Run a batch of policy-approved commands on one Prisma SD-WAN ION over SSH.

Approved: the display-only dump and inspect families, plus the exact active-diagnostic forms ping, tcpping, and dig -- see the prisma-cli://policy resource. The diagnostics send real packets from the device; everything else is denied fail-closed, with no deny list -- an unmatched command is refused by construction. One denied command rejects the whole batch before any connection is opened.

Call order is fixed and load-bearing: policy validation, then credential availability, then device address resolution, then a bounded TCP reachability probe, then the SSH session itself. A policy denial never reaches address resolution; a missing credential never triggers a resolution call.

Args: commands: One or more ION CLI commands. See the prisma-cli://policy resource for the exact approved forms. The whole batch is rejected if any single command fails the policy. element: Element name or controller ID to target, resolved to an SSH address via the same resolver every other tool uses. Required unless host is given. host: Explicit device address. Always wins: when it is given, no resolution happens and the address is used exactly as supplied. Use it whenever you already know the address, or for a management network the controller API cannot see. Supplying element alongside it is allowed -- the element is then only a label on the response, and nothing is resolved or cross-checked. site: Optional site name/ID to disambiguate element, as in every other semantic tool. Ignored when host is given.

Credentials, SSH port and known_hosts path come from the server's configuration only -- ION_USERNAME, ION_PASSWORD (or ION_PRIVATE_KEY), ION_SSH_PORT, ION_KNOWN_HOSTS. There is deliberately no per-call override: a tool argument is visible to the model and lands in the conversation transcript, which is normally logged. With nothing configured the call fails closed with configuration_error before any resolution, probe or connection. Host-key checking is always strict -- an unknown or mismatched key fails before credentials are sent, as host_key_unverified.

Each command's output is capped independently (the server's configured cap divided across the batch, floored), and every result declares whether it was truncated. A device rejection is that command's own status "error"; sibling commands keep their own status and output. Completion is decided by the device's prompt reappearing, never by elapsed time -- a slow ping is read to completion, not cut short.

Build and validate one site's Prisma SD-WAN config fragment.

Structures and validates a single site's device list against the prisma_sdwan.sites schema used by downstream automation (e.g. Ansible), then returns both the structured object and ready-to-save YAML text. This tool never writes to disk and never calls the Prisma SASE API — saving the returned data to a file, combining it with other sites, and applying it to the network is entirely up to the caller.

Args: site_id: Site identifier for the config (e.g. "BRANCH-101"). Free text — not resolved against the live tenant, so a typo will not be caught here. elements: Non-empty list of element objects, each requiring serial_number (string). Optional per-element keys: model_name, device_variables (object), policy_variables (object). Any other key is silently dropped, not an error.

Retrieve core Prisma SD-WAN inventory with compact operator-oriented output.

kind selects sites, ION elements, hardware machines, or application definitions. Summary mode projects the fields most useful for reasoning; full mode preserves the redacted controller record and should be used with a search/limit for large collections.

Args: kind: Inventory collection to retrieve: sites, elements (IONs), machines (hardware), or applications. Use find_site/find_element/find_resource instead if you already know a name and just need to resolve it to an ID. search: Case-insensitive substring filter across name, display_name, description, id, serial_number, and hw_id. Omit to return the whole collection (subject to limit). detail: summary (default) projects only the most relevant fields for reasoning. full returns the complete redacted controller record per item — use with search or a tight limit for large collections (e.g. applications can be thousands of rows). Note: kind="applications" with no search and detail="summary" ignores pagination and instead returns one aggregate summary (total_applications + counts per category), not a row list. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Return a combined health view for one ION element.

element and site accept names or IDs. The tool resolves IDs safely, fetches element operational state, optionally software state/status, and can fan out to interface status. Interface fan-out is intentionally bounded.

Args: element: Element name, serial number, hardware ID, or exact controller ID. If it resolves to exactly one record, site can be omitted — the element's own site is used. Ambiguous names (e.g. a short substring matching many elements) fail instead of guessing; pass an exact name/ID or add site to narrow it. site: Site name or controller ID that should own element. Optional when element already resolves uniquely on its own. include_software: When true (default), also fetch software state/status for the element. A failure here is reported inline under partial_errors rather than failing the whole call. include_interfaces: When true, also fan out to per-interface status (bounded by interface_limit). Off by default because it adds one API call per interface. interface_limit: Max interfaces to fetch status for when include_interfaces is true. Ignored otherwise. Must be between 1 and the server's fan-out ceiling (default 100).

