Loading ToolBench
Multi-vendor network automation, read-only. Covers Cisco IOS/IOS-XE/NX-OS/IOS-XR, Juniper Junos, Arista EOS, HPE Aruba (AOS-CX, AOS-Switch, Central), Cisco Meraki, Fortinet FortiOS and Palo Alto Networks PAN-OS. This server never changes a device.
netauto exposes 11 network automation tools with consistent naming (net_* prefix) and reasonable descriptions (avg ~150 chars). All tools are read-only, which is a strong safety posture. However, schemas are incomplete: most parameters lack type definitions beyond string, and output schemas are not formally documented. Error handling returns JSON with error/message fields but lacks recovery guidance. Parameter descriptions are present but generic (e.g., 'inventory name of the device' repeated across tools). No enum constraints on platform or kind parameters despite known valid values. Tool composition is sound, each tool has one responsibility, but descriptions could better explain WHEN to use each tool vs. alternatives.
Run the hardening ruleset against one device or a tagged group. Checks telnet exposure, SSH version, management-plane encryption, default SNMP communities, time sources and remote logging, using rules scoped to each platform's own syntax.
Diff a candidate configuration against what is on the device. Read-only: this shows what would change and commits nothing. Volatile lines and secrets are normalised out so the diff reflects real intent.
Connect to a host that has no inventory entry and run a read-only command. The target must be an address net_discover_local found in this process within the last hour, and never one routable on the internet, because connecting offers this server's credentials to whatever answers.
Connect to a device and return vendor, model, OS version, serial and hostname.
Discover live hosts on a directly attached network by ARP. ARP is authoritative on a local segment: hosts answer it even when they drop ICMP. Requires arp-scan on the host running this server. Hosts already in the inventory come back with "known_as" set, so what is left is what nobody has documented.
No enum constraints on platform or kind parameters. 'kind' accepts 'running|startup|candidate' but is defined as free-form string; 'platform' accepts vendor names but has no constraint. LLMs will hallucinate invalid values.
Output schemas not formally documented. Tools return JSON with varying structures (e.g., net_list_devices returns {count, devices[]} but net_device_facts returns {error, message} on failure). LLMs cannot plan downstream calls without knowing response shape.
Error responses lack recovery guidance. Errors return {error, message} but do not suggest next steps. E.g., 'Device not found' should suggest 'Call net_list_devices to see available devices.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2026-07-28+ | v2 |
Retrieve a device configuration as text.
List inventory devices, optionally filtered by tag or platform.
Run one read-only command on a device. The command is checked against a per-vendor allowlist. Anything that could change state, or that chains multiple commands, is rejected before it is sent.
Check which management ports given hosts answer on. A plain TCP connect per host and port, plus whatever banner the service volunteers -- SSH names its software before the client speaks, which is often enough to tell what the far end is. Nothing is sent, so nothing is changed. Unlike net_discover_local this needs no ARP, so it reaches any address that routes.
List every platform string this toolkit has a driver for.
Render a network topology as a draw.io diagram.
Parameter descriptions are generic and repetitive. 'inventory name of the device' appears in 6 tools. Descriptions should explain WHEN to use each tool and how it differs from similar tools (e.g., net_run_show vs net_get_config).
net_topology_draw lacks input validation and output documentation. Parameter 'topology' is a file path but no format or validation is described. Output structure (draw.io XML? URL?) is not documented.