Get basic device information (model, hostname, serial, version, etc.).

Args: hostname: Target device hostname (must exist in config.ini) config_path: Path to config.ini (empty string uses default search)

Get JUNOS version information with upgrade status.

Shows running version, planning version, pending version, local/remote package status, and reboot schedule.

Args: hostname: Target device hostname (must exist in config.ini) config_path: Path to config.ini (empty string uses default search)

Run a CLI show command on the device and return output.

Args: hostname: Target device hostname (must exist in config.ini) command: CLI command to execute (e.g., "show bgp summary") output_format: Output format — "text" (default), "json", or "xml". Note: pipe stages (| match, | last, | count, etc.) are silently dropped regardless of output_format — PyEZ's Device.cli() sends the command over NETCONF RPC, which JunOS does not pipe-process. Run the command without pipes; for line filtering, use run_show_command_batch's grep_pattern argument instead (works for a single host too — pass a one-element hostnames list). That workaround always fetches text output internally, so it cannot be combined with output_format="json"/"xml" — for structured output you must filter the result client-side instead. config_path: Path to config.ini (empty string uses default search)

Run multiple CLI show commands on the device in a single session.

Commands are executed in sequence and stop on the first failure. To run all commands regardless of individual errors, call run_show_command once per command instead.

Args: hostname: Target device hostname (must exist in config.ini) commands: List of CLI commands to execute output_format: Output format — "text" (default), "json", or "xml". Note: pipe stages (| match, | last, | count, etc.) are silently dropped regardless of output_format — PyEZ's Device.cli() sends the command over NETCONF RPC, which JunOS does not pipe-process. Run commands without pipes and filter client-side. run_show_command_batch's grep_pattern argument offers server-side-style filtering, but it only accepts one command at a time — it does not cover this tool's multi-command case, so it is not a drop-in workaround here. config_path: Path to config.ini (empty string uses default search)

Run a CLI show command on multiple devices in parallel.

Uses ThreadPoolExecutor for concurrent execution. Either hostnames or tags selects the targets; if both are omitted, every router in config.ini is targeted. When both are given, the intersection is used.

Args: command: CLI command to execute on all devices hostnames: List of target device hostnames (must exist in config.ini) tags: Tag filter. Each list element is one tag group (comma-separated tags AND together within a group). Multiple list elements OR together across groups. E.g. ["tokyo,core", "backup"] means (tokyo AND core) OR backup. Combined with hostnames the result is the intersection. grep_pattern: Optional Python re pattern. When set, only lines matching the pattern (via re.search) are kept from each host's output. Header lines (starting with #) are always preserved. Hosts with no matching lines show (no match). Reduces large batch outputs to the essential lines. This tool always fetches text output internally (there is no output_format parameter here) — grep_pattern filters plain-text lines and cannot be combined with structured JSON/XML output. max_workers: Maximum parallel threads (default 5) config_path: Path to config.ini (empty string uses default search)

List files on the remote device path (/var/tmp by default).

Args: hostname: Target device hostname (must exist in config.ini) config_path: Path to config.ini (empty string uses default search)

Check if a device is ready for upgrade.

Verifies whether the device is already running the target version, and performs a dry-run to check local/remote package availability.

Args: hostname: Target device hostname (must exist in config.ini) config_path: Path to config.ini (empty string uses default search)

Compare two JUNOS version strings.

Returns whether left is greater than, equal to, or less than right. No device connection required.

Args: left: First JUNOS version string (e.g., "22.4R3-S6.5") right: Second JUNOS version string (e.g., "23.2R1.0")

List routers defined in config.ini, optionally filtered by tags.

Returns section names from config.ini, which represent the hostnames that can be used with other tools. No device connection required.

Args: tags: Tag filter. Each list element is one tag group (comma-separated tags AND together within a group); multiple list elements OR together across groups. E.g. ["tokyo,core", "backup"] means (tokyo AND core) OR backup. None/empty returns all. config_path: Path to config.ini (empty string uses default search)

Get package file name and expected hash for a specific device model.

Retrieves model-specific package information from config.ini. No device connection required.

Args: hostname: Target device hostname (must exist in config.ini) model: Device model name (e.g., "EX2300-24T") config_path: Path to config.ini (empty string uses default search)

Get device configuration.

Args: hostname: Target device hostname (must exist in config.ini) output_format: Output format - "text" (default), "set", or "xml" config_path: Path to config.ini (empty string uses default search)

Show configuration difference compared to a rollback version.