Retrieve interface configuration and/or operational state for one element.

If interface is omitted and status is requested, the tool enumerates the element interfaces then fans out to each status endpoint up to the fan-out ceiling (default 100). Individual interface failures remain inline.

Args: element: Element name, serial number, hardware ID, or exact controller ID. If it resolves to exactly one record, site can be omitted — the element's own site is used. site: Site name or controller ID that should own element. Optional when element already resolves uniquely on its own. mode: config returns only interface configuration (no extra API calls). status returns only live operational state per interface. both (default) returns config plus status. interface: Optional filter to one interface by exact ID, exact name (case-insensitive), or name substring. Omit to return every interface on the element. An ambiguous substring returns every candidate rather than guessing. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max interfaces to return in this page. Omit to use the server default page size (50; max 200).

Return AnyNet topology with careful ID semantics preserved.

Summary mode returns counts and links that are not up. Full mode requires a site or status filter to avoid flooding the model. view='basenet' derives the underlay: it takes VPN leg IDs from AnyNet and resolves each through live vpnlink status, exposing element/interface-level underlay information. A link's path_id and controller anynet_link_id are kept distinct.

Args: detail: summary (default) returns link/node counts plus only the links that are not up. full returns every matching link and requires site or status to be set — a tenant-wide full dump is refused rather than flooding the response. node_count reflects the nodes array the controller's AnyNet payload actually returns, which can legitimately be 0 on tenants where the controller reports links only — a 0 node count alongside a non-zero link count is not an error, and link records still name their endpoints. site: Site name or controller ID to scope the topology to. Required for detail="full" (unless status is set) and for view="basenet". status: Filter links to one status value (e.g. "up"), case insensitive. Can substitute for site when detail="full". view: anynet (default) returns AnyNet-level links. basenet derives the underlay by resolving each AnyNet link's VPN legs through live status lookups — one API call per leg, capped at 100 legs per call (the server fan-out ceiling) and resumed via leg_offset. Requires site. leg_offset: For view="basenet" only: index into the full VPN-leg list to resume from — use the previous response's next_leg_offset. Must be >= 0. Ignored for view="anynet". cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max links to return in this page. Omit to use the server default page size (50; max 200).

Inspect WAN, VPN, VRF, LAN, and IPsec read-only state through one semantic tool.

Operations needing a site or element accept names or IDs. For VPN leg status/state, object_id is the vpnlink leg ID from topology, not the parent AnyNet path ID.

Args: operation: Which WAN-related collection to inspect: networks (tenant-wide WAN network definitions, no site needed), vrfs (tenant-wide VRF contexts, no site needed), ipsec_profiles (tenant-wide, no site needed), interfaces (WAN interfaces — requires site), paths (WAN paths — requires site), vpn_links (all VPN links, tenant-wide — this endpoint cannot be narrowed by site or element, see site), lan_networks (requires site), vpn_leg_status / vpn_leg_state (live status/state for one VPN leg — requires object_id, not site). site: Site name or controller ID. Required (directly or via element) for interfaces, paths, and lan_networks; ignored by vpn_links (a VPN link record has no site field, so the controller rejects a site filter there — the full tenant list is returned and you can match legs to sites via get_topology); unused otherwise. element: Element name or controller ID, as an alternative to site for the same operations — the element's own site is used if it resolves uniquely. Unused for networks, vrfs, ipsec_profiles, and the vpn_leg_* operations. object_id: Required for vpn_leg_status/vpn_leg_state — the VPN leg ID from a topology tool's basenet view, not the parent AnyNet path_id. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Resolve a human site name or exact ID without guessing.

Returns every matching candidate. If more than one site matches, the result is explicitly marked ambiguous so the caller can choose an exact site.

Args: name: Site name or controller ID. Exact ID match wins first, then exact name match (case-insensitive), then falls back to a substring match. Multiple hits are never auto-picked — check ambiguous in the result and call again with a more specific name or the exact id from sites. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max matches to return in this page. Omit to use the server default page size (50; max 200).

Resolve an ION/element name or exact ID without guessing.

The returned candidates include site_id when the controller provides it, allowing later tools to infer the correct site from an element.

Args: name: Element name, serial number, hardware ID, or exact controller ID. Exact ID match wins first, then exact name/serial/hw_id match (case-insensitive), then substring. Multiple hits are never auto-picked — check ambiguous and re-call with a more specific value or the exact id. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max matches to return in this page. Omit to use the server default page size (50; max 200).

Resolve common Prisma SD-WAN objects by human name or exact ID.

Use for machines, applications, security zones, WAN networks, path groups, service labels, VRFs, and the major policy-set families. It never silently selects one object when multiple records match.

Args: kind: Which object type to search. One of: machine, application, security_zone, wan_network, path_group, service_label, vrf, network_policy, priority_policy, nat_policy, security_policy, performance_policy, or policy to search all five policy-set families at once (each match is tagged with its policy_family). Use find_site/find_element instead for sites or ION elements — this tool does not cover those. name: Object name or exact controller ID. Exact ID match wins first, then exact name match (case-insensitive), then substring. Multiple hits are never auto-picked — check ambiguous and re-call with a more specific value or the exact id. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max matches to return in this page. Omit to use the server default page size (50; max 200).

Browse the v2 capability catalog when no semantic tool fits the request.

This is the discovery companion to read_capability. Normal operator workflows should prefer semantic tools. Call with no arguments to list every domain and its action count. Call again with domain set to one of the returned identifiers to list every action in that domain. Browsing a domain returns what you need to choose an action; ask for one action_id to get the full execution contract needed to run it. Nothing is ever truncated at either step.

Args: domain: A domain identifier returned by a prior no-argument call (e.g. "sites_devices", "security_policies"). Omit to list every domain instead of one domain's actions. method: Filter one domain's actions to only "GET" or only "POST". Ignored (and has no effect) when domain is omitted. action_id: An exact action identifier. Returns that one action's full contract — path_parameters, body_schema, output_fields, api_version — which is what read_capability needs. Use this after browsing a domain; domain and method are ignored when it is set. detail: Applies to a domain listing. "compact" (default) returns action_id, http_method, description, any required path parameters, and whether the action takes a body — enough to pick one. "full" returns every action's complete contract in one response, which for a large domain is several times bigger.

Execute one exact read-only registry capability as an expert escape hatch.

Prefer the semantic tools first. Use list_capabilities to discover an action_id. Parameters are validated against the registry and every response passes through central recursive secret redaction and response-size limits.

Curated actions that still need live verification are blocked here by default; set MCP_ALLOW_UNVERIFIED_COMPAT=true only after completing the validation checklist shipped with this project.

Args: action_id: Exact action identifier from list_capabilities, e.g. "sites_devices.sites". Not a free-text search term. path_parameters: One key per required/optional path parameter that action's list_capabilities entry lists under path_parameters (e.g. {"site_id": "..."}). Omit or use {} for actions with none. Unknown keys are rejected. body: JSON object matching that action's body_schema. Only meaningful for POST actions — passing any non-empty body to a GET action is rejected, as is any field the action's schema does not declare (the error names the valid fields). Two traps on the standard query body: retrieved_fields is refused — the controller answers it with the full record and a fabricated value in every unrequested field, so the reply looks right and is wrong; and a limit inside the body is not this tool's limit — it truncates at the controller and reports the truncated total with no cursor, stranding the rest. Page with the limit/cursor arguments below instead. cursor: Opaque pagination token copied from a previous response's next_cursor. Only applies when the result is a list. A cursor is bound to the tool that issued it — one from another tool is rejected rather than applied to an unrelated list. limit: Max items to return in this page when the result is a list. Omit to use the server default page size (50; max 200). This is the tool's own paging, applied after the response arrives — prefer it over a limit field in body. detail: "compact" (default) lets a large response drop fields that neither identify a record nor report its condition, so more records fit in one reply; whatever it held back is listed in omitted_fields. Pass "full" to get every field of every record instead, at the cost of fewer records per page. Small responses are unaffected either way.

Resolve an opaque path ID to a WAN interface, AnyNet link, or VPN leg.

By design, unresolved IDs are reported explicitly rather than guessed.

Args: site: Site name or controller ID that owns this path. Must resolve to exactly one site — an ambiguous or unknown name returns an error listing the candidates instead of guessing. path_id: The opaque path/interface/link ID to resolve, typically copied from a path_id, interface_id, or id field in the output of a routing/WAN tool such as get_wan or get_routing.

