Describe verified capabilities and the activation boundary.

List installed HCL model defaults, with file evidence and firmware boundaries.

Read one installed model's default interfaces; never claim guest CLI verification.

Validate intent and, by default, require a connected declared wired topology.

Use Comware interface names, not .net scene port keys. Validation does not prove firmware support, deployment or actual network connectivity. configuration checks individual intents without requiring one wired component.

Read the pinned mapping and API differences against current MCP discovery.

Probe the local HCL backend; never infer GUI or CLI control from it.

Create an isolated HCL project for safe live-gate verification.

List HCL projects immediately under configured project roots.

Read devices and links from one saved HCL project without changing it.

Copy a project, add a device cloned from a known model, and optionally link it.

Copy a project and add a reciprocal link between two free ports.

List the observed backend verbs, their evidence level and gating state.

Read-only and offline: it never opens a socket. The verb list comes from HCL's own logs, not from vendor documentation.

Open, inspect or close the backend topology session (state-changing).

The wrapper keys its topology to the connection, so opening keeps one connection alive and reuses it for hcl_device_power. At most one session is held at a time.

action is open, close or status. open needs topology and a working_directory inside a configured project root.

Power one device on through the observed backend verb (gated).

Requires an open session from hcl_backend_topology: the wrapper keys the topology to the connection, so a one-shot request is answered with errorCode=228. Only power-on was observed - no stop verb exists in the logs, so on=False is reported as unsupported rather than guessed.

Send one line to a device console over HCL's telnet bridge (gated).

Supply either pipe (\\.\pipe\<topology>-device<N> or telnet://127.0.0.1:<30001..31024>) or topology plus device; the default endpoint for a topology is the telnet bridge HCL publishes for that device. Output that arrived before the command is drained and reported as discarded_stale_bytes so stale console text cannot be mistaken for this request's answer.

Compile a validated plan into a separate .net project using real source models.

Replaces source devices/notes in the copy. Every linked CLI port needs an explicit model-to-scene map. Command transcripts stay outside startup configs. No GUI open, VM creation, power, CLI deployment or connectivity is claimed by a staged result.

Read the documented native NIC mode and fixed profiles; model compatibility is unverified.

List deterministic HCL-native graph templates.

Build a deterministic plan from a strict TopologyRequest; never deploy.

Use the same planner to count devices, links, addresses and services.

Explain a valid saved plan and its evidence boundaries without an LLM.

Return a repaired copy; preserve manually supplied addresses and services.

Generate documented Comware templates for ten typed services, offline only.

Generate a declarative HCL operation manifest; executable=false until live adapters are accepted.

Atomically export an offline plan/config/operation bundle under the output root.

Hash-check and reload an exported plan; never open the HCL GUI.

Open a staged .net in an existing SimwareClient (write-gated); no guest boot or CLI deployment.

Verify the active staged project identity, save it and parse the saved files (write-gated).

Plan and compile an isolated HCL project, optionally open it in an existing GUI.

activate defaults false. No VM power or CLI deployment occurs. Offline builds support durable idempotency; live activation is never replayed.

Rename one device and both ends of its saved links in a new project copy.

Move one saved device in an isolated project copy; no live canvas mutation.

Remove one saved device and reciprocal links from a separate project copy.

Remove exactly one reciprocal saved link from an isolated copy.

Append a bounded note in the observed .net representation to a copy.

Remove observed NOTE blocks only; preserve unknown drawing/Non-vBox data.

Create and test a native running-config backup for a bound staged device (gated).

Restore a tested native backup and compare the complete running configuration (gated).

Back up all staged devices before deployment; restore modified devices on failure (gated).

Parse bounded actual ping statistics from a bound staged console; never infer success from exit status.

Read bound running-device interface state; empty device inspects all staged devices.

Link/cable inventory remains unverified, so only_linked=true is rejected.

Read detailed native VLAN state from one bound staged device; no default or capacity guesses.

Read native user-defined traffic classes, behaviors and policies from one bound device.

Compare planned addresses with freshly bound guest observations.

Missing/extra live devices and a positive in_sync remain unknown until an authoritative native topology inventory is available.

Read interface anomalies and repeated addresses from staged running guests.

Carrier state does not prove cabling; healthy remains unknown.

Audit bound running Comware configuration posture without exporting credentials.

Empty device selects staged non-PC bindings, not a complete native canvas inventory. Unsupported Cisco rules and unknown storage algorithms prevent a secure=true verdict.

Apply/remove a scoped NetStream destination with local exporter-name identity.

Named NetFlow monitor/object equivalence and actual collector delivery remain unverified.

Apply per-VLAN rapid spanning-tree priority and selected edge/guard intent.

Native PVST, root-selection and global BPDU protection are not full IOS equivalence claims.

Apply bounded secure-MAC/shutdown intent on one existing access port.

Refuses unproved IOS protect/restrict mappings and unrequested authentication or learned-state conversion.

Tune requested interface bandwidth and OSPF fields with scoped readback and saved recovery.

Serial clock and IOS delay mappings remain unavailable; encrypted authentication values are partial. Secrets are omitted from operation receipts and previews.

Apply static, dynamic or interface/pool PAT intent to one staged router.

Uses recorded ACL/pool identities, bounded backup/readback/persistence and same-VM recovery. Comware outbound semantics and pool ranges do not prove IOS ingress-role/netmask equivalence.

Remove exact NAT mappings, binding and optional unshared ACL/pool resources.

Reused operation keys return recorded receipts without replaying device commands.

Remove one exact numbered/named ACL and optional IPv4 binding with backup, scope and startup readback.

Named types may be resolved from the actual config; unrelated definitions and bindings remain protected.

Apply scoped VLAN/access/trunk/router subinterface changes across staged devices.

All targets and backups precede changes; persistence and recovery stay bound to each VM.

Apply one strict Comware numbered or named ACL after identity, backup and restore preflight.

Changes only requested rules/bindings; readback and unrelated scope checks are mandatory.

Apply strict single-device VLAN/port/SVI intent with backup, readback and recovery.

Native trunk membership is replaced with the exact requested allowed VLAN set.