Labsco
MCP SERVER

Netdev SSH MCP

by krisiasty ↗

Pull configs and run read-only show commands on switches, routers and firewalls over SSH, with the secrets hashed out before they reach the model.

Network, Endpoint & Fleet Management
Summary
Device configs an assistant can read without being handed your passwords.

The redaction is the design: secrets are hashed deterministically rather than stripped, so a config is safe to put in front of a model and still comparable against another device's.

What it is

An SSH read layer for network devices, covering Arista EOS, Cisco NX-OS, Cisco IOS/IOS-XE, Juniper JunOS and FortiGate FortiOS. Passwords, SNMP community names and BGP, OSPF, TACACS, RADIUS and IKE keys are replaced with deterministic hashes on the way out.

What you get
  • The running or startup configuration off a device, with every secret already redacted
  • The same secret always hashing to the same value, so two devices' configs stay diffable and identical hashes mean identical secrets
  • Operational read commands run and returned — show on Arista, Cisco and JunOS, get on FortiOS
  • Structured output where the platform supports it by appending | json, and | no-more to switch pagination off
  • Reachability checked from the device itself, with the outgoing interface selectable
Requirements

SSH reachability to the devices and an account on them; the username can come from the environment when it is not passed with the call, and the SSH port only needs naming when a device does not use the standard one. Reads only. Startup configuration is not available on JunOS or FortiOS.

Setup effort

One command plus a key — brew install --cask krisiasty/tap/netdev-ssh-mcp, then supply credentials