Inspect DNS, DHCP, NTP, syslog, SNMP, TACACS+, and RADIUS read-only state.

Site/element names are resolved to controller IDs. ntp_status accepts object_id as an NTP configuration ID; if omitted and exactly one NTP configuration exists on the element, that ID is used automatically.

Args: operation: Which read to run. No params required: dns_profiles, dns_roles, syslog_profiles, tacacs_profiles. Requires site + element: dns_services, syslog_servers, snmp_agents, snmp_traps, tacacs_servers. Requires site only: dhcp_servers. Requires element only: ntp, radius, ntp_status (ntp_status also takes optional object_id). site: Site name or controller ID. Required by some operations (see operation); resolved the same way as find_site — ambiguous or unknown names return an error instead of guessing. element: Element name or controller ID. Required by some operations (see operation); resolved the same way as find_element. object_id: Only used by ntp_status, as an NTP configuration ID. Omit it if the element has exactly one NTP configuration — it is picked automatically. If it has more than one, this call fails with the candidate IDs listed; pass one of them here. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect multicast configuration, RPs, peer groups, routes, IGMP, and WAN status.

Args: operation: Which read to run. No params accepted: peer_groups, routes, igmp_memberships. Requires site only: source_rps, source_site_config. Requires site + element: config, dynamic_rps, rps, protocol_parameters, wan_status. site: Site name or controller ID. Required by the operations listed above; resolved the same way as find_site. Optional narrowing filter for routes/igmp_memberships, which are otherwise tenant-wide. element: Element name or controller ID. Required by the operations listed above; resolved the same way as find_element. Optional narrowing filter for routes/igmp_memberships, and may be combined with site. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect IPFIX/flow-export configuration, collectors, filters, templates, and prefixes.

Args: operation: Which read to run. Requires site + element: config. No params required: collectors, filters, profiles, templates, global_prefixes. local_prefixes takes optional site — site-scoped prefixes if given, tenant-wide prefixes if omitted. site: Site name or controller ID. Required or optional depending on operation (see above); resolved the same way as find_site. element: Element name or controller ID. Required only for config; resolved the same way as find_element. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect cellular modules, firmware status, APN profiles, and module images.

Args: operation: Which read to run. No params required: module_images, apn_profiles, firmware_status. Requires machine: machine_modules. Requires element: modules (the default cellular-module read). element: Element name, serial number, hardware ID, or controller ID. Required only for modules; resolved the same way as find_element. machine: Machine name, hardware ID, serial number, or controller ID. Required only for machine_modules; resolved the same way as find_resource(kind="machine"). cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect element software state/status and tenant-wide upgrade/template status.

Args: operation: Which read to run. Requires element: element_state, element_status. No params required (tenant-wide): machine_upgrade, upgrade_status, site_templates, template_deployments. element: Element name or controller ID. Required only for element_state/element_status; resolved the same way as find_element. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect directory/tenant identity state. Session/token fields are always redacted centrally.

Args: operation: Which read to run. No params required: directory_service, directory_status, directory_users, directory_groups, active_user_ips, tenant_users, element_users. Requires object_id: element_user_access. object_id: Element-user ID (from an element_users result's id field). Required only for element_user_access; ignored otherwise. An ID that does not exist is not reported as an error — it returns an empty list, exactly like a valid user with no access records. Confirm the ID came from an element_users result before reading an empty response as "this user has no access". cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect service connections, endpoints, binding maps, service labels, and extensions.

Args: operation: Which read to run. No params required: tenant_connections, endpoints, binding_maps, service_labels, tenant_extensions. Requires site: site_connections, site_extensions. Requires site + element: element_extensions. site: Site name or controller ID. Required by some operations (see operation); resolved the same way as find_site. element: Element name or controller ID. Required only for element_extensions; resolved the same way as find_element. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect Prisma Access/SASE integration, connections, prefixes, and ADEM state.

Args: operation: Which read to run. Requires site: site_config, connections, adem_site_config, adem_status. Requires site + object_id: connection_status (a SASE connection ID from a connections result's id field). No params required: connection_config, pa_networks, integration_status. Requires site + element: advertised_prefixes, reachable_prefixes. site: Site name or controller ID. Required by most operations (see operation); resolved the same way as find_site. element: Element name or controller ID. Required only for the prefix operations; resolved the same way as find_element. object_id: SASE connection ID. Required only for connection_status; ignored otherwise. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect tenant/platform metadata, licenses, SKUs, machines, and reports.

