Perform comprehensive connectivity and health analysis of the APIC infrastructure.

Returns complete analysis including:
- APIC controller connectivity and version
- Fabric health (nodes online, critical faults)
- Capacity metrics and high-utilization nodes
- Multicast configuration summary

This is a composite function that provides an overall health check of the entire fabric.

Analyze network paths between two EPGs.

Args:
    src_epg: Source EPG DN or name
    dst_epg: Destination EPG DN or name

Returns:
- Contracts found between EPGs
- Consumer/provider relationships
- Connectivity status

Useful for troubleshooting connectivity issues and validating security policies.

Retrieve audit logs of configuration changes.

Args:
    hours: Number of hours back to retrieve logs (default: 24h)

Returns audit logs with user activity breakdown and configuration changes.
Limited to 50 most recent changes.

Retrieve multicast information for bridge domains of a specific tenant.

Args:
    tenant: Tenant name to filter bridge domains

Returns multicast configuration for the tenant's bridge domains including GIPo addresses.

Retrieve multicast information for all bridge domains.

Returns comprehensive multicast configuration including:
- GIPo multicast addresses (bcastP) for BUM traffic
- IGMP snooping configuration
- Multicast flooding settings
- IPv6 multicast support
- Discovered IGMP groups
- Static multicast groups

Retrieve fabric capacity metrics.

Returns capacity information for each node including:
- Current usage
- Maximum capacity
- Utilization percentage
- Context information

Useful for capacity planning and resource monitoring.

Retrieve security contracts from APIC.

Args:
    tenant: Optional tenant name filter. If not specified, returns contracts from all tenants.

Returns contracts with tenant, name, description, scope, priority, and DSCP settings.

Retrieve endpoints from a specific EPG.

Args:
    tenant: Tenant name
    application: Application profile name
    epg: Endpoint Group name

Returns all endpoints in the EPG with MAC, IP, encapsulation, and location details.

Retrieve Endpoint Groups (EPGs) from APIC.

Args:
    tenant: Optional tenant name filter. If not specified, returns EPGs from all tenants.

Returns EPGs with tenant, application, name, description, and policy details.

Retrieve recent events from APIC event log.

Args:
    time_range: Time range in hours (default: 24h)

Returns recent events with severity breakdown, sorted by creation time.
Limited to 100 most recent events.

Retrieve health scores of APIC objects.

Returns health scores of monitored objects with severity classification.
Objects are classified as healthy (>=90), minor (75-89), major (50-74), or critical (<50).

Retrieve interface statistics for specific node and/or interface.

Args:
    node_id: Optional node ID filter
    interface: Optional specific interface name

Returns interface statistics including operational state, speed, and usage.
Useful for monitoring interface health and performance.

Retrieve LLDP neighbors discovered on fabric nodes.

Args:
    node_id: Optional node ID filter. If not specified, returns neighbors from all nodes (limited to 50).

Returns LLDP neighbor information including remote system name, port description,
chassis ID, and management IP. Useful for understanding physical topology.

Retrieve physical interfaces from a specific node or all nodes.

Args:
    node_id: Optional node ID filter. If not specified, returns interfaces from all nodes (limited to 100).

Returns list of physical interfaces with admin state, operational state, speed, usage, and MTU.

Analyze CPU and memory resource utilization across the fabric.

Returns:
- CPU utilization per node
- Memory utilization per node
- Average CPU and memory usage
- Nodes with high utilization (>80% CPU, >85% memory)

Essential for performance monitoring and capacity planning.

Identify top network conversations (top talkers).

Returns the top 20 traffic generators including:
- Tenant and EPG information
- Bytes and packets transferred
- Utilization percentage
- Traffic ranking

Useful for identifying bandwidth consumers and traffic patterns.

Analyze network traffic for a tenant or EPG.

Args:
    tenant: Optional tenant name to filter traffic
    epg: Optional EPG name to filter traffic (requires tenant)

Returns traffic statistics including:
- Bytes average, max, and min
- Traffic data over 5-minute intervals
- Total bytes transferred

Useful for traffic monitoring and troubleshooting.

Retrieve VRFs (Virtual Routing and Forwarding instances) from APIC.

Args:
    tenant: Optional tenant name filter. If not specified, returns VRFs from all tenants.

