NetClaw

A CCIE-level AI network engineering coworker that runs on OpenClaw or Hermes, with 237 skills and 176 MCP integrations in its catalog. Investigate live networks, learn from your own documentation, coordinate specialist agents, and carry out approved changes with baselines, verification and an immutable audit trail. Available tools and HUD controls depend on the selected runtime and installed components.

Work from chat, the visual HUD, your phone, or a Zoom meeting. Start with one NetClaw, or build a risk of specialist NetClaws behind a single Border.

Start here: Choose a runtime · Install · Capabilities · RAG · GCF · Mobile · Zoom · VS Code · HUD · Jev

Project: Source version 1.9.0 — unpublished · Release notes · Contributing — numbered specs + Spec Kit · Changelog

VS Code: Install NetClaw or explore the VS Code Extension: a native workbench for your existing NetClaw, with Chat, Canvas, RAG, Testbed management, per-MCP configuration and reviewed security controls.

Reference: Architecture · MCP servers · Skills · Workflows · Safety

Hermes or OpenClaw?

Choose the agent runtime during installation. Both can use the shared NetClaw HUD for Chat, branching Canvas investigations, local Avatar and browser-owned conversation history. Your choice persists across launches; an existing OpenClaw installation keeps its default.

Hermes runtime installation includes the selected NetClaw MCP servers and skills. The protected HUD companion admits only reviewed tools: installing another MCP does not automatically enable it in HUD conversations. Attachments, configuration APPLY, per-conversation model/effort overrides and hosted Avatar are unavailable in this first Hermes HUD release. Local Avatar is supported. See the Hermes setup and capability guide.

Connection: the browser on :3000 talks to the HUD API on :3001. For Hermes, the API uses a private MCP bridge and an authenticated companion on loopback :8643; it does not connect directly to or restart your ordinary Hermes gateway. Hermes HUD acceptance passed on Mac and Ubuntu under Windows WSL2; native Windows uses WSL.

Spec 148 delivers the shared HUD connection. NetClaw 1.8.0 / spec149 adds Hermes iN2N/eN2N and Mobile Ask Border through protected execution. The initial qualified profile is subnet calculation; media attachments and production Hermes confinement remain unavailable. See setup, mobile versions and tested scope. Runtime installation details · Acceptance and exact tested platforms

The function-first HUD opens on standard Chat, with a Chat / Canvas interface switch, selected-runtime operations panels, Basic/Advanced presentation and detailed Jev views. OpenClaw also offers its native interface in a separate tab. Saved conversations survive refresh; runtime and usage indicators show available evidence rather than assumed values. See the HUD guide for the broader workspace.

RAG — answers grounded in your documents

Teach NetClaw your vendor guides, standards, customer designs and runbooks. Upload through Slack or the HUD RAG panel, ingest a local file, or preview a URL crawl before importing it. PDF, Markdown, HTML, text and modern Office formats are supported; legacy Office conversion uses optional LibreOffice.

Hybrid semantic and keyword search, local reranking and structure-aware chunks return cited passages with document, section and page context. Retrieval runs locally after the models are installed. NetClaw can refine a search within a bounded budget and report when the corpus cannot answer. Uploaded knowledge stays separate from the agent's experiential memory; captured network snapshots are opt-in and carry their age.

Try: “Using our uploaded design guide, explain the intended BGP policy and cite the relevant sections.” Then ask for a live device check to compare intent with current state.

Setup, formats and retrieval pipeline · Consented knowledge sharing between peers

GCF — compact network evidence

GCF gives participating MCP integrations a compact representation of structured tool results: tabular encoding for repeated records, graph encoding for topology, and optional session references and deltas for repeated queries. This reduces repetitive payload text so more useful network evidence can fit into a model's context. The serializer retains source data and falls back to JSON when encoding fails.

Choose NETCLAW_GCF_MODE=full, graph, generic or off; session/delta behavior also requires the caller to enable it. Savings depend on the payload and model. The recorded 1,000-node fixture used 98,859 graph-output characters versus 139,881 compact-JSON characters (about 29% less); serializer token counts use a characters/4 estimate, not a model tokenizer or a guaranteed billing reduction.

Optional: NETCLAW_TABULAR_FORMAT=bpp encodes flat, non-graph results (the payloads that would otherwise use the GCF generic profile) with bpp instead. It requires pip install bpp-format, is off by default, never affects graph, session or delta encoding, and falls back to GCF generic if bpp is missing or its round trip is not lossless.

Serializer and mode reference · Recorded benchmark · Reproduce the benchmark

NetClaw Mobile — your network in your pocket

The Flutter client brings the Border to iOS and Android. Enroll with a single-use QR token, ask by text or voice, scan a device QR/deep link, and receive answers with the responding claw identified. A dashboard, conversation history, feed and approvals view keep the operator connected away from the desk.

Resolve approval requests with device biometrics and attach camera/microphone captures to an investigation. The phone is an NCFED edge member with device-native capabilities; the Border handles agent reasoning. Explicit notifications can reach a connected phone, with platform push fallback when configured. Existing authorization and audit rules still apply.

Build, enroll and use Mobile · iOS release checklist · Android release checklist

Zoom — network investigations in the meeting

Bring NetClaw into an incident call through Zoom Realtime Media Streams. With listening enabled, transcript and chat context can trigger network investigations through the existing Border and specialist routing. The Zoom App side panel shows status and returned evidence, with an optional camera overlay.

Live meeting context and historical meeting search serve different purposes: RTMS supplies the current conversation; the official Zoom Meetings MCP can supply prior meeting context where configured. Historical connectivity is environment-dependent. Meeting requests retain the same device-write approval gates as other channels.

RTMS setup, tools and deployment boundaries · Meeting intelligence specification

Function-first HUD

Start with standard Chat, switch to Canvas for branching investigations, or open the native OpenClaw interface in a separate tab. The local operations workspace also provides Claw/MCP drill-downs, reported LLMs, Jev assessments, RAG uploads and retrieval, Tokenomics, service Logs, masked Configuration, Security mode/enforcement panels, and Documentation. Basic/Advanced presentation and optional Three.js views keep evidence accessible. See the HUD guide. The service remains local to the host; the new UI does not change its access controls.

VS Code Extension

Bring your existing NetClaw into Visual Studio Code. The NetClaw extension gives you a themed operations workbench alongside your code, configuration and documentation. It connects to the NetClaw you already run on OpenClaw or Hermes; available actions follow that runtime's capabilities.