Sensitive values in external CA or other returned objects are recursively redacted before leaving the server.

Args: operation: Which read to run. No params required: tenant, licenses, skus, machines, external_ca, otp_access, hub_service_endpoints. Requires machine: machine_system_status, machine_software. reports takes no parameters — see folder. machine: Machine name, hardware ID, serial number, or controller ID. Required only for the two machine-scoped operations; resolved the same way as find_resource(kind="machine"). folder: Not usable. The endpoint ignores it — every value returns zero items, including a folder path copied verbatim from an unfiltered reports result — so passing it is rejected with a 400 rather than returning a misleading empty list. Call reports unfiltered and select from the returned path/type fields yourself. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Unified operational monitoring for incidents, flows, metrics, and AIOps.

Events/alarms carry an important warning: an unwindowed call only sees the most recent records and may miss an older incident. Use start_time and end_time for incident analysis. Flow digest mode summarizes application, path, action, and top talkers; raw=true returns records. Link/probe metrics are recorded telemetry, not an active ping test.

Args: operation: Which monitoring dataset. events/alarms query the incident log (see start_time/end_time below — they behave differently here than for the other operations). flows returns a summarized digest by default (raw=true for individual flow rows) and requires site. link_metrics/ probe_metrics return recorded telemetry (not a live probe) and require site. aiops_health, aiops_anomaly, aiops_forecast, aiops_aggregates, system_metrics, qos_metrics, and bandwidth_stats are tenant-wide AIOps datasets that ignore site, element, hours, start_time, and end_time entirely. site: Site name or controller ID. Required for flows, link_metrics, and probe_metrics; an optional filter for events/alarms; ignored by every aiops_*/system_metrics/ qos_metrics/bandwidth_stats operation. element: ION element name or ID. Optional filter with the same scope as site; ignored wherever site is ignored. hours: Lookback window in hours (max 168) ending now. Used only when start_time/end_time are both omitted, and only for flows, link_metrics, probe_metrics. Has no effect on events/alarms or any aiops_* operation. start_time: ISO 8601 timestamp. For flows/link_metrics/ probe_metrics this must be paired with end_time (supply both or neither) and replaces hours. For events/alarms it is an independent, optional lower bound — you may pass it alone to mean "since this time". Leaving both start_time and end_time unset on events/alarms returns only the most recent records and can silently miss an older incident. end_time: ISO 8601 timestamp — see start_time for the pairing rules, which differ by operation. severity: Comma-separated severity filter for events/alarms (e.g. "critical,major"). Ignored for every other operation. raw: When true, skip summarization and return raw records instead: individual flow rows for flows (capped at 500), or per-datapoint metric series for link_metrics/probe_metrics instead of the path/probe-pivoted view. Ignored for every other operation. limit: Max items to return in this page for list-shaped results (events, alarms, raw flows, probe_metrics). Capped at 100 for events/alarms. Ignored for single-object results (flow digest, link_metrics) — because link_metrics cannot be paginated, a wide window can exceed the server's response byte budget, in which case the whole payload is replaced by an identifying stub plus "warning": "item exceeded response budget...". That warning means the data was dropped, not that no data exists: retry with a smaller hours (a multi-day window is the usual cause). cursor: Opaque pagination token copied from a previous response's next_cursor. Only meaningful where limit is. app: Application ID/name filter — flows only. Ignored elsewhere. path_id: Path ID filter — flows only. Ignored elsewhere. waninterface_id: WAN interface ID filter — flows only. Ignored elsewhere.

Inspect the major Prisma SD-WAN policy families using human policy names.

sets and stacks can be listed tenant-wide. rules and status require policy as an exact/partial name or ID; ambiguous policy names are never auto-selected. Security policy-set status is not present in the source registry and is therefore reported unsupported instead of invented.