Args: hostname: Target device hostname (must exist in config.ini) rollback_id: Rollback version to compare against (0-49, default 1) config_path: Path to config.ini (empty string uses default search)

Collect RSI (Request Support Information) and SCF (Show Configuration) from a device.

Saves two files: {hostname}.SCF (show configuration) and {hostname}.RSI (request support information). Model-specific timeouts are applied automatically (e.g., SRX Branch: 1200s, Virtual Chassis: 1800s).

Args: hostname: Target device hostname (must exist in config.ini) output_dir: Directory to save output files (empty uses config RSI_DIR or current dir) config_path: Path to config.ini (empty string uses default search)

Collect RSI/SCF from multiple devices in parallel.

Uses ThreadPoolExecutor for concurrent collection. Default 20 workers matches junos-ops CLI default for RSI collection. Either hostnames or tags selects the targets; if both are omitted, every router in config.ini is targeted. When both are given, the intersection is used.

Args: hostnames: List of target device hostnames tags: Tag filter. Each list element is one tag group (comma-separated tags AND together within a group); multiple list elements OR together across groups. Combined with hostnames the result is the intersection. output_dir: Directory to save output files (empty uses config RSI_DIR or current dir) max_workers: Maximum parallel threads (default 20) config_path: Path to config.ini (empty string uses default search)

Probe NETCONF reachability for one or more devices.

Equivalent to junos-ops check --connect. Opens a fast NETCONF handshake (no full PyEZ facts gathering, 5-second TCP probe) and reports per-host status as a table.

Args: hostnames: List of target device hostnames (must exist in config.ini) tags: Tag filter. Each list element is one tag group (comma-separated tags AND together within a group); multiple list elements OR together across groups. Combined with hostnames the result is the intersection. max_workers: Maximum parallel threads (default 20, matches junos-ops) config_path: Path to config.ini (empty string uses default search)

Verify local firmware checksums against the config.ini inventory.

Equivalent to junos-ops check --local. Iterates every <model>.file / <model>.hash pair in the DEFAULT section of config.ini and verifies the file on the staging server. No device connection required.

Args: model: Restrict to a single model (empty = all configured models) config_path: Path to config.ini (empty string uses default search)

Verify the staged firmware checksum on one or more devices.

Equivalent to junos-ops check --remote. Connects to each device via NETCONF and verifies the package file (<model>.file) sitting on the device against <model>.hash. Doubles as post-SCP copy verification. Per-host model resolution: model arg > config.ini [host].model > device facts.

Args: hostnames: List of target device hostnames (must exist in config.ini) tags: Tag filter. Each list element is one tag group (comma-separated tags AND together within a group); multiple list elements OR together across groups. Combined with hostnames the result is the intersection. model: Override model resolution for all hosts (empty = per-host resolution) max_workers: Maximum parallel threads (default 20) config_path: Path to config.ini (empty string uses default search)

Copy firmware package to remote device via SCP with checksum verification.

Checks if copy is needed (already running target version, or package already present on device). Cleans up storage before copying.

Args: hostname: Target device hostname (must exist in config.ini) dry_run: If True (default), show what would be done without copying force: If True, skip version checks and force copy config_path: Path to config.ini (empty string uses default search)

Install firmware package on device with pre-flight checks.

Full upgrade flow: version check -> rollback pending if needed -> copy (with checksum) -> clear reboot schedule -> rescue config save -> request system software add (with validation).

Args: hostname: Target device hostname (must exist in config.ini) dry_run: If True (default), show what would be done without installing force: If True, skip version checks and force install unlink: If True, run request system software add <pkg> unlink via CLI instead of PyEZ SW.install(). Use for low-flash devices (EX2300 / EX3400, ~1.3 GB /dev/gpt/junos) where major version upgrades fail with "ERROR: insufficient space" because PyEZ does not expose the unlink parameter. The CLI path frees ~330 MB by unlinking the source tgz during extraction. config_path: Path to config.ini (empty string uses default search)

Rollback to previously installed package version.

Checks pending version first. If no pending version exists, rollback is skipped.

Args: hostname: Target device hostname (must exist in config.ini) dry_run: If True (default), show what would be done without rolling back config_path: Path to config.ini (empty string uses default search)

Schedule device reboot at a specified time.

Checks for existing reboot schedules. If one exists and force is False, the existing schedule is preserved.