Install: search Extensions for NetClaw by publisher NetClaw, or use:

code --install-extension NetClaw.netclaw

Use VS Code 1.102 or later on macOS or Linux. On Windows, open your intended WSL distribution and install the extension in WSL. Existing Remote SSH workspaces are supported; loopback addresses refer to the extension host. Browser VS Code and native Windows runtime hosting are not supported.

Start your NetClaw HUD, open the NetClaw Activity Bar, and choose Add existing NetClaw. Give the connection a friendly nickname such as My Mac lab, enter its HUD API address—normally http://127.0.0.1:3001—and review the returned installation identity. Start the updated HUD to enable full Testbed and scoped MCP editing; updating the extension alone cannot add those API routes.

Cards, labeled forms, search and filters follow light, dark and high-contrast editor themes. The interactive 3D BGP view uses reported sessions and includes an accessible list. It does not infer physical cabling or health.

Changes retain their review boundaries: Testbed saves do not connect devices, saved MCP configuration does not prove endpoint access, and stored security policy does not prove traffic enforcement. Supported actions depend on the installed runtime and native CLI capabilities.

VS Code 1.1.0 (Spec152): the upper Connections panel now opens the six runtime workspace Markdown files for reading, reviewed edits and upload/overwrite, with no delete. It also provides reviewed Start/Stop/Restart for the selected installation’s verified owned services, offline Start and Save & Restart. This is not in Marketplace 1.0.1. See workspace controls and prerequisites and verification. Source 1.11.0 supplies the required HUD discovery and native helper. See release verification and platform limits, including WSL regular-file acceptance and intentional symlink refusal.

Extension guide and setup · Privacy · Exact 0.1.1 qualification and platform scope

Resources

• NetClaw Overview — community guide

Quick Install

git clone https://github.com/automateyournetwork/netclaw.git
cd netclaw
./scripts/install.sh          # interactive installer — pick exactly what you want

Run it as your normal user — not with sudo. Under sudo, OpenClaw's config, your API keys, and all skills land in /root/.openclaw where your own openclaw can't see them. The installer refuses to run under sudo and instead asks before each specific command that needs root.

The installer opens an interactive TUI (pure bash — no dialog/whiptail needed): pick an install profile, then optionally fine-tune the exact MCP server list in an arrow-key checklist (Space to toggle, a all, n none). Only what you select gets installed.

Install profiles:

Scripted / non-interactive installs:

./scripts/install.sh --profile recommended        # any profile, no TUI
./scripts/install.sh --components "pyats netbox"  # exact component list
./scripts/install.sh --all                        # everything
./scripts/install.sh --list                       # see all components & profiles

The installer reports the host OS, version, architecture and component Python, then checks the selected components before installing packages or changing runtime configuration. Known unsupported components are disabled in the custom checklist; explicit selections and profiles fail with all detected blockers rather than silently dropping components. A full selection can therefore be blocked on macOS.

./scripts/install.sh --runtime hermes --preflight --components "forward panorama zabbix zoom-rtms"
./scripts/install.sh --preflight --all             # report all declared prerequisites; no installation

Preflight checks declared Python bounds, native SDK platforms, external commands, Forward's Go/CGO toolchain and Docker daemon availability. It does not prove package resolution or vendor connectivity. Existing Python 3.12 is preferred for component runtimes unless NETCLAW_PY is explicitly set; python3 on PATH must still be 3.10+. See Python compatibility and prerequisites.

Filled .env and first-time setup

You can fill credentials before installing: copy .env.example to .env in the NetClaw checkout, then edit and uncomment the settings you need. The installer imports supported settings into ~/.openclaw/.env before onboarding starts (~/.hermes/.env for Hermes). It resolves the checkout path regardless of where you run the installer. Existing runtime assignments, including empty ones, win; conflicts are listed by variable name without printing values.

Onboarding still chooses your provider, model, gateway and channels. Reuse detected credentials when the runtime offers that choice. Filling an API key does not supply those other choices. Onboarding failure now stops installation with an error instead of reporting completion.

For an existing installation, import without reinstalling components:

python3 scripts/import-env.py             # preview; writes nothing
python3 scripts/import-env.py --apply     # add missing runtime settings
# Hermes: add --runtime hermes to both commands

If OpenClaw has not been configured, continue with openclaw onboard --install-daemon. For an already-running gateway, run openclaw gateway restart to load newly imported settings. ./scripts/setup.sh also imports before its platform questions; skip platforms that are already configured. To replace an existing runtime value, edit the runtime .env deliberately; import never overwrites it.

The importer accepts single-line dotenv assignments declared in .env.example, keeps their literal syntax, skips blank values and obvious placeholders such as changeme/sk-ant-..., and never executes or expands them. Quote values containing #. Unknown names are reported for manual runtime configuration; malformed or multiline records fail before any write. Destination writes are atomic with mode 0600; symlinks are refused. Generated MCP launcher paths remain installer-managed. An inherited process variable can still take precedence over either dotenv file.

For a custom OpenClaw state directory, export OPENCLAW_STATE_DIR before import, installation and later OpenClaw commands; OPENCLAW_CONFIG_PATH can select its config file. For Hermes use HERMES_HOME. NetClaw retains its historical OPENCLAW_HOME state-directory fallback in the installer/importer; prefer OPENCLAW_STATE_DIR for consistency with upstream OpenClaw.

Current OpenClaw intentionally filters provider keys from a working-directory .env; the durable runtime file is the appropriate location for them. See OpenClaw environment precedence.

Agent runtime — OpenClaw or Hermes

NetClaw runs on top of an agent runtime. OpenClaw is the default. You can also run NetClaw on Hermes (Nous Research's self-improving agent). The interactive installer asks which runtime to use; scripted installs pick it explicitly:

./scripts/install.sh --runtime hermes --profile recommended
NETCLAW_RUNTIME=hermes ./scripts/install.sh --all

On a Hermes install the installer still deploys the same MCP servers, skills, SOUL, and platform credentials — NetClaw's MCP registrations (config/openclaw.json → mcpServers) are translated into Hermes' mcp_servers: block by scripts/openclaw-to-hermes-mcp.py (paths made absolute, ${VAR} resolved from the shared .env, merged non-destructively). Inspect the result with hermes mcp list.

Scope: the runtime choice covers install, onboarding, gateway, MCP registration, skills, credentials and the shared HUD. Hermes HUD conversations use the protected companion's qualified tools. Spec149 / 1.8.0 adds protected Hermes iN2N/eN2N execution and Mobile Ask Border. See qualification and compatibility; installed does not mean qualified.

For the shared HUD, install --runtime hermes --add "subnet-calc hermes-hud", then run ./scripts/netclaw hud select hermes "$HOME/.hermes" and ./scripts/netclaw hud. See Hermes HUD setup and limits. The eight-tool conversation bridge is HUD-private and excluded from agent-native registrations. Windows uses the Linux launcher inside Ubuntu on WSL2.

A Risk of NetClaws (iN2N)

A risk is the (real) collective noun for a group of lobsters — and NetClaw is a lobster. You can now run a risk of NetClaws: instead of one monolith carrying every skill, run a group of focused, specialized claws coordinated by a single Border Claw. You talk only to the Border; it routes each request to the member that owns the capability (a CML claw, a pyATS claw, an Azure claw…) and returns the result.

• Focus & token economy — each member carries only the skills it needs.
• Least privilege — each member gets only its integration's secrets.
• One door — the Border is the single interface, single external identity, and single audit trail; members dial it outbound (no ngrok, no mesh, no inbound ports — co-located or across clouds). Any provider/model per claw (incl. local Ollama). Cold/on-demand members spin up on first use.

At install you pick standalone, Border, or Member. This is the internal counterpart to N2N federation between different operators (eN2N). A classic standalone NetClaw is just "a risk of one, its own Border."

NCFED is documented as an IETF Internet-Draft — draft-capobianco-ncfed-00 (Experimental), specifying the wire protocol (BGP-multiplexed discrimination, 13-octet handshake, framing, eN2N consent + iN2N TOFU trust models) for the IETF agentproto effort: docs/ietf/draft-capobianco-ncfed-00.md.

Claw Certification (feature 060) closes the eN2N crypto gap: federation channels are TLS-encrypted and certificate-authenticated — domain-verified (ACME/Let's Encrypt via DNS-01, identity bound to a DNS name you own, not the tunnel) or pinned self-signed TOFU. The Border is its risk's CA so members verify the hub (mutual auth); credentials auto-rotate before expiry. Enable with N2N_CERT_MODE=on|enforce; existing claws upgrade in one command (scripts/patch-claw-certs.sh). New to peering? See docs/N2N-FEDERATION-GUIDE.md.

Production mode — enforced, honest, and durable (feature 057)

N2N_RISK_MODE=production enforces, fail-closed, rather than merely flagging. Layered, production-grade security — and posture that never lies:

• Member sandbox — host-level kernel confinement. Each member runs as a hardened systemd unit (NoNewPrivileges, ProtectSystem=strict, the operator's master .env made inaccessible, private /tmp, and syscall/namespace limits on native Linux); on-demand members cold-start in a transient hardened systemd-run unit. The member keeps its real tools/network but is kernel-confined. (OpenShell containers were evaluated and rejected for live-infra members — empty, egress-denied sandboxes; host confinement is what actually works.)
• Model-guard — DefenseClaw LLM guardrail proxy. Model I/O routes through the DefenseClaw Go proxy (:4000) for prompt/response inspection; member skill/MCP sets are DefenseClaw component-scanned before they run. If the guard is unavailable, delegations fail closed (no silent bypass to a direct provider).
• Audit — GAIT immutable git trail. Every delegation/enrollment/removal/ quarantine is committed to ~/.openclaw/n2n/gait/ (append-only) on both Border and member sides, cross-referenced to the SQLite audit.
• Least-privilege secrets by construction — each member gets only its integration's .env slice; the sandbox hides the master .env.
• Honest posture — testing / production — enforced / production — DEGRADED ( missing); never a false enforced claim. Per-control policy: containment gap (sandbox / model-guard) blocks; audit-only gap (GAIT) runs flagged audit-degraded; N2N_STRICT_ALL=1 blocks on any gap.
• Durable runtime — mesh daemon + always-on members as systemd --user services (Restart=always), generated by scripts/in2n-services.py; fault isolation distinguishes daemon vs member vs backend.
• A2A cards advertise the risk's posture and LLM capability (model + guarded flag) so federated peers see a neighbour's security + reasoning tier.

Token/context economy: the monolith loaded ~194 skills + ~37–52 MCP servers (hundreds–thousands of tool schemas) into every turn. A risk runs a lean Border (0 domain skills, ~32 broker tools) that routes to members carrying ~3 specialty skills + 1 vendor MCP each — roughly a 15–30× reduction in per-claw tool-schema context, plus tiered models (Opus Border, Sonnet/Haiku/Ollama members). See docs/N2N-RISK.md and specs/057-in2n-production-enforcement.

→ Full guide: docs/N2N-RISK.md · external peering: N2N-PEERING-NETCLAWS.md · already federated with a peer? docs/N2N-RISK-MIGRATION-FOR-PEERS.md

Whatever you pick, the installer then runs a two-phase setup:

Phase 1: openclaw onboard (OpenClaw's built-in wizard)

• Pick your AI provider (Anthropic, OpenAI, Bedrock, Vertex, 30+ options)
• Set up the gateway (local mode, auth, port)
• Connect channels (Slack, Discord, Telegram, WhatsApp, etc.)
• Install the daemon service

Phase 2: ./scripts/setup.sh (NetClaw platform credentials)

• Network devices (testbed.yaml editor)
• Platform credentials — only for the components you installed (your selection is remembered in ~/.openclaw/netclaw-components.conf)
• Your identity (name, role, timezone for USER.md)

After setup, start NetClaw:

openclaw gateway              # terminal 1
openclaw tui                  # terminal 2

Reconfigure anytime:

• openclaw configure — AI provider, gateway, channels
• ./scripts/setup.sh — network platform credentials
• ./scripts/install.sh — add or remove MCP servers (re-run keeps your current selection preselected)

Enterprise Security (DefenseClaw + OpenShell)

NetClaw includes enterprise-grade security via Cisco DefenseClaw and NVIDIA OpenShell:

Enable Security

# During install (recommended)
./scripts/install.sh
# Answer 'y' to "Enable DefenseClaw + OpenShell?"

# Or enable later
./scripts/defenseclaw-enable.sh

Run NetClaw Securely

# One-command secure startup (recommended)
./scripts/netclaw-secure-start.sh

# Then connect to sandbox:
openshell sandbox connect netclaw
export HOME=/sandbox
openclaw gateway run &
openclaw tui

# Or guardrails only (no container)
defenseclaw setup guardrail --mode action
claw

Full security guide >>>

Visual HUD

The capability catalogue covers currently 176 MCP integrations and 237 skills; configured entries are not proof of live connectivity.

The function-first HUD opens on standard Chat, with an operations dashboard and a preserved, branching Canvas workspace. Inspect internal Claws, mobile edges and external neighbours; drill into reported MCPs and LLM identities; compare Jev evidence; upload/search RAG; review token usage, estimates and budgets; inspect LAB/production mode, DefenseClaw and OpenShell; filter service logs; and browse guides, CLI declarations, MCP signatures and the HUD OpenAPI reference. Three.js views are optional companions to the panels and tables. Configured capabilities, recorded usage and estimates stay distinct from verified live state.

On Windows, start the gateway and Visual HUD together by double-clicking Start-NetClaw.cmd, or from PowerShell:

.\Start-NetClaw.ps1

The launcher verifies Node.js, npm, and OpenClaw; installs Visual HUD dependencies on the first run; avoids starting duplicate services; waits for the configured gateway port plus ports 3000 and 3001; and opens Canvas Chat. Use .\Start-NetClaw.ps1 -Interface HUD to open the main dashboard instead, or add -NoBrowser when you only want to start the services.

cd ui/netclaw-visual
npm install
npm run dev                   # then open http://localhost:3000

Requires the OpenClaw gateway to be running for live chat (openclaw gateway run). After updating your checkout, run scripts/upgrade-hud.sh --check from the repository root, then scripts/upgrade-hud.sh --apply to rebuild. Add --install-deps only when the lockfile dependencies need installation. This helper preserves configuration, security modes and Canvas storage; it does not pull Git or restart services.

HUD guide · Logging guide · Security modes · CLI/interface reference · HUD OpenAPI · Setup and legacy utilities

What It Does

Full platform capability overview

A CCIE-level AI network engineering coworker. Built on OpenClaw with Anthropic Claude, 237 skills, and 176 MCP integrations for complete network automation with ITSM gating, source-of-truth reconciliation, immutable audit trails, gNMI streaming telemetry, NetFlow/IPFIX flow telemetry, Canvas/A2UI inline network visualizations, packet capture analysis, GitHub config-as-code, GitLab DevOps (issues, merge requests, pipelines, repositories, wikis), Jenkins CI/CD (job monitoring, build triggering, log analysis, SCM tracking), Chrome DevTools browser automation (visualization render QA, controller GUI gap-filling, undocumented API discovery, headless or watchable-headed), Computer Use full-desktop automation (legacy desktop-only tools with no browser or API path, virtual XFCE desktop with VNC/noVNC Watch Mode), Cisco CML lab simulation, ContainerLab containerized network labs, Cisco NSO orchestration, Cisco SD-WAN vManage monitoring, Grafana observability (dashboards, Prometheus, Loki, alerting, incidents), Prometheus direct PromQL monitoring, Kubeshark Kubernetes traffic analysis, Cisco Meraki Dashboard management, Cisco ThousandEyes network intelligence, AWS and Azure cloud networking, Cisco Secure Firewall policy auditing, Check Point Security (15 MCPs: policy, threat intel, gateway, SASE, malware), Itential network orchestration, Juniper JunOS device automation, Arista CloudVision Portal monitoring, F5 BIG-IP pyATS iControl REST coverage, Infoblox DDI, Palo Alto Panorama, FortiManager, Batfish offline configuration analysis, UML diagram generation, EVPN/VXLAN fabric workflows, live BGP/OSPF control-plane participation, OSPF/IS-IS link-state and BGP topology analysis over stored Topolograph snapshots, nmap network scanning, gtrace path analysis and IP enrichment, Slack-native operations, Cisco WebEx-native operations, Microsoft 365 integration, Twilio voice/SMS, Twitter/X integration, Claroty OT/IoT asset management, Forward Networks digital twin, Ollama local LLM routing, an offline agentic RAG document knowledge base (cited answers from user-uploaded vendor guides and standards), layered Memory MCP, MemPalace persistent AI memory, and Lantronix Percepxion/SLC out-of-band console-server management (fleet-wide and direct single-device).

NetClaw is an autonomous network engineering agent powered by Claude that can:

• Monitor device health — CPU, memory, interfaces, hardware, NTP, logs — fleet-wide in parallel
• Troubleshoot connectivity, routing adjacencies, performance, and flapping using OSI-layer methodology with multi-hop parallel state collection
• Analyze routing protocols — OSPF (LSDB, LSA types, area design), BGP (11-step path selection, NOTIFICATION codes), EIGRP (DUAL states)
• Audit security posture — ACLs, AAA, CoPP, management plane hardening, CIS benchmarks, ISE NAD verification, NVD CVE scanning
• Discover topology via CDP/LLDP, ARP, routing peers — reconcile against NetBox cables
• Configure devices with full ITSM-gated change management — ServiceNow CR, baseline, apply, verify, rollback
• Reconcile NetBox or Nautobot source of truth against live device state — flag IP drift, undocumented links, missing interfaces; query Nautobot IPAM for IP addresses, prefixes, VRF/tenant/site filtering when the org uses Nautobot instead of NetBox
• Manage ACI fabric — health audits, policy analysis, safe tenant/VRF/BD/EPG changes with fault delta rollback
• Investigate endpoints via ISE — auth history, posture, profiling, human-authorized quarantine
• Audit Cisco Secure Firewall policies via FMC — search access rules by IP/FQDN, resolve FTD device policies, cross-FMC consistency checks, and SGT-based policy review
• Operate Infoblox DDI — inspect DNS zones and records, DHCP scopes and leases, and IPAM utilization before address-related changes
• Inspect Cisco Meraki infrastructure via Cisco's official remote MCP — 494 read-only Dashboard capabilities behind 2 tools: org inventory, networks, devices, wireless SSIDs, RF profiles, Air Marshal, switch ports and ACLs, MX L3/L7 firewall rules, site-to-site VPN, content filtering, security events, loss/latency history, and the configuration change audit. Writes are structurally absent upstream — changes are made in the dashboard
• Audit Palo Alto Panorama and FortiManager estates — policy search, device-group/ADOM/package review, NAT validation, and commit/install readiness checks
• Monitor network paths via Cisco ThousandEyes — synthetic test results, agent health, hop-by-hop path visualization (latency, loss, MPLS labels per hop), BGP route analysis (AS path, reachability, origin validation), outage investigation, anomaly detection, instant on-demand tests, endpoint VPN diagnostics, and AI-powered views explanations — via both community (9 tools, local stdio) and official (~20 tools, remote HTTP) MCP servers
• Access remote devices via Cisco RADKit cloud relay — discover device inventory, inspect device attributes and capabilities, execute CLI commands with timeout/truncation controls, and perform SNMP GET operations on air-gapped or cloud-unreachable devices without direct SSH/SNMP connectivity
• Automate Juniper JunOS devices via PyEZ/NETCONF — CLI command execution, configuration management, Jinja2 template rendering, device facts collection, and batch operations across router fleets
• Monitor Arista fabric via CloudVision Portal REST API — device inventory, event stream, connectivity monitor status, and device tag management for fleet-wide health assessment
• Monitor Cisco SD-WAN fabric via vManage API (read-only) — device inventory (vManage, vSmart, vBond, vEdge), WAN Edge serial/chassis details, device and feature templates, centralized policies, active alarms, audit events, interface statistics, BFD session health, OMP route analysis, DTLS/TLS control connections, and running config retrieval
• Observe infrastructure via Grafana (75+ tools) — search/view/modify dashboards, query Prometheus metrics with PromQL (interface traffic, CPU, BGP state, error rates, histogram percentiles), query Loki logs with LogQL (syslog, SNMP traps, application logs), manage alerting rules and contact points, track incidents with timeline activities, view OnCall schedules and current responders, annotate dashboards, render panel images, and generate deep links
• Query Prometheus directly (6 tools) — execute instant and range PromQL queries, browse available metrics with pagination, retrieve metric metadata (type, help, unit), inspect scrape target health and status, and verify Prometheus server availability. Supports basic auth, bearer tokens (Grafana Cloud, Thanos, Cortex), and multi-tenant org IDs
• Inspect Kubernetes traffic with Kubeshark (6 tools) — capture L4/L7 traffic across cluster pods, export pcaps for Wireshark analysis, create point-in-time snapshots, filter with KFL expressions, list TCP/UDP flows with RTT metrics, and get top-talker summaries. Automatic TLS decryption via eBPF. Dissects HTTP, gRPC, GraphQL, Redis, Kafka, DNS
• Observe network state with SuzieQ (5 tools) — query current and historical network state across 20+ tables, run BGP/OSPF/interface/EVPN assertions, get aggregated summaries, trace forwarding paths hop-by-hop, and discover value distributions. Time-travel queries for historical analysis
• Troubleshoot EVPN/VXLAN fabrics — VTEP reachability, VNI mapping, EVPN route-type inspection, multihoming state, and underlay/overlay correlation
• Participate in BGP and OSPF as a live routing peer — inject/withdraw routes, query RIB/LSDB, adjust LOCAL_PREF and OSPF cost, peer with real routers over GRE tunnels via native protocol speakers (RFC 4271/5340)
• Trace network paths with gtrace — advanced traceroute with MPLS label detection, ECMP path discovery, and NAT detection; continuous MTR monitoring with per-hop loss and jitter; distributed GlobalPing probes from 500+ worldwide locations; ASN ownership lookup, geolocation, and reverse DNS for IP enrichment
• Scan for CVE vulnerabilities against the NVD database with CVSS severity correlation and exposure confirmation
• Manage F5 BIG-IP load balancers — virtual servers, pools, iRules, stats, and change management
• Audit F5 BIG-IP via iControl REST API — LTM virtual servers, pools, nodes, 40+ monitor types, 60+ profile types, iRules, GTM wide IPs, system health (CPU, memory, disk), HA sync-status, certificates, analytics (HTTP, TCP, DNS, DoS), live-update signature freshness
• Operate Catalyst Center — device inventory, client monitoring, site management, and troubleshooting
• Calculate IPv4 and IPv6 subnets — VLSM planning, wildcard masks, allocation standards
• Alert via Slack — severity-formatted notifications, incident workflows, and user-aware routing
• Alert via Cisco WebEx — Adaptive Card-formatted notifications with interactive incident management buttons, threaded investigation, user-aware escalation via People API, and voice responses
• Diagram your network with Draw.io topology maps (color-coded by reconciliation status)
• Visualize protocol hierarchies as interactive Markmap mind maps
• Render inline Canvas/A2UI visualizations in chat — topology maps with health-colored nodes, real-time dashboards (CPU, memory, BGP, OSPF), severity-sorted alert cards, ServiceNow change request timelines, config/routing/ACL diffs, hop-by-hop path traces with ECMP and black hole detection, and aggregated health scorecards with drill-down
• Generate UML and infrastructure diagrams via Kroki — 27+ types including network topology (nwdiag), rack layouts (rackdiag), packet headers (packetdiag), protocol state machines, sequence diagrams, C4 architecture, Mermaid, D2, Graphviz, ERD — output as SVG, PNG, PDF
• Reference IETF RFCs and Wikipedia for standards-compliant configuration
• Store reports, config backups, and diagrams on SharePoint via Microsoft Graph
• Generate Visio topology diagrams from CDP/LLDP discovery and upload to SharePoint
• Notify via Microsoft Teams — health alerts, change updates, and report delivery to Teams channels
• Analyze packet captures — upload a pcap to Slack and NetClaw runs deep tshark analysis: protocol hierarchy, conversations, endpoints, DNS/HTTP extraction, expert info, and filtered inspection
• Track network changes in GitHub — create issues from findings, commit config backups, open PRs for changes, link to ServiceNow CRs
• Manage Jenkins CI/CD pipelines (16 tools via remote HTTP) — monitor job and build status, trigger parameterized builds with human-in-the-loop confirmation, analyze build logs with regex search, track SCM changes and correlate commits with builds, verify Jenkins health and authentication — via the official Jenkins MCP Server plugin (Streamable HTTP transport)
• Track Jira issues and Confluence pages (72 tools via stdio) — search issues with JQL, create and update issues with human-in-the-loop, transition through workflows, link issues, manage Confluence pages with CQL search, create postmortems and runbooks, cross-product incident-to-documentation workflows — via the community mcp-atlassian server (Cloud + Server/DC support)
• Orchestrate network services via Cisco NSO — retrieve device configs from NSO's CDB, check sync status, inspect operational state, discover service types and deployed instances, platform inventory, and NED management — all via RESTCONF from Slack
• Simulate network topologies in Cisco CML — create labs, add nodes, wire links, start/stop labs, execute CLI commands, capture packets on lab links, and manage CML users — all from natural language via Slack
• Deploy containerized network labs via ContainerLab — deploy multi-vendor topologies (SR Linux, cEOS, IOS XR, NX-OS, FRR, cRPD), inspect running labs, execute commands on nodes, and destroy labs when done — all through the ContainerLab API
• Inspect AWS cloud networking — VPCs, Transit Gateways, Cloud WAN, VPN tunnels, Network Firewalls, flow logs, ENI details, and route tables via 27 read-only AWS Network tools
• Monitor AWS CloudWatch — query metrics (VPN tunnel state, NAT GW drops, TGW traffic), check alarms, run Logs Insights queries, analyze VPC flow logs
• Audit AWS security — IAM users/roles/policies (read-only), CloudTrail API event history, credential rotation compliance, MFA enforcement
• Analyze AWS costs — service breakdowns, network cost drivers (NAT GW, TGW, VPN, data transfer), monthly trends, forecasts, anomaly investigation
• Diagram AWS architecture — auto-discover and render VPCs, subnets, TGWs, load balancers as visual topology diagrams (requires graphviz)
• Stream gNMI telemetry from Cisco IOS-XR, Juniper, Arista, and Nokia SR OS devices — structured YANG model queries, SAMPLE/ON_CHANGE subscriptions, ITSM-gated configuration changes, YANG capability browsing, and gNMI-vs-CLI state comparison
• Audit every action in an immutable Git-based trail (GAIT) — there is always an answer to "what did the AI do and why"
• Track token consumption and cost in real-time — every interaction displays input/output tokens, USD cost, and GCF savings. Session-level tracking with per-tool breakdown. Powered by Anthropic's count_tokens() API with local estimation fallback
• Encode tool responses with GCF (Graph Compact Format), with JSON fallback. Generic encoding is checked for a lossless round trip. Graph summaries and deltas retain a complete authoritative source snapshot so metrics, errors, timestamps, and other fields are never silently dropped. Savings depend on the payload and mode; earlier 91–99% figures described reduced graph projections, not complete operational evidence. Configure NETCLAW_GCF_MODE as full (default), graph, generic, or off.
• Remember across sessions with MemPalace — semantic search across all past sessions, temporal knowledge graph for network facts (upgrades, peer changes, maintenance windows) with validity windows, cross-domain navigation between wings, and per-agent diaries. Complements OpenClaw's file-based daily logs (memory/YYYY-MM-DD.md) with structured, searchable long-term memory — "GAIT records what happened. MemPalace remembers why."
• Secure production deployments with DefenseClaw — Cisco AI Defense enterprise security: OpenShell kernel-level sandbox (Landlock, seccomp, namespaces), component scanning before execution, CodeGuard static analysis, LLM prompt/completion inspection, runtime guardrails, SQLite audit logging with SIEM export (Splunk HEC, OTLP) for SOC2/PCI-DSS/HIPAA compliance

