automateyournetwork

224 verified skills113,868 total stars

percepxion-oob

Manage Lantronix out-of-band (OOB) infrastructure via Percepxion central management platform: device inventory, serial port inspection via SLC CLI, firmware compliance, config management, security auditing, and closed-loop incident remediation. Use during outages, maintenance windows, compliance cycles, and AI-assisted automation workflows.

tools644

zoom-meeting-context

Zoom meeting intelligence — correlates a live or referenced Zoom meeting discussion against NetClaw's historical meeting record (via the official Zoom Meetings MCP) and today's actual network state. Use when someone in a Zoom meeting references a past discussion or incident ('didn't we have this issue before?'), or asks to search prior meetings for a topic. Does not itself recognize live in-meeting questions — that happens automatically inside zoom-rtms-mcp's own extractor (spec 118) before this skill is ever invoked.

tools644

n2n-federation

Federate your NetClaw with other NetClaw operators over the BGP mesh — exchange capability inventories and ask your claw what a peer can do. (US1; remote invocation and chat land in later phases.)

tools638

token-tracker

Track token consumption, enforce session budgets, and display cost for every NetClaw interaction.

tools638

network-data-analysis

Ad-hoc read-only SQL analysis over exported network data (Zeek logs, Suricata eve.json, generated reports) using DuckDB. Use when aggregating across a packet capture's sessions, correlating IDS alerts with connection metadata, or answering counting and grouping questions that a per-log view cannot

data-ai632

meraki-wireless-ops

Cisco Meraki wireless (read-only) — SSID configuration, RF profiles, Air Marshal, channel utilization, signal quality, client connectivity events via Cisco's official Meraki MCP. Use when inspecting Meraki SSIDs, auditing RF configuration, or investigating WiFi connectivity

tools632

meraki-monitoring

Cisco Meraki monitoring and diagnostics (read-only) — device availability, loss and latency history, uplink status, live tool results, configuration change log, API request analytics via Cisco's official Meraki MCP. Use when checking Meraki device health, investigating uplink loss, or reviewing recent configuration changes

tools632

fortigate-ops

FortiGate device operations — system status, interfaces, routing, IPsec VPN tunnel state with phase 1 and phase 2 reported separately, HA member identification, per-VDOM scoping, and manager-vs-device drift detection. Use when asking what a FortiGate is ACTUALLY doing right now, whether a tunnel is up, or whether the device matches FortiManager's intent.

development632

network-report-documents

The four standard NetClaw document compositions — a change-record Word document from a real ServiceNow CR plus device state, an interface/config audit workbook from real device queries, an executive summary deck with an embedded topology diagram, and a required PDF form filled from real data. Use when an operator asks for a deliverable to attach to a change record, hand to an auditor, or put in front of a director.

development632

meraki-switch-ops

Cisco Meraki switching (read-only) — port configuration and status, VLANs, ACLs, QoS, STP, link aggregation, routing interfaces via Cisco's official Meraki MCP. Use when inspecting Meraki switch ports, auditing switch ACLs, or investigating port errors

tools632

elasticsearch-logs

Search and analyse logs in an existing Elasticsearch cluster (8.x/9.x) — syslog, application logs, Zeek/Suricata exports, or any indexed event data. Use for "what errors did we see", "how many times did X happen", "show me logs from device Y", "which host logged the most". Read-only. Counting questions MUST go through ESQL or track_total_hits — a bare search total silently caps at 10,000.

development632

k8s-service-path

Trace the Kubernetes service path — Service to selector to pods to EndpointSlices to readiness, plus Ingress routing. Use when a service is getting no traffic, an ingress is not routing, or someone asks why a workload is unreachable inside a cluster.

devops632

nsm-ids-triage

Triage Suricata IDS alerts from a packet capture (read-only) — signature alerts with detection posture, severity filtering, and corroboration against Zeek session metadata. Use when triaging IDS alerts, checking whether a capture contains known-bad traffic, or validating that a detector was actually armed

testing632

meraki-network-ops

Cisco Meraki organization and network operations (read-only) — org discovery, network inventory, device inventory, clients, group policies, admins, licensing, alert settings via Cisco's official Meraki MCP. Use as the entry point for any Meraki question, to discover org and network IDs, or to inventory Meraki networks and devices

tools632

msgraph-visio

Upload and retrieve Visio (.vsdx) and other diagram files in OneDrive/SharePoint via the Microsoft 365 MCP server. Use when publishing a generated topology diagram to OneDrive, or fetching an existing .vsdx for reference

tools632

anta-validation

Validate Arista EOS network state with structured pass/fail verdicts using ANTA. Use for "is this switch healthy", "did my change break anything", "verify BGP/interfaces/hardware are correct", "run a health check on this device". Read-only. A test for a feature the device does not run reports not_applicable — never a failure — and no health percentage is ever emitted.

development632

fortianalyzer-ops

FortiAnalyzer log operations — policy-filtered traffic log query within a bounded time window, offset pagination, per-policy activity checks, and logging-device inventory. Use when asking whether traffic actually matched a firewall rule, investigating what hit a policy, or determining whether a rule is genuinely unused.

development632

meraki-security-appliance

Cisco Meraki MX security appliance (read-only) — L3/L7 firewall rules, content filtering, IDS/IPS and AMP settings, site-to-site VPN, traffic shaping via Cisco's official Meraki MCP. Use when auditing Meraki firewall rules, reviewing content filtering, or inspecting MX VPN configuration

tools632

k8s-network-policy

Review Kubernetes NetworkPolicies — what is actually permitted to reach a workload, and whether the answer can be trusted. Use when asked what can talk to a pod, whether a namespace is restricted, why traffic is being blocked, or for any security review of cluster network segmentation.

development632

k8s-workload-inventory

List Kubernetes workloads and namespaces — pods with their node, phase and readiness, plus events. Use when asked what is running, where it is running, what is failing, or for a general inventory of a cluster.

devops632

fortimanager-ops

FortiManager policy operations — ADOM inventory, policy package review, recursive object resolution, revision history, install preview, and gated package install. Use when auditing FortiGate firewall policy at the MANAGER level (intent), reviewing ADOM policy packages, or planning a package install with rollback context.

testing632

msgraph-files

Read OneDrive and SharePoint files via the Microsoft 365 MCP server — list folder contents, fetch item metadata, inspect versions and sharing permissions. Use when locating a document in OneDrive/SharePoint, checking who a file is shared with, or reviewing file version history

tools632

bgp-registry-intel

BGP and registry intelligence — RPKI origin validation (is this announcement authorised?), RDAP registry ownership and abuse contacts, PeeringDB interconnection data, RIPEstat routing status and prefix visibility, RIPE Atlas anchors. Use when investigating an unfamiliar prefix or ASN, checking whether a BGP announcement is RPKI-valid, finding who owns address space or who to report abuse to, or determining what an AS announces and where it peers.

testing632

hardware-health-check

Out-of-band hardware health via Redfish BMC (read-only) — power state, component health, thermal and power readings, firmware inventory, SEL log triage. Use when determining whether a host is powered off versus unreachable, checking hardware faults, reviewing thermal or PSU state, or triaging BMC event logs

testing632

zabbix-problem-review

Review current and historical problems from Zabbix — severity, which host, when it started, how long it has been active, and whether anyone has acknowledged it. Use when someone asks what is broken right now, how long something has been broken, or what happened during a window that has already passed.

tools632

document-generation

Generate Word (.docx), Excel (.xlsx) and PowerPoint (.pptx) documents and fill existing PDF forms, from real NetClaw data, with per-element provenance and no fabrication. Use when someone needs a deliverable rather than an answer — a change record to attach to a CR, an audit workbook for a compliance reviewer, a summary deck for a director, or a required PDF form filled from real device and ticket data.

development632

zabbix-metrics-history

Retrieve polled metric history from Zabbix — interface utilization, counters and any collected item — over any time window, correctly routed between raw history and hourly trends. Use when someone asks what something WAS doing over time: is this normal, what did this interface do overnight, was it like this last Tuesday. This is the only NetClaw skill that can answer a question about the past from a poller.

tools632

zabbix-availability

Device availability and monitored inventory from Zabbix — is a device reachable, since when, how often has it flapped, and what is the NMS actually watching. Use when someone asks how long a device has been down, whether it is flapping, or what is and is not being monitored.

development632

catalyst-center-readonly

Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is, or to reconcile controller state against the devices themselves.

development632

nsm-session-pivot

Pivot through Zeek session and protocol metadata from a packet capture (read-only) — connection listing, service filtering, and following a connection uid into dns/http/ssl logs. Use when reconstructing what sessions occurred in a capture, following a connection across protocols, or investigating retrospectively

data-ai632

globalping-external-checks

Measure a public endpoint from thousands of probes worldwide - ping, traceroute, DNS, MTR and HTTP from real vantage points on the internet. