netops-field-notes-mcp

The things I check by hand on network gear, as tools your coding agent can call: what changed between two config snapshots and how much it matters, whether a config passes the CIS/PCI basics, why a port will not pass 802.1X, which certificates are hiding inside a config and when they expire, what a device is and what it sits next to, what an OPNsense rule change actually does, and whether a proposed change is safe to push.

Read-only. Deterministic — no model call, so two engineers get the same answer. No account, no telemetry, nothing read from your disk: configs and logs go in as text.

Install

Pin the version.

Claude Code

claude mcp add netops-field-notes -- uvx --from "git+https://github.com/getlarkwright/netops-field-notes-mcp@v0.1.1" netops-field-notes-mcp

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "netops-field-notes": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/getlarkwright/netops-field-notes-mcp@v0.1.1", "netops-field-notes-mcp"]
    }
  }
}

Docker

{
  "mcpServers": {
    "netops-field-notes": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "ghcr.io/getlarkwright/netops-field-notes-mcp:0.1.1"]
    }
  }
}

Python 3.10 or newer for the uvx route (uv installs it). Also in the official MCP registry as io.github.getlarkwright/netops-field-notes-mcp.

Tools

diagnose_dot1x

The one that saves the most time. Paste what you have — any of the three inputs — and it names the failure mode rather than restating the log:

ROOT CAUSE
Two defects: (1) dot1x failed on an EAP mismatch (EAP-TLS vs EAP-PEAP); (2) MAB then
Accepted with NO dynamic VLAN, so the endpoint landed on VLAN 10 instead of VLAN 30.

RECOMMENDED FIX
1. Align EAP: either enroll a client cert + set the supplicant to EAP-TLS, OR allow EAP-PEAP
   in the ISE auth policy for this port. Make both ends match.
2. Fix the ISE authorization profile "MAB_Guest": add Tunnel-Type=VLAN(13),
   Tunnel-Medium-Type=802(6), Tunnel-Private-Group-ID=30.
3. On the access port add: `authentication event fail action authorize vlan 30` as a local backstop.

It knows the difference between a CoA sent to port 1700 and one sent to 3799, an unknown-CA failure and a missing client certificate, and a permit any any eq 443 dACL that IOS will reject.

find_certs_in_config

Web monitors watch ports. Certificates on network gear live in the config — Cisco crypto pki chains, RouterOS exports, OPNsense <crt> blobs — and expire without anybody watching. This reads them ou

... View full README on GitHub