automateyournetwork/netclaw.

aap-automation

Red Hat Ansible Automation Platform — inventory management, job template execution, project SCM sync, ad-hoc commands, host management, Galaxy content discovery. Use when automating infrastructure with Ansible, running playbooks, managing inventories, or searching for Ansible collections and roles.

aap-eda

Event-Driven Ansible (EDA) — activation lifecycle, rulebook management, decision environments, event stream monitoring. Use when managing event-driven automation triggers, enabling/disabling activations, or reviewing EDA rulebooks.

aap-lint

ansible-lint playbook and role validation — syntax checking, best practice enforcement, project-wide analysis, rule filtering. Use when validating Ansible playbooks, checking code quality, or enforcing automation best practices before deployment.

aci-change-deploy

Safe ACI policy change deployment - ServiceNow CR lifecycle, pre/post-change fault baselines, APIC policy application, automatic rollback on fault delta, and GAIT audit trail. Use when deploying ACI policy changes, creating tenants or EPGs, pushing config to APIC, or running a change window with rollback protection.

aci-fabric-audit

Comprehensive Cisco ACI fabric health audit - node status, tenant/VRF/BD/EPG policy review, contract analysis, fault triage, and endpoint learning verification. Use when auditing ACI fabric health, checking for faults, reviewing tenant policies, or running pre/post-change baselines on APIC.

arista-cvp

Arista CloudVision Portal (CVP) automation via REST API — device inventory, events, connectivity monitoring, tag management (4 tools). Use when managing Arista devices, checking CloudVision events, monitoring network connectivity probes, or tagging devices in CVP.

aruba-cx-config

View and manage Aruba CX switch configurations, perform ISSU upgrades, and firmware operations

aruba-cx-interfaces

Monitor Aruba CX switch interface status, LLDP neighbors, and optical transceiver health

aruba-cx-switching

View and manage Aruba CX switch VLANs and MAC address tables for Layer 2 operations

aruba-cx-system

Discover Aruba CX switch system information, firmware versions, and VSF topology

atlassian-itsm

IT Service Management workflows using Jira for issue tracking and Confluence for documentation

aws-cloud-monitoring

AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance. Use when checking AWS alarms, analyzing VPC flow logs, investigating network latency, or monitoring VPN and NAT Gateway metrics.

aws-cost-ops

AWS Cost Explorer — spending analysis, service breakdowns, forecasts, cost anomalies. Use when analyzing AWS spending, investigating cost spikes, reviewing network cost drivers like NAT Gateway, or forecasting next month's bill.

aws-network-ops

AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN tunnel status.

aws-security-audit

AWS security auditing — IAM users/roles/policies, CloudTrail API events, security posture analysis. Use when auditing IAM permissions, investigating security incidents, checking MFA compliance, or tracing API activity in CloudTrail.

azure-network-ops

Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets, troubleshooting hybrid connectivity (ExpressRoute/VPN), checking NSG rules, inspecting firewall policies, or analyzing load balancer health.

azure-security-audit

Azure NSG compliance auditing and security posture assessment. CIS Azure Foundations Benchmark rules, effective security rule analysis, orphaned NSG detection. Use when auditing Azure NSGs for CIS compliance, checking for overly permissive rules, or reviewing effective security on NICs.

batfish-config-analysis

Batfish network configuration analysis -- pre-deployment validation, reachability testing, ACL/firewall tracing, differential analysis, compliance checking. Use when validating configs before deployment, testing traffic paths, tracing ACL rules, comparing config versions, or auditing compliance policies. Strictly read-only.

blender-3d-viz

Create 3D network topology visualizations in Blender from CDP/LLDP neighbor data

canvas-network-viz

Canvas/A2UI inline network visualizations — topology maps, health dashboards, alert cards, change timelines, config diffs, path traces, and health scorecards rendered directly in the OpenClaw chat interface. Consumes existing MCP server data (pyATS, Grafana, Prometheus, ServiceNow, SuzieQ, Batfish) and outputs A2UI JSON for Canvas rendering. Use when the operator asks to see a network map, device dashboard, alert summary, change request timeline, config diff, forwarding path trace, or health scorecard.

catc-client-ops

Catalyst Center client operations and monitoring - list/filter wired and wireless clients, detailed client lookup by MAC, client count analytics, time-based analysis, SSID and band filtering, wireless troubleshooting. Use when looking up a client by MAC or IP, counting clients per site or SSID, analyzing wireless band distribution, or investigating Wi-Fi signal issues.

