit log.
Connect AI assistants to explicitly paired computers, servers, and VMs for permitted remote actions.
Explainable graph-retrieval memory engine with an RL-trained management policy.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides AI assistants with direct access to multi-vendor network devices for tasks like configuration management, health checks, and topology discovery through 35 specialized tools. It enables natural language control over platforms including Cisco, Juniper, and Nokia using SSH, NETCONF, and SNMP protocols.12MIT
- AlicenseAqualityCmaintenanceBridges AI agents with network infrastructure, enabling secure read-only access to multiple vendor routers via SSH for natural language queries and troubleshooting.581MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to execute SSH commands on network devices using natural language, supporting multiple vendors and authentication methods for automated network management.-
- FlicenseNot gradedqualityCmaintenanceEnables AI assistants to manage network devices via gNMI protocol, including querying capabilities, reading/modifying configurations, and subscribing to telemetry data through natural language.-