gabrielmoreira Multivendor Raw CLI
Run a command on a device whose platform has no dedicated NetClaw server, and get its real output.
MCP server: multivendor-cli-mcp · Tools: run_command, check_reachability
Check routing first
Refuses raw execution on Cisco and Juniper, naming pyats / junos-mcp. Those servers are richer for
their own platforms. Use list_devices and look at owning_server before reaching for this.
Start with check_reachability
On any newly added device, run it first. It separates three failures that look identical in a generic error message and need three different fixes:
| Status | Means | Fix |
|---|---|---|
unreachable |
TCP/port problem | network, or the device is down |
auth_failed |
credentials resolved but rejected | check Vault path or env vars |
platform_mismatch |
inventory platform ≠ reality, or no driver | correct the inventory |
not_found |
device in no inventory source | add it |
Command policy
Filtering is server-side and runs before connecting — a denied command never opens a session. In
read-only mode the first verb must be show/display/get/… Ordering: chaining is rejected first,
then per-platform destructive verbs, then the allowlist.
CLI wrappers are unwrapped and their inner command judged. On FRR the only read path is
vtysh -c "show ip route", whose first token is vtysh — so the wrapper is stripped and
show ip route is what gets evaluated. This means vtysh -c "configure terminal" is correctly
denied: allowlisting vtysh itself would have turned the wrapper into a config escape.
Platform strings
Aliases are normalised, so nokia_srl, srl and nokia_srlinux all resolve to the same policy — and
to the SR Linux-specific denylist rather than only the universal baseline.
Verified live against Nokia SR Linux (native CLI) and FRR (shell-hosted).
Caveat: CLI reach is not full vendor support
netmiko also drives Fortinet, Palo Alto PAN-OS and Check Point, so this server gives CLI-level reach to them today. That is not equivalent to their dedicated API integrations:
| Vendor | What CLI gives you | What it does NOT give you |
|---|---|---|
| Fortinet | FortiOS CLI reads | FortiManager policy packages, ADOM model, install preview |
| Palo Alto | PAN-OS CLI reads | Panorama device groups, templates, commit validation |
| Check Point | GAiA CLI reads | Management API policy layers, threat intel |
Roadmap items R3 (Fortinet) and R4 (Palo Alto) are still needed. Do not treat CLI reach as completing them.