catc-inventory

Catalyst Center device inventory and site management - list/filter devices by hostname, IP, platform, family, role, reachability; view site hierarchy; get interface details per device; device reachability monitoring; cross-reference with pyATS. Use when listing network devices, checking device reachability, auditing software versions, viewing site hierarchy, or finding a device by serial number.

catc-troubleshoot

Catalyst Center troubleshooting workflows - device unreachable investigation, client connectivity issues, interface down analysis, site-wide outage triage, wireless roaming problems, integration with pyATS for CLI-level diagnostics. Use when a device is unreachable, a user reports connectivity problems, an interface is down, a site has an outage, or wireless clients have roaming issues.

clab-lab-management

ContainerLab network lab lifecycle management — authenticate, list, deploy, inspect, execute commands on, and destroy containerized network labs via the ContainerLab API. Use when deploying containerized network labs, spinning up SR Linux or cEOS topologies, running commands on lab nodes, or tearing down test environments.

cloudflare-analytics

Access Cloudflare traffic analytics, logs, and Radar global Internet insights.

cloudflare-dns

Manage Cloudflare DNS zones and records with analytics insights.

cloudflare-security

Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.

cloudflare-zerotrust

Inspect Cloudflare Zero Trust access applications, policies, tunnels, and CASB findings.

cml-admin

CML administration — user/group management, system info, licensing, resource monitoring. Use when creating CML users, checking license status, monitoring CML server resources, or auditing lab usage across teams.

cml-lab-lifecycle

Cisco CML lab lifecycle management — create, start, stop, wipe, delete, clone, import/export labs. Use when building a network lab, starting or stopping a CML lab, cloning a topology, or importing lab YAML files.

cml-node-operations

CML node operations — start, stop, console access, CLI execution, config management, node details. Use when starting or stopping a CML node, running show commands on a lab router, setting startup configs, or reading console logs.

cml-packet-capture

CML packet capture — start, stop, download pcaps from CML lab links, integrate with Packet Buddy for analysis. Use when capturing packets in a CML lab, troubleshooting BGP or OSPF with packet analysis, or downloading pcap files for Wireshark review.

cml-topology-builder

Build CML topologies — add nodes, create interfaces, wire links, set link conditioning, add annotations. Use when building a network topology in CML, adding routers or switches to a lab, wiring links between nodes, or simulating WAN conditions.

datadog-apm

Analyze distributed traces and service performance in Datadog APM.

datadog-incidents

Manage incidents in Datadog Incident Management.

datadog-metrics

Query metrics and explore dashboards in Datadog.

defenseclaw-ops

Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails

devnet-catalyst-search

Search Cisco Catalyst Center API documentation for device management and policy automation

devnet-meraki-search

Search Cisco Meraki API documentation and lookup specific operations

drawio-diagram

Generate draw.io network diagrams — native .drawio files with CLI export (PNG/SVG/PDF), plus browser-based Mermaid/XML/CSV via MCP server. Use when creating network topology diagrams, generating architecture visuals, exporting diagrams to PNG or PDF, or building draw.io files from discovery data.

eve-lab-topology-build

Build or rewire EVE-NG lab topology. Use when creating or deleting virtual networks, connecting node interfaces to networks, inspecting topology links, checking interface mappings, or listing available node templates before wiring a lab.

eve-lab-topology-design

Design EVE-NG lab topology and coordinate the design workflow. Use when the user asks for lab design, architecture advice, topology planning, design review, or a build plan, especially when requirements, trade-offs, or validation need to be structured first.

eve-lab-topology-discovery

Gather missing requirements for EVE-NG topology design. Use when the request is vague or incomplete, when you need discovery questions, defaults, trade-off framing, image recommendations, or domain guidance before proposing a topology.

eve-lab-topology-validation

Validate EVE-NG topology designs and enforce final delivery structure. Use when reviewing a design, checking build readiness, producing the final design output, building an implementation plan, or running topology QA before implementation.

eve-ng-config-ops

Manage EVE-NG startup configurations stored in lab files. Use when exporting configs natively into the lab, reading embedded startup configs, pushing startup config before boot, clearing config without full NVRAM wipe, or bulk-checking stored configs after lab changes.

eve-ng-console-ops

Execute live CLI commands on running EVE-NG nodes over telnet console. Use when running show commands, making live config changes, verifying protocol state, testing connectivity, checking console readiness, or interacting with IOS, Junos, VPCS, EOS, or NX-OS nodes.

