netdev-ssh-mcp

What is netdev-ssh-mcp?

netdev-ssh-mcp is an MCP server that exposes SSH-based tools for interacting with network devices from Arista EOS, Cisco NX‑OS, Cisco IOS/IOS‑XE, Juniper JunOS, and FortiGate FortiOS. It is designed for use with Claude Code, Claude Desktop, Codex, and other MCP clients.

How to use netdev-ssh-mcp?

Install via Homebrew on macOS (brew install --cask krisiasty/tap/netdev-ssh-mcp) or build from source with Go 1.26+. Configure it in your MCP client’s JSON config (e.g., .mcp.json for Claude Code, claude_desktop_config.json for Claude Desktop) by providing the path to the binary and optionally environment variables for authentication. Use tools like get_config, run_show_command, run_ping, run_traceroute, and trust_host_key in natural language prompts.

Key features of netdev-ssh-mcp

• Retrieve running/startup configs with deterministic SHA‑256 secret hashing.
• Run operational show and get commands on supported platforms.
• Execute ping and traceroute from the device’s perspective.
• Securely manage SSH host keys via trust_host_key.
• Supports SSH agent and password‑based authentication.

Use cases of netdev-ssh-mcp

• Auditing device configurations and comparing secrets across devices.
• Troubleshooting network issues with live operational commands.
• Testing reachability and path latency from the device.
• Verifying and updating SSH host keys for new or changed devices.
• Automating network operations through AI assistants.

FAQ from netdev-ssh-mcp

How does get_config handle sensitive data?

get_config automatically replaces passwords, secrets, SNMP community names, and key material with deterministic SHA‑256 hashes. The same secret always produces the same hash, enabling safe config comparison and diffing.

Which device types are supported?

Supported device types are eos (Arista), ios (Cisco IOS/IOS‑XE), nxos (Cisco NX‑OS), junos (Juniper JunOS), and fortios (FortiGate FortiOS). fortigate is an alias for fortios.

How do I authenticate to a device?

Authentication is tried in this order: SSH agent (if SSH_AUTH_SOCK is set) or password (via DEVICE_PASSWORD environment variable). At least one method must be available. The password is never passed through tool parameters.

How does host key verification work?

Host key verification is enabled by default using the user’s OpenSSH known_hosts file. If a device is not found, the tool trust_host_key lets you inspect the fingerprint and then write it to the file. Verification can be disabled with --insecure-skip-host-key-check (use only as a temporary escape hatch).

Can I use netdev-ssh-mcp with Claude Desktop?

Yes, but Claude Desktop does not inherit your shell environment. You must explicitly set SSH_AUTH_SOCK in the env block of claude_desktop_config.json. Alternatively, use password authentication by setting DEVICE_PASSWORD.