Enterprise Security

NetClaw includes DefenseClaw from Cisco AI Defense as the recommended enterprise security layer:

Enable DefenseClaw

# During installation
./scripts/install.sh
# Answer "y" to "Enable DefenseClaw (recommended)?"

# Or enable later
./scripts/defenseclaw-enable.sh

Key Commands

defenseclaw --version              # Check installation
defenseclaw skill scan       # Scan a skill before use
defenseclaw tool block       # Block a dangerous tool
defenseclaw alerts                 # View security alerts

Full documentation: docs/DEFENSECLAW.md | Security Principles | Upgrade Guide

Check Point Security Integration

NetClaw integrates with Check Point's enterprise security platform through 15 official MCP servers, providing AI-powered automation for firewall policies, threat intelligence, gateway diagnostics, SASE management, and malware analysis.

Enable Check Point Integration

# During installation
./scripts/install.sh
# Answer "y" to "Enable Check Point Security Integration?"

# Or enable for existing installation
./scripts/checkpoint-enable.sh

Example Queries

/checkpoint show me all firewall policies
/checkpoint check reputation of IP 185.220.101.1
/checkpoint show gateway health status
/checkpoint what IPS protections are available for CVE-2024-1234
/checkpoint cross-reference firewall rules with my CML lab topology

Full documentation: docs/CHECKPOINT.md | Skill Definition

Optional Jev Science Officer

Border can consult Jev for evidence review, specialist selection, answer review, diagnostic advice, change-plan review and incident triage. It invents typed questions from the current human request and member evidence, then explains whether Jev's assessment supported, challenged or changed the recommendation. Jev remains advisory; existing device and change-approval gates retain authority.

Enable the Jev Science Officer installer component and configure a TypeSafe key or compatible endpoint. Defaults are $5/day and $0.25/use case, with operator setup and settings overrides. Sanitized evidence is the default; additional private hosted disclosure needs exact scoped approval. See setup, privacy and interpretation. The RISK view shows the dedicated advisor separately from execution members.