Returns VRFs with tenant, name, description, and policy control settings.

Search APIC objects by IP address.

Args:
    ip_address: IP address to search

Returns matching endpoints and subnets that contain or use this IP address.
Comprehensive search across the fabric.

Track a specific endpoint by MAC or IP address.

Args:
    mac_or_ip: MAC address (format: XX:XX:XX:XX:XX:XX or XX-XX-XX-XX-XX-XX) or IP address

Returns endpoint location including tenant, application, EPG, encapsulation, and other details.
Useful for troubleshooting connectivity issues.

Get list of all switches across all fabrics.

Returns:
    Dict with list of switches including serial numbers, fabric, IP addresses, etc.

Get configuration deployment history for a specific fabric.

Args:
    fabric_name: Name of the fabric

Returns:
    Dict with deployment history records including timestamps and status

Get event records from Nexus Dashboard event monitoring.
This endpoint provides critical events, alarms, and system notifications.

Args:
    limit: Maximum number of events to return (default: 50, max recommended: 1000)
    severity: Optional filter by severity (critical, error, warning, info)

Returns:
    Dict with event records including metadata and items with severity, description, timestamps, etc.
    Results are automatically limited client-side if API returns more than requested.

Get list of fabric configurations.

Returns:
    Dict with fabrics information including fabric names, types, and status

Get summary of all fabric associations (MSD fabric-member relationships).

Returns:
    Dict with fabric summary and associations

Get detailed interface information for a specific switch by serial number.

Args:
    serial_number: Serial number of the switch (e.g., "FDO23460MQC")

Returns:
    Dict with list of all interfaces and their details (status, VLAN, compliance, etc.)

Get configuration preview for a specific network deployment.

Args:
    fabric_name: Name of the fabric
    network_name: Name of the network

Returns:
    Dict with configuration preview for each switch showing what will be deployed

Get list of networks in a specific fabric.

Args:
    fabric_name: Name of the fabric

Returns:
    Dict with networks information including network names, VLANs, and configuration

Get deployment status for a specific network in a fabric.

Args:
    fabric_name: Name of the fabric
    network_name: Name of the network

Returns:
    Dict with network status details including deployment state and errors

Get list of NDFC sites/fabrics.

Returns:
    Dict with sites information

Get list of switches in a specific fabric.

Args:
    fabric_name: Name of the fabric

Returns:
    Dict with switches information including serial numbers, IP addresses, and status

Get list of VRFs (Virtual Routing and Forwarding instances) in a specific fabric.

Args:
    fabric_name: Name of the fabric

Returns:
    Dict with VRFs information including VRF names and configuration

Authenticate to NDFC and obtain JWT token.
Token is valid for 3600 seconds (1 hour).

Returns:
    Dict with success status and authentication information

Logout from NDFC and clear JWT token.

Returns:
    Dict with success status

Execute SSH command specifically on Palo Alto firewalls.

🔥 USE THIS for ALL Palo Alto firewall commands (show vpn, show system, show routing, etc.).
This tool uses PTY interactive sessions required by Palo Alto PAN-OS.

Examples:
- "show vpn gateway"
- "show system info"
- "show routing route"

Execute SSH commands on multiple Palo Alto firewalls in parallel.

🔥 USE THIS for batch operations on multiple Palo Alto firewalls.

Args:
    targets: List of {"ip": "10.240.203.241", "command": "show vpn gateway"}
    timeout: Global timeout in seconds (default: 120s)

Get configuration audit logs (who changed what, when).

Args:
    limit: Maximum number of logs to return (default: 100, max: 1000)

Returns:
    Dict with total_logs count and logs list containing:
    - time, admin, command, result, path

Get pending configuration changes (candidate vs running config).

Returns:
    Dict with has_pending_changes boolean, diff_summary, and diff_content

Execute custom operational command on Panorama.

Args:
    cmd: XML command (e.g., "<show><system><info></info></system></show>")

Returns:
    Dict with command execution results in JSON format

Get list of Device-Groups and their member firewalls.

Returns:
    Dict with total_device_groups count and device_groups list
    containing name, member devices, and device count

Find duplicate address objects (same IP, different names).