eve-ng-lab-management

Manage EVE-NG labs and platform inventory. Use when listing labs, checking lab metadata, creating or deleting labs, importing or exporting lab archives, checking EVE-NG health or auth, or verifying available node images before build work.

eve-ng-node-operations

Manage EVE-NG node lifecycle. Use when listing nodes, checking runtime state, creating or deleting nodes, starting or stopping nodes or whole labs, verifying node details, or wiping node NVRAM back to factory defaults.

evpn-vxlan-fabric

EVPN/VXLAN fabric audit and troubleshooting — VTEPs, VNIs, route types, multihoming, underlay/overlay validation. Use when troubleshooting VXLAN overlay reachability, auditing leaf-spine fabric health, debugging silent hosts or asymmetric flooding, or validating anycast gateway and ESI multihoming state.

f5-config-mgmt

F5 BIG-IP configuration management - safe change workflow with baseline capture, planning, creation/update/deletion of virtual servers, pools, iRules, and profiles with full verification. Use when creating or modifying F5 virtual servers, adding pool members, deploying iRules, performing blue-green traffic shifts, or rolling back a BIG-IP change.

f5-health-check

F5 BIG-IP health monitoring - virtual server status, pool member health, log analysis, performance statistics, and systematic health assessment. Use when checking F5 load balancer health, running a pre-change or post-change validation, investigating pool member failures, or auditing SSL certificate expiration.

f5-troubleshoot

F5 BIG-IP troubleshooting - virtual server failures, pool member health, connection issues, SSL/TLS problems, iRule errors, persistence issues, and performance degradation. Use when a VIP is not responding, pool members are marked down, users report SSL errors, the application is slow, or iRule TCL errors appear in logs.

fmc-firewall-ops

Cisco Secure Firewall FMC — access policy search, rule inspection, FTD device targeting, multi-FMC profile management. Use when searching firewall rules by IP or FQDN, checking if host A can reach host B through the firewall, auditing FMC access policies, or reviewing SGT-based segmentation rules.

fortimanager-ops

FortiManager operations — ADOM inventory, policy package review, object search, install preview, and compliance workflows. Use when auditing FortiGate firewall policies, reviewing ADOM policy packages, validating firewall path rules, or planning a FortiManager package install with rollback.

fwrule-analyzer

Multi-vendor firewall rule analysis — overlap detection, shadowing, conflict identification, duplication checking across PAN-OS, ASA, FTD, IOS/IOS-XE, IOS-XR, Check Point, SRX, Junos, Nokia SR OS, and Fortinet FortiOS/FortiGate. Use when validating firewall rule changes, auditing rulesets for conflicts, or normalizing vendor configs to a common schema.

gait-session-tracking

GAIT session lifecycle management - branch creation, turn recording, audit logging for every NetClaw operation. Use when starting a new NetClaw session, recording a health check or config change, pinning a pre-change baseline, or viewing the audit trail for a troubleshooting session.

gcp-cloud-logging

Google Cloud Logging — log search, VPC flow logs, firewall logs, audit logs, log buckets and views. Use when searching GCP logs, investigating denied VPC flow traffic, checking who deleted a VM, analyzing firewall rule hits, or troubleshooting a GCP application error.

gcp-cloud-monitoring

Google Cloud Monitoring — time series metrics, alert policies, active alerts, metric discovery. Use when checking GCP network performance, investigating firing alerts, querying VM CPU or memory metrics, reviewing Cloud VPN tunnel status, or assessing load balancer latency.

gcp-compute-ops

Google Cloud Compute Engine — VM instances, disks, templates, instance groups, reservations, project discovery. Use when listing GCP VMs, troubleshooting a Compute Engine instance, checking disk attachments, planning capacity with reservations and commitments, or managing instance groups.

gitlab-devops

GitLab DevOps operations — issues, merge requests, CI/CD pipelines, repository browsing, labels, milestones, releases, and wiki management. Use when querying GitLab project status, monitoring pipeline executions, browsing repository files, creating issues for network findings, opening merge requests for config changes, or managing project metadata.

gnmi-telemetry

gNMI streaming telemetry operations for multi-vendor network devices. Query device state via structured YANG model paths, subscribe to real-time telemetry streams, apply ITSM-gated configuration changes, browse YANG capabilities, and compare gNMI data against CLI output.

gns3-link-management

Manage GNS3 links - connect/disconnect node interfaces, isolate nodes

gns3-node-operations

Manage GNS3 nodes - add from templates, start/stop/suspend/reload, console access

gns3-packet-capture

Capture network traffic on GNS3 links - start/stop captures, retrieve PCAP data

gns3-project-lifecycle

Manage GNS3 network lab projects - create, open, close, delete, clone, export/import

gns3-snapshot-ops

Manage GNS3 project snapshots - create, restore, delete for safe experimentation

grafana-observability

Grafana observability platform — dashboards, Prometheus PromQL, Loki LogQL, alerting, incidents, OnCall schedules, annotations, datasource queries, panel rendering (75+ tools). Use when querying Grafana dashboards, running PromQL for interface metrics, searching Loki logs for syslog events, investigating firing alerts, or checking who is on call.

gtrace-ip-enrichment

IP address enrichment — ASN ownership lookup, geolocation (city/region/country/coordinates), and reverse DNS resolution. Use when identifying who owns an IP address, locating an IP geographically, resolving reverse DNS for a traceroute hop, or enriching unknown IPs from logs or flow data.

gtrace-path-analysis

Network path tracing and monitoring — traceroute with MPLS/ECMP/NAT detection, continuous MTR monitoring, and distributed GlobalPing probes from 500+ worldwide locations. Use when tracing the path to a destination, diagnosing slow network routes, detecting MPLS or ECMP load balancing, running MTR for intermittent packet loss, or testing reachability from global vantage points.

humanrail-escalation

Human-in-the-loop escalation via HumanRail — route low-confidence agent decisions, pre-destructive operation approvals, and ambiguous incident tickets to real human engineers. Human answers are verified and returned as structured output. Workers are paid via Lightning Network. Use when the agent is uncertain, when a destructive change needs explicit human sign-off beyond a ServiceNow CR, or when an ambiguous ticket requires human triage before automated handling.

infoblox-ddi

Infoblox DDI operations — DNS zones/records, DHCP scopes and leases, IPAM networks and address utilization. Use when checking DNS records, validating IPAM address allocation, investigating DHCP scope exhaustion, verifying reverse DNS for network devices, or reconciling Infoblox with NetBox or Nautobot.

infrahub-sot

OpsMill Infrahub — infrastructure source of truth with versioned branches, schema-driven nodes, GraphQL queries, relationship traversal. Use when querying Infrahub for device inventory, browsing infrastructure schemas, creating a branch for a change proposal, running GraphQL queries against Infrahub, or reconciling Infrahub data with live device state.

ipfix-receiver

Receive and query IPFIX and NetFlow flow records from network devices via UDP.

ise-incident-response

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident. Use when a SOC alert flags a compromised endpoint, an unauthorized device is detected on the network, an endpoint is doing port scanning or lateral movement, or you need to quarantine a MAC address in ISE.

ise-posture-audit

Cisco ISE posture and policy audit - authorization rules, posture compliance, profiling gaps, TrustSec SGT matrix, active session health. Use when running a periodic ISE compliance audit, reviewing authorization policies for over-permissiveness, checking TrustSec segmentation, assessing endpoint profiling accuracy, or preparing for SOC2 or PCI-DSS review.

itential-automation

Itential Automation Platform (IAP) — network automation orchestration, device configuration management, compliance enforcement, workflow execution, golden config, lifecycle management, and gateway services via 65+ MCP tools. Use when automating network changes through Itential, running compliance plans, deploying golden configs, or orchestrating IAP workflows

jenkins-cicd

Jenkins CI/CD pipeline management — monitor builds, trigger pipelines, analyze logs, and track SCM changes for network automation workflows.

junos-network

Juniper JunOS device automation via PyEZ/NETCONF — CLI execution, configuration management, Jinja2 template rendering, device facts, batch operations, config diff and rollback comparison (10 tools). Use when managing Juniper routers, pushing JunOS configs, running show commands on Juniper devices, or comparing rollback versions

kubeshark-traffic

Kubeshark Kubernetes traffic analysis — L4/L7 deep packet inspection, TLS decryption, pcap export, flow analysis, service mapping (6 tools). Use when capturing Kubernetes pod traffic, debugging service-to-service latency, exporting pcaps from a cluster, or analyzing encrypted east-west traffic

markmap-viz

Create interactive mind map visualizations from markdown - network inventory, OSPF areas, BGP topology, security audit results. Use when visualizing network topology as a mind map, creating audit result diagrams, or generating hierarchical views of OSPF areas, BGP peers, or VLAN structures

mempalace

MemPalace AI memory — persistent memory across sessions. Search past decisions, store architecture choices, track temporal network facts via knowledge graph, navigate cross-domain connections, maintain specialist agent diaries. Use when recalling past decisions, storing important context, tracking network changes over time, or maintaining operational journals.