Architecture

Human (Slack / WebEx / WebChat / Mobile / Zoom) --> NetClaw (CCIE Agent on OpenClaw)
                                |
                                |-- KNOWLEDGE & CONTEXT:
                                |     MCP: RAG             --> Local document retrieval with citations
                                |     GCF serializer       --> Compact table/graph evidence for participating MCPs
                                |
                                |-- EDGE & MEETINGS:
                                |     NCFED Mobile         --> Phone chat, notifications, biometrics, capture
                                |     Zoom RTMS + App      --> Meeting context, investigations, evidence panel
                                |
                                |-- SCIENCE OFFICER (optional):
                                |     MCP: Jev --> typed advisory probabilities / compatible endpoint
                                |                  dynamic questions; no execution authority
                                |
                                |-- DEVICE AUTOMATION:
                                |     MCP: pyATS           --> IOS-XE / NX-OS / IOS-XR devices
                                |     MCP: Juniper JunOS   --> PyEZ / NETCONF (CLI, config, templates)
                                |     MCP: F5 BIG-IP       --> iControl REST (virtuals, pools, iRules)
                                |     MCP: Catalyst Center --> DNA-C API (devices, clients, sites)
                                |     MCP: Arista CVP      --> CloudVision REST API (inventory, events, tags)
                                |
                                |-- gNMI TELEMETRY:
                                |     MCP: gNMI MCP        --> gNMI Get/Set/Subscribe/Capabilities (10 tools)
                                |                              IOS-XR, Juniper, Arista, Nokia via pygnmi
                                |
                                |-- INFRASTRUCTURE:
                                |     MCP: Cisco ACI       --> APIC / ACI fabric
                                |     MCP: Cisco ISE       --> Identity, posture, TrustSec
                                |     MCP: NetBox          --> DCIM/IPAM source of truth (read-write)
                                |     MCP: Nautobot        --> IPAM source of truth (5 tools, alternative to NetBox)
                                |     MCP: Infrahub        --> Schema-driven SoT, GraphQL, branches (10 tools)
                                |     MCP: ServiceNow      --> Incidents, Changes, CMDB
                                |
                                |-- MICROSOFT 365:
                                |     MCP: Microsoft Graph  --> OneDrive, SharePoint, Visio, Teams
                                |
                                |-- SECURITY & COMPLIANCE:
                                |     MCP: NVD CVE         --> NIST vulnerability database
                                |
                                |-- VERSION CONTROL:
                                |     MCP: GitHub           --> Issues, PRs, code search, Actions (Docker)
                                |
                                |-- PACKET ANALYSIS:
                                |     MCP: Packet Buddy     --> pcap/pcapng deep analysis via tshark
                                |
                                |-- NETWORK ORCHESTRATION:
                                |     MCP: Cisco NSO          --> Device config, sync, services via RESTCONF
                                |     MCP: Itential IAP       --> Config mgmt, compliance, workflows, lifecycle (65+ tools)
                                |
                                |-- FIREWALL SECURITY:
                                |     MCP: Cisco FMC          --> Access policy search, FTD targeting, multi-FMC
                                |     MCP: Check Point (15)   --> Policy, threat intel, gateway, SASE, malware (40+ tools)
                                |
                                |-- CLOUD-MANAGED NETWORKING:
                                |     MCP: Cisco Meraki       --> official remote MCP, 494 read-only capabilities via 2 tools
                                |
                                |-- NETWORK INTELLIGENCE:
                                |     MCP: ThousandEyes (community) --> Tests, agents, path vis, dashboards (9 tools, stdio)
                                |     MCP: ThousandEyes (official)  --> Alerts, outages, BGP, instant tests, endpoints (~20 tools, remote HTTP)
                                |
                                |-- REMOTE DEVICE ACCESS:
                                |     MCP: Cisco RADKit  --> Cloud-relayed CLI, SNMP, device inventory (5 tools, stdio)
                                |
                                |-- SD-WAN:
                                |     MCP: Cisco SD-WAN      --> vManage API (12 read-only tools: devices, templates, policies, alarms)
                                |
                                |-- OBSERVABILITY:
                                |     MCP: Grafana            --> Dashboards, Prometheus, Loki, alerting, incidents, OnCall (75+ tools via uvx)
                                |     MCP: Prometheus         --> Direct PromQL queries, metric discovery, target health (6 tools via pip)
                                |     MCP: Kubeshark          --> K8s L4/L7 traffic capture, TLS decryption, pcap export, flow analysis (6 tools, remote HTTP)
                                |     MCP: SuzieQ             --> Network state queries, assertions, summaries, path tracing (5 tools, stdio)
                                |
                                |-- PROTOCOL PARTICIPATION:
                                |     MCP: Protocol MCP      --> BGP/OSPF/GRE speakers (10 tools, scapy)
                                |
                                |-- LAB & SIMULATION:
                                |     MCP: Cisco CML         --> Lab lifecycle, topology, nodes, captures
                                |     MCP: ContainerLab      --> Containerized labs (SR Linux, cEOS, FRR) via API
                                |
                                |-- AWS CLOUD:
                                |     MCP: AWS Network        --> VPC, TGW, Cloud WAN, VPN, Firewall (27 tools)
                                |     MCP: AWS CloudWatch     --> Metrics, alarms, logs, flow log analysis
                                |     MCP: AWS IAM            --> Users, roles, policies (read-only)
                                |     MCP: AWS CloudTrail     --> API event audit trail
                                |     MCP: AWS Cost Explorer  --> Spending analysis, forecasts
                                |     MCP: AWS Diagram        --> Architecture visualization (graphviz)
                                |
                                |-- GCP CLOUD (remote HTTP):
                                |     MCP: Compute Engine     --> VMs, disks, templates (28 tools)
                                |     MCP: Cloud Monitoring   --> Metrics, alerts, time series (6 tools)
                                |     MCP: Cloud Logging      --> Log search, VPC flow logs, audit (6 tools)
                                |     MCP: Resource Manager   --> Project discovery (1 tool)
                                |
                                |-- INLINE VISUALIZATION:
                                |     Skill: Canvas A2UI   --> Topology maps, dashboards, alerts, timelines, diffs, paths, scorecards
                                |
                                |-- UTILITIES:
                                |     MCP: Subnet Calc     --> IPv4 + IPv6 CIDR calculator
                                |     MCP: GAIT            --> Git-based AI audit trail
                                |     MCP: Wikipedia       --> Technology context
                                |     MCP: Markmap         --> Mind map visualizations
                                |     MCP: Draw.io         --> Network topology diagrams
                                |     MCP: UML MCP         --> 27+ diagram types via Kroki
                                |
                                |-- COLLABORATION:
                                |     Channel: Slack         --> Bidirectional via WebSocket (OpenClaw built-in)
                                |     Channel: Cisco WebEx   --> Bidirectional via webhooks (@jimiford/webex plugin)
                                |     MCP: Microsoft Graph   --> Teams, SharePoint, OneDrive, Visio
                                |
                                '     MCP: RFC Lookup      --> IETF standards reference

OpenClaw Workspace Files

NetClaw ships with the full set of OpenClaw workspace markdown files. These are injected into the agent's system prompt at session start to define its identity, behavior, and operating procedures.

How they work: OpenClaw reads these files at session start and injects them under "Project Context" in the system prompt. Each file is capped at 20,000 characters. Sub-agents only receive AGENTS.md and TOOLS.md.

What to customize: Edit USER.md with your name, timezone, and preferences. Edit TOOLS.md with your device IPs, Slack channels, and site information. The rest define NetClaw's behavior and expertise — modify only if you want to change how the agent operates.

NetClaw Pal

The HUD's fourth Chat interface, Avatar, offers selectable local John and Lobster 3D characters beside the existing Chat, preserving its configured model, conversation and approvals. Rotate, pan and zoom the character; enable the Mac system voice for local audio-reactive animation. Cloned voice, dedicated microphone input and custom-avatar import are follow-on work. Tavus remains an experimental, disabled-by-default stock-video foundation with its own key, bounded Free allowance and restricted agent; live hosted acceptance is pending. See setup, recording guidance and limitations and spec 144.

MCP Servers (176)

Existing voice installations: complete the voice authentication migration before restarting the upgraded Twilio webhook service. Callbacks now require valid signatures; alert triggers require a separate bearer token.

FastMCP modernization: see the upgrade, rollback and compatibility guide for spec 141 and the remaining external exceptions.

Adding one? Follow docs/ADDING-AN-MCP.md and run python3 scripts/reconcile-mcp.py before pushing — CI enforces it.

Adding a new MCP server or skill? Run python3 scripts/verify-inventory-counts.py before opening your PR — it computes the true skill/MCP counts from the codebase and flags any documentation that has drifted out of sync, so these numbers don't need to be manually recounted (see spec 047 for details).

| 136 | Equinix Fabric + Network Edge | Official MCP | stdio policy/OAuth bridge to HTTP | Provider inventory and gated create/update/actions. No delete tools. Guide | | 137 | Tavus Pal | Built-in (tavus-pal-mcp) | stdio (Python, isolated venv; HUD-invoked) | Optional stock-face voice companion; one pal_query tool targets an all-tools-denied NetClaw agent. No main-agent registration or device access. Guide |

Additional Server Notes

All MCP servers communicate via stdio (JSON-RPC 2.0) through scripts/mcp-call.py, except where noted below (HTTP/remote endpoints).