Args: hostname: Target device hostname (must exist in config.ini) reboot_at: Reboot time in YYMMDDHHMM format (e.g., "2601020304" = 2026-01-02 03:04) dry_run: If True (default), show what would be done without scheduling force: If True, clear existing reboot schedule and set new one config_path: Path to config.ini (empty string uses default search)

Run a morning health check across multiple devices in parallel.

Checks per host (Phase 1):

• show system alarms / show chassis alarms

• show interfaces descriptions — a physical interface is flagged [IF_DOWN] only when it has a description (Admin=up, Link=down) and its Last flapped time is within since_hours. Undescribed unused ports and chronically-down ports are suppressed (loopback / mgmt / internal logical units are also excluded).

• show log messages | last 200 — alert patterns within since_hours

• dual-RE redundancy — an explicit routing-engine fault is flagged [RE_FAULT] (skipped on SRX chassis clusters, whose facts misreport RE status; a failed cluster node raises chassis alarms instead)

• route_baseline (optional) — when > 0, a device whose inet.0 destination count differs from this value is flagged [ROUTE_BASELINE]. Scope with tags (e.g. tags=["main"], route_baseline=152), since full-table routers carry far more routes than access routers.

Syslog patterns watched: BGP state change away from Established, STP port role change, OSPF neighbor down, ARP address conflict, IF_DOWN.

since_hours defaults to 18 (≈ previous 15:00 for a 09:00 morning run). Tags default to none (all routers); pass tags=["main"] to limit scope.

Output tiers:

• CRITICAL — connection failure

• WARNING — at least one anomaly found

• OK — clean

Returns a Markdown summary with anomaly details for CRITICAL/WARNING hosts and a collapsed OK list.

The call stops after JUNOS_DEADLINE seconds (default 45; 0 disables) so a large fleet does not run into a client's per-call timeout: hosts that have not finished are listed under NOT CHECKED and the summary is marked partial. For a full sweep of a large fleet use daily_brief_start / daily_brief_result.

Start a daily_brief in the background; returns immediately with a job_id.

Use this for a fleet too large for one synchronous daily_brief (a client's per-call timeout is about 60 s). Arguments mirror daily_brief. Poll daily_brief_result(job_id) every few seconds until status is done (the full brief is under result, with no deadline) or error. If too many jobs are retained, returns {"status": "rejected", ...}.

While a job is running, a call that would switch to a different config file is refused (the config is process-global); use the same config_path or none.

Args: hostnames: Only these hosts (must exist in config.ini). Default: all hosts. tags: Tag filter. Each element is one group: a comma inside an element means the host must have ALL of those tags ("main,core"); several elements are ORed (["main", "core"] = hosts tagged main OR core). Case-insensitive. With hostnames too, the result is the intersection of the two. since_hours: Look-back window for syslog/interface events (default 18). route_baseline: When > 0, flag a device whose inet.0 route count differs. max_workers: Devices checked in parallel (default 10). config_path: Path to config.ini (empty uses the default search).

Fetch a daily_brief_start job by id.

status is running (keep polling), done (result holds the brief), error (error holds the exception type name only) or unknown (bad or expired id).

Push configuration to a device with commit confirmed and health check.

Supports two input methods (exactly one required):

• config_file: Path to a .set or .j2 file containing set commands

• set_commands: List of set command strings (inline)

Safety features (not available in Juniper's official MCP server):

• dry_run mode (default True): shows diff without committing

• commit confirmed: auto-rollback if not confirmed within timeout

• health check: auto-rollback on connectivity failure after commit

Commit flow (normal): lock -> load -> diff -> commit_check -> commit confirmed -> health check -> confirm -> unlock

Commit flow (no_commit=True — intentional auto-rollback): lock -> load -> diff -> commit_check -> commit confirmed -> unlock (health check and final confirm are skipped; JUNOS rolls back automatically after confirm_timeout minutes)

RPC timeout: every step uses timeout from config.ini for the host, else the model default from junos-ops (180 s on SRX branch models such as SRX300/320/340/345, whose commits can exceed 30 s; 120 s otherwise). It is never shortened.

Per-call deadline: with JUNOS_DEADLINE set (default 45 s; 0 disables) the push runs as a background job and this call waits for it until shortly before the deadline. If it finishes, the answer is the same as without a deadline. If not, the answer says "Still running" with a job_id: poll push_config_result(job_id) for the outcome (the device-side commit confirmed protects a push whose caller went away). For hosted clients that cut a tool call at about 60 s and for slow-committing models, push_config_start returns the diff and the job id without waiting.

