get_configLABSCO SUMMARY
Device configs an assistant can read without being handed your passwords.
The redaction is the design: secrets are hashed deterministically rather than stripped, so a config is safe to put in front of a model and still comparable against another device's.
What it is
An SSH read layer for network devices, covering Arista EOS, Cisco NX-OS, Cisco IOS/IOS-XE, Juniper JunOS and FortiGate FortiOS. Passwords, SNMP community names and BGP, OSPF, TACACS, RADIUS and IKE keys are replaced with deterministic hashes on the way out.
What you get
- The running or startup configuration off a device, with every secret already redacted
- The same secret always hashing to the same value, so two devices' configs stay diffable and identical hashes mean identical secrets
- Operational read commands run and returned — show on Arista, Cisco and JunOS, get on FortiOS
- Structured output where the platform supports it by appending | json, and | no-more to switch pagination off
- Reachability checked from the device itself, with the outgoing interface selectable
Requirements
SSH reachability to the devices and an account on them; the username can come from the environment when it is not passed with the call, and the SSH port only needs naming when a device does not use the standard one. Reads only. Startup configuration is not available on JunOS or FortiOS.
Setup effort
One command — brew install --cask krisiasty/tap/netdev-ssh-mcp
USE CASES
01
Diffing two devices that should be identical
Pull both configs — the hashed secrets compare cleanly, so a real difference stands out instead of being buried under redaction markers.
02
Working out why a route is not there
Run the routing and BGP show commands with | json and read structured output rather than parsing a screen.
03
Auditing what is actually deployed
Read the running configuration off each device with secrets already hashed — safe to keep, and safe to show the model.
04
Checking reachability from the device, not from your laptop
Ping from the device itself and choose the outgoing interface, which is the test that matches where the traffic will actually come from.
05
Taking inventory across mixed vendors
One command tool covers Arista, Cisco, Juniper and FortiGate, so version and inventory reads do not need a different script per platform.
5 tools
Listed in project docs. Your client may show a different list.
run_show_commandrun_pingrun_traceroutetrust_host_keyBEFORE YOU INSTALL
What to know first
Tools you get
5 tools named in the project's documentation.
Requires
- SSH access to the devices and an account on them
- An SSH agent (SSH_AUTH_SOCK) or DEVICE_PASSWORD — either one is enough
- Homebrew on macOS for the cask, or Go 1.26 or later to build from source
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
macOS: brew install --cask krisiasty/tap/netdev-ssh-mcp (binary lands at $(brew --prefix)/bin/netdev-ssh-mcp)
OR build from source (requires Go 1.26 or later):
TERMINAL
go build -o netdev-ssh-mcp .OR after building, install it system-wide:
TERMINAL
sudo install -m 0755 netdev-ssh-mcp /usr/local/bin/Add the mcpServers block to .mcp.json (Claude Code) or claude_desktop_config.json (Claude Desktop), with command set to the full binary path — alternatively register globally: claude mcp add netdev-ssh-mcp <YOUR_PATH_TO_BINARY>
Provide SSH auth: either an SSH agent (SSH_AUTH_SOCK) or export DEVICE_PASSWORD; optionally export DEVICE_USERNAME to avoid passing username on every call
MCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"netdev-ssh-mcp": {
"command": "<YOUR_PATH_TO_BINARY>",
"env": {
"DEVICE_USERNAME": "admin"
}
}
}
}<YOUR_PATH_TO_BINARY> is the full path to netdev-ssh-mcp ($(brew --prefix)/bin/netdev-ssh-mcp after a Homebrew install). admin is a sample; yours is your SSH username on the devices.
These blocks authenticate through your SSH agent. To use a password instead, add DEVICE_PASSWORD to the env block. Claude Code also reads it from the shell it is started in, so there you can export DEVICE_PASSWORD instead; Claude Desktop does not inherit your shell environment, so there it has to be in the env block.
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"netdev-ssh-mcp": {
"command": "<YOUR_PATH_TO_BINARY>",
"env": {
"DEVICE_USERNAME": "admin",
"SSH_AUTH_SOCK": "/private/tmp/<YOUR_COM_APPLE_LAUNCHD>/Listeners"
}
}
}
}<YOUR_PATH_TO_BINARY> is the full path to netdev-ssh-mcp ($(brew --prefix)/bin/netdev-ssh-mcp after a Homebrew install). admin is a sample; yours is your SSH username on the devices. The SSH_AUTH_SOCK value is the output of echo $SSH_AUTH_SOCK in your terminal. Claude Desktop does not inherit your shell environment, so the SSH agent socket has to be written here.
These blocks authenticate through your SSH agent. To use a password instead, add DEVICE_PASSWORD to the env block. Claude Code also reads it from the shell it is started in, so there you can export DEVICE_PASSWORD instead; Claude Desktop does not inherit your shell environment, so there it has to be in the env block.