• HumanRail — FastMCP streamable HTTP (Python) on port 8100 (git clone + pip install "mcp[cli]>=1.0.0" httpx + python3 server.py); auth via HUMANRAIL_API_KEY Bearer token. Public hosted endpoint also available at https://humanrail.dev/mcp — set HUMANRAIL_MCP_URL=https://humanrail.dev/mcp to skip local install. Get a free API key at humanrail.dev
• GitHub — runs via Docker
• CML — pip-installed (cml-mcp)
• NSO — pip-installed (cisco-nso-mcp-server)
• FMC — runs as an HTTP server on port 8000
• Cisco Meraki (official) — remote HTTP, 494 read-only Dashboard capabilities via semantic_search + execute_api
• ThousandEyes — community MCP via stdio (9 read-only tools); official MCP is a remote HTTP endpoint hosted by Cisco at https://api.thousandeyes.com/mcp (~20 tools via npx mcp-remote)
• RADKit — FastMCP stdio with certificate-based cloud relay auth (5 tools for remote device access)
• Nautobot — MCP SDK stdio (5 IPAM tools, alternative to NetBox)
• Infrahub — stdio (10 tools for schema-driven SoT, GraphQL queries, and versioned branches)
• Itential — pip-installed (itential-mcp), stdio (65+ tools for network automation orchestration)
• JunOS — stdio (10 tools for PyEZ/NETCONF device automation)
• Arista CVP — uv/stdio (4 tools for CloudVision Portal device inventory, events, connectivity monitoring, and tag management)
• UML — stdio (2 tools for 27+ diagram types via Kroki multi-engine rendering)
• Protocol — stdio (10 tools for live BGP/OSPF/GRE control-plane participation using scapy-based protocol speakers)
• ContainerLab — stdio (6 tools for containerized network lab lifecycle management via ContainerLab API)
• SD-WAN — stdio (12 read-only tools for Cisco SD-WAN vManage fabric monitoring)
• Grafana — uvx mcp-grafana (75+ tools for dashboards, Prometheus, Loki, alerting, incidents, OnCall)
• Prometheus — pip-installed (prometheus-mcp-server), stdio (6 tools for direct PromQL queries, metric discovery, and scrape target health)
• Kubeshark — remote HTTP endpoint running inside a Kubernetes cluster (6 tools for L4/L7 traffic capture, pcap export, flow analysis, and TLS decryption via eBPF; access via kubectl port-forward svc/kubeshark-hub 8898:8898)
• nmap — FastMCP stdio (14 tools for host discovery, port scanning, service/OS detection, NSE scripts, and vulnerability scanning with CIDR scope enforcement and audit logging)
• gtrace — gtrace mcp stdio (6 tools for advanced traceroute with MPLS/ECMP/NAT detection, MTR continuous monitoring, GlobalPing distributed probes, ASN lookup, geolocation, and reverse DNS)
• AWS — uvx (uv tool runner)
• GCP — remote HTTP endpoints hosted by Google (OAuth 2.0 auth)
• AAP Enterprise — 4 independent servers via uv run stdio: Controller (45 tools for inventories, jobs, projects, ad-hoc commands, Galaxy), EDA (12 tools for event-driven activations, rulebooks, decision environments), ansible-lint (9 tools for playbook/role validation and best practices), and Red Hat Docs (documentation search with domain validation)
• fwrule — uv run fwrule-mcp stdio (3 tools for multi-vendor firewall rule overlap, shadowing, conflict, and duplication analysis across 9 vendors using 6-dimensional set intersection)
• SuzieQ — stdio (5 read-only tools for network state queries, assertions, summaries, unique value discovery, and path tracing across 20+ network tables via the SuzieQ REST API)
• GNS3 — FastMCP stdio (26 tools for GNS3 network lab management — projects, nodes, links, packet capture, and snapshots via REST API v3). No persistent connections, no port management
• RAG Knowledge Base — FastMCP stdio (10 tools for the offline document knowledge base: multi-format ingestion via Slack/HUD/URL, hybrid dense+BM25 retrieval with local reranking and mandatory citations, HIIL-gated corpus management, opt-in secret-scrubbed snapshots). Data at ~/.openclaw/rag/, fully offline after install, strictly separate from Memory MCP
• Topolograph (topolograph-mcp) — remote HTTP endpoint against the operator's own Topolograph instance (TOPOLOGRAPH_MCP_URL, default https://topolograph.com/mcp), bearer TOPOLOGRAPH_API_TOKEN. 27 read-only tools: 13 for OSPF/IS-IS link-state topology analysis over stored snapshots — path computation, failure simulation, MPLS-TE/CSPF, event timeline — plus 14 for BGP topology (speakers, sessions, route search, VRF/VPN inventory, BGP-to-IGP graph binding; requires Topolograph >= 2.69). Mutation tools are hidden server-side (TOPOLOGRAPH_MCP_READ_ONLY=true); the client allowlist is set with defenseclaw tool allow (see spec 119, spec 120)
• Zoom RTMS (zoom-rtms-mcp) — FastMCP stdio, 9 tools (see spec 118). Ingests live meeting transcript/chat/active-speaker/screen-share signals via Zoom's Realtime Media Streams (no Meeting SDK bot — Zoom reserves that for human participants), recognizes network-investigation questions with a deterministic extractor, and routes them into the existing Border/NCFED routing path via a new loopback-only bgp/federation/zoom_channel.py channel. Feeds a Zoom App side panel (avatar + live status + evidence) with an optional Layers API camera overlay. Pairs with the official Zoom Meetings MCP (remote/OAuth, historical meeting search) via the zoom-meeting-context skill. No new device-write approval mechanism — reuses NetClaw's existing gate unchanged for anything a meeting participant asks that would change configuration.

Skills (237)

Jev Science Officer (6)

Questions are authored dynamically; none of these skills executes a network change.

pyATS Device Skills (9)

pyATS Linux Host Skills (3)

pyATS JunOS Skills (3)

pyATS ASA Firewall Skills (1)

pyATS F5 BIG-IP Skills (2)

Domain Skills (10)

F5 BIG-IP Skills (3)

Catalyst Center Skills (3)

Microsoft 365 Skills (3)

GitHub Skills (1)

Packet Analysis Skills (1)

nmap Network Scanning Skills (3)

gtrace Path Analysis & IP Enrichment Skills (2)

Cisco CML Skills (5)

ContainerLab Skills (1)

GNS3 Skills (5)