Args: family: Which policy family to inspect: network, priority, nat, security, performance, or all to query every family at once (each item tagged with policy_family). all only supports operation="sets" or "stacks" — rules/status need a single policy name, which is meaningless across families at once. operation: sets (default) or stacks list every policy set/stack tenant-wide, no policy needed. rules lists the rules inside one policy set — requires policy. status gets one policy set's status — requires policy; not available for family="security" (reported as unsupported_operation, not guessed). policy: Exact/partial policy-set name or controller ID. Required for rules/status, ignored for sets/stacks. Ambiguous partial matches are never auto-picked — the error lists every candidate so you can retry with an exact name or ID. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect security zones, application catalog/version, prefixes, and SD-WAN apps.

Application searches are performed client-side against the registry-backed application catalog. Site/element names are resolved automatically for scoped security-zone operations.

Args: operation: zones (all security zones, no other args needed), site_zones (requires site), element_zones (requires site and element), applications (catalog search, optional application substring filter), application_version (catalog version info, no args), global_prefixes/local_prefixes (no other args needed), sdwan_apps (list, no other args), sdwan_app_status/sdwan_app_configs (requires application as an exact SD-WAN app ID, not a name search). site: Site name or controller ID. Required for site_zones and element_zones; ignored otherwise. element: ION/element name or controller ID. Required (with site) for element_zones; ignored otherwise. application: For operation="applications", an optional case-insensitive substring to filter the application catalog by display name. For sdwan_app_status/sdwan_app_configs, this must instead be the exact SD-WAN app controller ID (not a search term) — those two operations do not resolve names. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. An operation with zero matches still returns the same collection key with an empty list, not a different shape. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Inspect BGP, OSPF, static routes, and routing policy objects for one ION.

Site and element accept names or IDs. bgp_status returns all peer states in one call where supported. bgp_prefixes resolves a specific BGP peer by peer ID/name/address and then retrieves reachable, advertised, or discovered prefixes. For bgp_status, include_prefixes=true enables composite behavior: reachable/filtered prefix counts are added per peer and Established peers receiving zero reachable prefixes are flagged. OSPF neighbor/prefix operations enumerate OSPF configs and fan out safely.

Args: operation: Which routing dataset to fetch. bgp_peers, bgp_config, ospf_config, static_routes, route_maps, prefix_lists, community_lists, and aspath_lists each return that object list directly. bgp_status returns peer session states with an established flag added. bgp_prefixes requires peer and returns one peer's prefixes (see prefix_kind). ospf_neighbors/ospf_prefixes fan out across every OSPF config found on the element. element: ION element name, serial number, hardware ID, or exact controller ID. Required for every operation. site: Site name or controller ID. Optional — inferred from element's inventory record when possible; only needed to disambiguate an element name that exists at more than one site. peer: BGP peer name, IP address, or exact ID. Required only for bgp_prefixes; resolved the same way as element (exact ID, then exact name/IP, then substring) — ambiguous or missing matches return a structured error with candidates instead of guessing. Ignored for every other operation. prefix_kind: For bgp_prefixes only: "reachable" (prefixes actually usable via this peer, the default), "advertised" (what we send the peer), or "discovered" (what the peer offered before filtering). Ignored for every other operation. include_prefixes: For bgp_status only. When true, also fetches per-peer reachable-prefix counts (one extra API call per peer, bounded by the server fan-out limit, default 100) and flags any Established peer with zero reachable prefixes via established_zero_prefixes — a fast way to spot a session that's up but not passing routes. Leave false for a quick status check. Ignored for every other operation. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).

Retrieve common device-side diagnostic state without requiring raw API IDs.

Covers LLDP neighbors, MAC table, switch port/VLAN mappings, BFD peers, and application-probe configuration. Site is inferred from the element whenever the element inventory record provides site_id.

Args: operation: Which diagnostic to fetch. lldp_neighbors and mac_table need only element. bfd_peers, port_to_vlan, vlan_to_port, and application_probe also need a resolvable site (explicit, or inferred from the element's inventory record) — if neither is available, these four return an error rather than guessing. port_to_vlan/vlan_to_port additionally require a switch-capable element model; on other models the controller rejects the read with a "does not support switch configuration" message, which means wrong device type, not a failed lookup — don't retry it against the same element. element: ION element name, serial number, hardware ID, or exact controller ID. Always required. site: Site name or controller ID. Optional for lldp_neighbors/ mac_table; required (explicit or inferable from element) for bfd_peers, port_to_vlan, vlan_to_port, and application_probe. cursor: Opaque pagination token copied from a previous response's next_cursor. Omit on the first call. limit: Max items to return in this page. Omit to use the server default page size (50; max 200).