Only one push per host runs at a time; a second one is refused. While a push holds a host, other tools on that host wait at most until the deadline and then answer "host busy".

Args: hostname: Target device hostname (must exist in config.ini) config_file: Path to .set or .j2 file (mutually exclusive with set_commands) set_commands: List of set commands (mutually exclusive with config_file) dry_run: If True (default), show diff only without committing confirm_timeout: Minutes before auto-rollback (default 1, used with commit confirmed) no_commit: If True, issue commit confirmed but intentionally skip the final commit so JUNOS auto-rolls back after confirm_timeout minutes. Useful for triggering service restarts (e.g. syslog on EX3400) where no request ...restart command exists. dry_run=True takes precedence over no_commit (diff is shown but nothing is committed). health_check: Fallback health check commands tried in order after commit. Passes if ANY command succeeds. Supports "ping ..." (checks packets received), "uptime" (NETCONF RPC probe), or any CLI command (success if no exception). Default: ["uptime"] — uses the existing NETCONF session and does not depend on ICMP reachability. (Changed from broadcast ping in junos-mcp 0.11.0 to match junos-ops 0.16.8+.) Ignored when no_commit=True. config_path: Path to config.ini (empty string uses default search)

Start push_config as a background job and return its diff and job_id without waiting for the commit.

Use this instead of push_config when the client cuts a tool call at about 60 s (hosted connectors) or the device commits slowly (SRX branch models such as SRX300/320/340/345), or when push_config answered "Still running". The job uses the host's full RPC timeout (timeout in config.ini, else 180 s on SRX branch models and 120 s otherwise) and no per-call deadline. Arguments and the commit flow are the same as push_config.

The job locks the candidate configuration, loads the change and computes the diff, and this call returns that diff (diff). The same locked session then goes on to commit_check -> commit confirmed -> health check -> confirm -> unlock, so the committed change is exactly the diff returned. Poll push_config_result(job_id) every ~10 s until status is not running. If the server dies mid-way, an unconfirmed commit confirmed rolls back on the device after confirm_timeout minutes.

With dry_run=True (default) nothing is committed: the answer has status dry_run and the diff under result once the job finishes.

Returns {"job_id", "status", "hostname", "diff"?, "result"?, "poll_with": "push_config_result", "poll_after_seconds"}. status may already be final (done with "No changes to apply", failed for a lock or load error). A refusal returns {"status": "rejected", "error"} (a push to this host is already in progress, too many retained jobs, or a config switch while a job runs).

Args: hostname: Target device hostname (must exist in config.ini) config_file: Path to .set or .j2 file (mutually exclusive with set_commands) set_commands: List of set commands (mutually exclusive with config_file) dry_run: If True (default), return the diff only; nothing is committed confirm_timeout: Minutes before auto-rollback (default 1) no_commit: Commit confirmed only, then let JUNOS roll back (see push_config) health_check: Health check commands after commit (see push_config; default ["uptime"]) config_path: Path to config.ini (empty string uses default search)

Fetch a push_config_start (or deadline-bound push_config) job by id.

status is running (keep polling; diff is present once computed), done (result holds the same text push_config returns: committed and permanent, no changes, or the intentional no_commit rollback), dry_run (result holds the diff; nothing committed), failed (result says why: lock/load error, failed health check, or a commit confirmed that is or may be pending and rolls back after confirm_timeout minutes), error (error holds the exception type name only; any unconfirmed commit rolls back after confirm_timeout minutes) or unknown (bad or expired id; finished jobs are kept for 10 minutes).

Report server version and config status — without connecting to any device.

Call this at session start (or after a tool-call timeout) to confirm the MCP is up, see which version is running, and verify that config.ini loads and how many routers it defines. Lightweight by design: junos-mcp fans out to many Juniper devices, so this check ONLY loads config.ini and counts hosts — it opens NO NETCONF/SSH connection to any device.

Always returns the same keys: status (healthy / error), service, version, config_path (the resolved config.ini path it would use), router_count (number of host sections in config.ini), tags (sorted list of distinct tags across configured hosts), and config (ok / error / missing). On an error result, detail carries the reason. There is no degraded state: this check either loads config.ini or it does not.

Args: config_path: Path to config.ini (empty string uses default search).