A router's client list, its DHCP leases and its ARP table describe the same network and routinely differ: a device with a lease that is not responding, a neighbour with no lease, a client the UI shows that the kernel does not. Collapsing them into one 'devices' tool would lose exactly the signal someone is looking for at two in the morning. The same instinct shows in the SSH diagnostic splitting reachability from banner from authentication, and in a capabilities tool that states its own guardrails up front. This inspects rather than configures — nothing here changes a setting — which for a home router reached by an agent is the right side of the line to be on.
An ASUSWRT diagnostic client that reaches the router over SSH and reports what it finds, across identity and health, network and addressing, wireless, administrative access, storage, and process and kernel state.
- asuswrt_capabilities returns the server's own guardrails and safe settings, so what it will and will not do is knowable before anything else is called.
- asuswrt_ssh_diagnostics separates TCP reachability, banner exchange and authentication — three different failures that otherwise present as one.
- The network picture in layers: LAN addressing and DHCP presence, WAN protocol with gateway and DNS, IPv6 prefix and router address, DHCP pool and static reservations, and NVRAM-reported DNS settings.
- Who is actually on it — connected clients, active dnsmasq leases and ARP neighbours read separately, because they disagree in useful ways.
- Security-relevant surface: web admin ports and processes, web, SSH and telnet access settings, listening TCP and UDP sockets, loaded kernel modules and scheduled cron jobs.
- Wireless radios with SSIDs and per-band connection counts, plus guest networks with their LAN-access state.
- Capacity and storage: per-interface RX and TX counters from the kernel, conntrack table usage against its limit, filesystem usage, mounts and partitions.
SSH access to the router, with SSH enabled on it. Everything here reads; the tool names are inspect, fetch and list throughout.
One command plus a key — uvx asuswrt-mcp, then supply credentials