Args:
    limit: Maximum number of addresses to analyze (default: 100)

Returns:
    Dict with total_addresses, duplicates_found count, and
    duplicates list with IP and conflicting names

Check for certificates expiring within threshold days.

Args:
    days_threshold: Days before expiration to alert (default: 30)

Returns:
    Dict with total_certificates, expiring_certificates list,
    expired_certificates list, and counts

Generate and return a Panorama API key.

Returns:
    Dict with api_key for manual API operations

Find local overrides not managed by Panorama.

Args:
    limit: Maximum number of devices to check (default: 100)

Returns:
    Dict with devices_with_overrides list

Get inventory of all firewalls managed by Panorama.

Returns:
    Dict with total_devices count and devices list containing:
    - device name, serial, version, HA state, connection status
    - IP address, model, uptime, installed plugins

Find security rules that never matched traffic.

Args:
    device_group: Name of the device-group to analyze
    days: Analysis period in days (default: 30)
    limit: Maximum number of rules to analyze (default: 100)

Returns:
    Dict with never_matched_rules list and analysis details

Find security rules without Security Profile Group attached.

Args:
    device_group: Name of the device-group to analyze
    limit: Maximum number of rules to analyze (default: 100)

Returns:
    Dict with total_rules_analyzed, rules_without_profile list, and count

Analyze security rules quality for a Device-Group.

Args:
    device_group: Name of the device-group to analyze

Returns:
    Dict with rules list and quality_issues analysis:
    - rules_without_description count
    - rules_with_generic_names count
    - too_permissive_rules count (any/any/any)
    - details with specific rule names

Get Panorama system information.

Returns:
    Dict with hostname, version, uptime, serial, model, and security versions
    (threat, AV, wildfire, URL filtering)

Find unused address objects in Panorama configuration.

Args:
    object_type: Type of object to analyze (default: "address")

Returns:
    Dict with total_objects, unused_count, and unused_objects list

Find unused zones in security rules.

Args:
    limit: Maximum number of zones to analyze (default: 100)

Returns:
    Dict with total_zones and zones list

Check PAN-OS, Threat, AV, Wildfire version compliance across devices.

Returns:
    Dict with panorama versions and devices_versions showing
    version and model for each managed firewall

Execute SSH command on generic network devices (Cisco, Juniper, Arista, Linux, etc.).

⚠️ NOT for Palo Alto firewalls - use paloalto_send_command instead.
Works with standard SSH devices that don't require PTY interactive sessions.

Execute SSH commands on multiple generic network devices in parallel.

⚠️ NOT for Palo Alto firewalls - use paloalto_send_command_parallel instead.

Args:
    targets: List of {"ip": "192.168.1.1", "command": "show version"}
    timeout: Global timeout in seconds (default: 30s)

Example:
    [
        {"ip": "192.168.1.1", "command": "show version"},
        {"ip": "192.168.1.2", "command": "show ip route"}
    ]

List available diagnostic skills/workflows.

Skills are step-by-step procedures that guide Claude through structured
troubleshooting using the MCP tools. Call this first to discover what's
available, then use skills_load() to load a specific skill.

Args:
    platform: Filter by platform (mikrotik, aruba, aci, graylog, librenms,
              paloalto, panorama, generic). If None, returns all skills.
    tag: Filter by topic tag (bgp, routing, multicast, connectivity, wifi…).
         If None, no tag filter is applied.
    reload: Set True to refresh the index after adding new skill files (default: False).

Returns:
    List of skills with name, title, platform, tags, description and required tools.
    Never returns skill content — use skills_load() for that.

Load a diagnostic skill and return its full procedure.

The skill contains step-by-step instructions: which MCP tools to call, in what
order, what results to expect, and how to interpret anomalies. Read and follow
the skill before executing the corresponding workflow.

Matching priority: exact → case-insensitive exact → prefix → substring.
If the name is ambiguous, returns a list of candidates instead of content.

Args:
    skill_name: Skill name (e.g., "bgp-diagnostic-mikrotik", "connectivity-check").
                Partial and case-insensitive matches are supported.
                Use skills_list() first if unsure of the exact name.
    name: Alias for skill_name — either parameter is accepted.

Returns:
    Full Markdown content of the skill plus metadata (platform, tags, token estimate).