meraki-monitoring

Cisco Meraki Monitoring & Diagnostics — live ping, cable test, LED blink, wake-on-LAN, camera analytics, config change tracking. Use when running ping tests from Meraki devices, troubleshooting switch port cables, blinking LEDs to identify hardware, checking camera analytics, or auditing Meraki config changes

meraki-network-ops

Cisco Meraki Dashboard — organization inventory, network management, device lifecycle, client discovery, action batches. Use when listing Meraki devices, managing networks, checking device status, investigating clients, or running bulk Meraki API operations

meraki-security-appliance

Cisco Meraki Security Appliance (MX) — firewall rules, site-to-site VPN, content filtering, traffic shaping, security events. Use when auditing Meraki MX firewall rules, troubleshooting site-to-site VPN tunnels, managing content filtering, or investigating Meraki security events and IDS alerts

meraki-switch-ops

Cisco Meraki Switching — port configuration, VLANs, port status, ACLs, QoS rules, port cycling. Use when configuring Meraki switch ports, creating VLANs, checking port status and PoE, troubleshooting switch connectivity, or managing Meraki ACLs and QoS

meraki-wireless-ops

Cisco Meraki Wireless — SSID management, RF profiles, channel utilization, signal quality, client connectivity events. Use when managing Meraki SSIDs, troubleshooting WiFi connectivity, analyzing RF channel utilization, checking wireless signal quality, or investigating client roaming issues

msgraph-files

Manage files on OneDrive and SharePoint via Microsoft Graph API - upload, download, list, search, and organize network documentation and artifacts. Use when uploading reports to SharePoint, retrieving network docs from OneDrive, organizing config backups, or searching for topology diagrams

msgraph-teams

Send notifications and reports to Microsoft Teams channels via Graph API - alert delivery, report posting, incident updates, and diagram sharing. Use when posting health alerts to Teams, sending security notifications, sharing change completion updates, or delivering reports to a Teams channel

msgraph-visio

Generate and manage Visio network diagrams on SharePoint via Microsoft Graph API - create topology diagrams from CDP/LLDP discovery, update existing diagrams, export to PDF. Use when creating Visio topology diagrams, uploading network diagrams to SharePoint, or generating physical/logical topology views from discovery data

nautobot-sot

Nautobot IPAM & source of truth — IP address queries, prefix lookups, VRF/tenant/site filtering, IPAM search, connection testing. Use when looking up IP addresses in Nautobot, checking subnet allocations, querying IPAM by VRF or tenant, or validating Nautobot as the network source of truth

netbox-reconcile

Reconcile NetBox source of truth against live network state - detect IP drift, missing interfaces, undocumented links, cable mismatches, VLAN mismatches, and ticket discrepancies in ServiceNow. Use when validating NetBox accuracy, checking for config drift, auditing network documentation, or reconciling source of truth after changes

nmap-network-scan

Host discovery and port scanning using nmap — ICMP/ARP host discovery, SYN/TCP/UDP port scanning with scope enforcement and audit logging. Use when discovering live hosts on a subnet, scanning for open ports, verifying firewall rules, or doing pre/post-change port scans

nmap-scan-management

Custom nmap scans with arbitrary flags, plus scan history retrieval and management. Use when running nmap with custom flags, reviewing past scan results, comparing before/after scans, or retrieving a previous scan by ID

nmap-service-detection

Service fingerprinting, OS detection, NSE script execution, and vulnerability scanning using nmap MCP. Use when identifying services on open ports, fingerprinting OS versions, running NSE scripts for SSL or SMB checks, or scanning for known CVEs and vulnerabilities

nso-device-ops

Cisco NSO device operations — config retrieval, state inspection, sync, platform info, NED IDs, device groups. Use when retrieving device configs from NSO, checking sync status, pulling platform inventory, or inspecting NSO device groups and NED drivers

nso-service-mgmt

Cisco NSO service management — discover service types, list service instances, orchestrate network services. Use when listing NSO services, checking service health, auditing deployed service instances, or asking what services NSO can provision.

nvd-cve

Search the National Vulnerability Database for CVEs - find vulnerabilities by keyword or ID, get CVSS scores, weaknesses, affected configurations, and remediation references. Use when looking up a CVE, scanning for vulnerabilities, running a security audit, or checking if a software version has known exploits.

packet-analysis

Analyze network packet captures (.pcap/.pcapng) using Packet Buddy MCP. Use when opening a pcap file, inspecting packet captures, troubleshooting network traffic, analyzing retransmissions, or filtering packets by protocol.

pagerduty-incidents

Manage and investigate incidents in PagerDuty.

pagerduty-oncall

Manage on-call schedules and escalation policies in PagerDuty.

pagerduty-orchestration

Manage event orchestration and routing rules in PagerDuty.

pagerduty-services

Manage service catalog and service health in PagerDuty.

paloalto-panorama

Palo Alto Panorama operations — device groups, templates, security policy search, NAT review, commit status, and audit workflows. Use when searching Palo Alto firewall rules, checking if traffic is allowed through Panorama, reviewing NAT policies, or auditing device groups.

prisma-sdwan-apps

View Prisma SD-WAN application definitions for policy visibility

prisma-sdwan-config

Inspect Prisma SD-WAN interfaces, routing (BGP, static), policies, and security zones

prisma-sdwan-status

Monitor Prisma SD-WAN element health, software versions, events, and alarms

prisma-sdwan-topology

Discover Prisma SD-WAN sites, ION elements, machines, and network topology

prometheus-monitoring

Prometheus monitoring — PromQL instant/range queries, metric discovery, metadata, scrape target health, system health checks (6 tools). Use when querying Prometheus metrics, checking scrape targets, investigating alert thresholds, or analyzing network device utilization trends.

protocol-participation

Live BGP and OSPF control-plane participation — peer with real routers, inject/withdraw routes, query RIB/LSDB, adjust metrics, GRE tunnel status. Use when injecting or withdrawing BGP routes, checking BGP peer state, querying the OSPF LSDB, or testing route advertisement in a lab.

pyats-asa-firewall

Cisco ASA firewall operations via pyATS — VPN sessions, failover state, interfaces, routing, service policies, resource usage, AnyConnect monitoring. Use when checking ASA failover status, monitoring VPN sessions, auditing ASA security, or troubleshooting AnyConnect connectivity.

pyats-config-mgmt

Network change management - pre-change baselines, configuration deployment, post-change verification, rollback procedures, and compliance validation. Use when pushing config to a device, planning a network change, rolling back a configuration, or running compliance checks.

pyats-dynamic-test

Generate and execute deterministic pyATS aetest validation scripts - interface state, OSPF neighbors, BGP paths, ping matrices, and custom compliance tests. Use when writing a network test, validating post-change state, running pass/fail checks, or building automated regression tests.

pyats-f5-ltm

F5 BIG-IP LTM/GTM operations via pyATS iControl REST — virtual servers, pools, nodes, monitors, profiles, iRules, persistence, GTM wide IPs, DNS, data groups. Use when checking F5 virtual server status, auditing pool members, reviewing iRules, or inspecting GTM wide IP health.

pyats-f5-platform

F5 BIG-IP platform operations via pyATS iControl REST — system, networking, HA/CM, auth, analytics, security, APM, live-update, ADC certs, file management. Use when checking BIG-IP system health, verifying HA sync status, auditing certificates, or inspecting F5 platform resources.

pyats-health-check

Comprehensive network device health monitoring - CPU, memory, interfaces, hardware, NTP, logging, environment, and uptime analysis. Use when running a device health check, monitoring CPU or memory usage, checking interface errors, or validating NTP sync.

pyats-junos-interfaces

JunOS interface operations via pyATS — physical/logical interfaces, LACP, CoS, LLDP, ARP, BFD, IPv6 neighbors, traffic monitoring, optics diagnostics. Use when checking Juniper interface status, auditing LACP members, inspecting optics power levels, or reviewing ARP and LLDP neighbors.

pyats-junos-routing

JunOS routing operations via pyATS — OSPF/OSPFv3, BGP, route table, MPLS/LDP/RSVP, TED, PFE, ping, traceroute across Juniper devices. Use when checking Juniper OSPF neighbors, viewing BGP summary, inspecting MPLS LSPs, tracing routes, or auditing the JunOS route table.

pyats-junos-system

JunOS system operations via pyATS — chassis health, hardware inventory, system info, NTP, SNMP, files/logs, firewall counters, DDoS protection, services accounting. Use when checking Juniper chassis alarms, auditing hardware inventory, reviewing system uptime, or inspecting JunOS firewall counters.

pyats-linux-network

Linux host network operations via pyATS — interface configuration, routing tables, network connections, and multi-table route inspection across fleet hosts. Use when checking Linux interface status, viewing routing tables, auditing host network config, or comparing routes across hosts.

pyats-linux-system

Linux host system operations via pyATS — process monitoring, filesystem inspection, Docker container stats, package/tool verification across fleet hosts. Use when checking running processes, monitoring Docker containers, inspecting log files, or verifying system tools on Linux hosts.

pyats-linux-vmware

VMware ESXi host operations via pyATS — VM inventory, snapshot management, hypervisor inspection across ESXi hosts in the testbed. Use when listing VMs on ESXi, checking snapshot age, auditing VMware inventory, or verifying pre-change snapshots exist.

pyats-network

Network device automation via pyATS - run show commands, ping, apply config, learn config/logging, list devices, run Linux commands, execute dynamic tests on Cisco IOS-XE/NX-OS devices. Use when running CLI commands on routers or switches, checking interface status, applying configuration changes, or collecting device data via pyATS.

pyats-parallel-ops

Fleet-wide parallel device operations - concurrent health checks, config audits, routing snapshots, severity-sorted reporting, and failure-isolated multi-device automation. Use when checking all devices at once, running bulk health checks, collecting configs from the entire fleet, or comparing state across multiple routers and switches.

pyats-routing

CCIE-level routing protocol analysis - OSPF, BGP, EIGRP, IS-IS, static routes, RIB/FIB verification, redistribution audit, and convergence validation. Use when analyzing routing tables, debugging OSPF neighbors, checking BGP peering, verifying route redistribution, or validating convergence after changes.

pyats-security

Network security audit - ACLs, AAA, control plane policing, management plane hardening, encryption, port security, and CIS benchmark checks. Use when auditing device security posture, checking compliance, hardening a router or switch, reviewing access lists, or investigating unauthorized access.

pyats-topology

Network topology discovery via CDP/LLDP neighbors, ARP tables, routing peers, and interface mapping to build complete network maps. Use when mapping the network, building a diagram, discovering what is connected to what, or documenting device neighbors and links.

pyats-troubleshoot

Systematic network troubleshooting - connectivity, routing, interface, protocol, and performance issues using structured OSI-layer and divide-and-conquer methodology. Use when something is broken, a device is unreachable, a link is flapping, users report slow performance, or an OSPF/BGP adjacency is down.

radkit-remote-access

Cisco RADKit — cloud-relayed remote device access, CLI execution, SNMP polling, device inventory discovery, attribute inspection. Use when accessing remote network devices through a cloud relay, running CLI on air-gapped devices, polling SNMP metrics remotely, or discovering device inventory via RADKit.

rfc-lookup

Search and retrieve IETF RFC documents - lookup by number, search by keyword, extract sections. Use when looking up an RFC, checking protocol specifications, verifying standards compliance, or researching how a protocol should behave per the spec.

sdwan-ops

Cisco SD-WAN vManage read-only operations — fabric devices, WAN Edge inventory, templates, policies, alarms, events, interface stats, BFD sessions, OMP routes, control connections, running config. Use when checking SD-WAN fabric health, viewing vManage alarms, auditing SD-WAN policies and templates, or troubleshooting BFD tunnels.

servicenow-change-workflow

Full ITSM-gated change lifecycle - CR creation, pre-change incident validation, approval gate, execution via pyats-config-mgmt, post-change verification, and closure with GAIT audit trail. Use when creating a change request, making a network change that needs approval, tracking change management, or following ITIL change process.

slack-incident-workflow

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in Slack, tracking incident status, or running a post-incident review.

slack-network-alerts

Format and deliver network alerts, health warnings, and critical notifications via Slack with rich formatting, reactions, and file attachments. Use when sending alerts to Slack, posting health check results, notifying the team about a device issue, or formatting network status updates for a channel.

slack-report-delivery

Deliver formatted network reports, audit results, topology diagrams, and compliance documentation to Slack channels with rich Block Kit formatting. Use when posting a health check report, sharing a security audit, delivering topology diagrams, or sending scheduled network reports to Slack.

slack-user-context

Leverage Slack user profiles, presence, DND status, and workspace context to personalize responses, route escalations, and coordinate team operations. Use when checking who is on-call, routing an escalation, personalizing responses based on user role, or respecting Do Not Disturb before paging someone.

slack-voice-interface

Respond to Slack voice clips with both text and an MP3 voice reply using edge-tts. Voice IN is already handled by OpenClaw transcription. Use when a user sends a voice message in Slack, you need to reply with audio, or you want to generate a spoken MP3 response.

snmptrap-receiver

Receive and query SNMP traps from network devices via UDP.

splunk-indexes

Discover and inspect Splunk indexes and configuration.

splunk-saved

Manage and run saved searches in Splunk.

splunk-search

Execute and validate SPL (Search Processing Language) queries.

subnet-calculator

IPv4 and IPv6 subnet calculator - CIDR breakdown, usable hosts, previous/next subnets, address classification, VLSM planning, and dual-stack analysis. Use when calculating subnets, figuring out how many hosts fit in a prefix, planning IP addressing, getting wildcard masks for ACLs, or checking if two IPs are in the same subnet.

suzieq-observability

SuzieQ network observability — query current and historical network state, run validation assertions, get summary statistics, trace forwarding paths, and discover unique values across 20+ network tables. Use when investigating BGP/OSPF state, checking interface health, performing time-travel queries, validating network assertions, or tracing packet paths through the network via SuzieQ.

syslog-receiver

Receive and query syslog messages from network devices via UDP.

te-network-monitoring

Cisco ThousandEyes — test management, agent inventory, test results, dashboards, path visualization, user/account management. Use when checking ThousandEyes test results, viewing network monitoring dashboards, listing agents, investigating alerts, or assessing overall network performance.

te-path-analysis

Cisco ThousandEyes — path visualization, BGP route analysis, outage investigation, instant tests, endpoint agent diagnostics. Use when tracing network paths hop-by-hop, investigating why a site is slow, analyzing BGP route changes, diagnosing an internet outage, or troubleshooting VPN from endpoint agents.

telemetry-ops

Comprehensive network telemetry and event collection across multiple protocols.

terraform-operations

Execute local Terraform operations with ServiceNow change control.

terraform-registry

Discover providers and modules from the Terraform Registry.

terraform-workspaces

Manage HCP Terraform (Terraform Cloud/Enterprise) workspaces.

token-tracker

Track and display token consumption and cost for every NetClaw interaction.

uml-diagram

UML and diagram generation via Kroki — class, sequence, activity, state, component, deployment, network, ER, C4, Mermaid, D2, Graphviz, BPMN, 27+ types. Use when generating a network diagram, creating a sequence diagram, drawing a rack layout, visualizing a protocol state machine, or producing architecture documentation.

vault-mounts

Discover and manage HashiCorp Vault secret engine mounts.

vault-pki

Manage HashiCorp Vault PKI certificate infrastructure.

vault-secrets

Manage HashiCorp Vault KV secrets with strict value protection.

webex-incident-workflow

Manage network incident response workflows in Cisco WebEx - incident spaces, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in WebEx, tracking incident status, or running a post-incident review.

webex-network-alerts

Format and deliver network alerts, health warnings, and critical notifications via Cisco WebEx with Adaptive Cards, markdown formatting, and file attachments. Use when sending alerts to WebEx spaces, posting health check results, notifying the team about a device issue, or formatting network status updates for a WebEx space.

webex-report-delivery

Deliver formatted network reports, audit results, topology diagrams, and compliance documentation to WebEx spaces with Adaptive Cards and markdown formatting. Use when posting a health check report, sharing a security audit, delivering topology diagrams, or sending scheduled network reports to WebEx.

webex-user-context

Leverage WebEx user profiles, presence status, and workspace context to personalize responses, route escalations, and coordinate team operations. Use when checking who is available, routing an escalation, personalizing responses based on user role, or determining engineer availability before paging someone.

webex-voice-interface

Respond to WebEx voice clips with both text and an MP3 voice reply using edge-tts. Voice IN is already handled by OpenClaw transcription. Use when a user sends a voice message in WebEx, you need to reply with audio, or you want to generate a spoken MP3 response.

wikipedia-research

Research networking protocols, standards history, and technology context via Wikipedia - OSPF, BGP, MPLS, 802.1X, VXLAN, and more. Use when looking up protocol background, researching how a technology works, building reference material for the team, or understanding standards history.

zscaler-identity

Manage users, groups, departments, and identity provider configurations.

zscaler-insights

Access analytics, threat intelligence, and security event data.

zscaler-zdx

Monitor digital experience scores, user performance, and application health.

zscaler-zia

Manage Zscaler Internet Access firewall rules, URL filtering, DLP, and security policies.

zscaler-zpa

Manage Zscaler Private Access applications, segments, policies, and connectors.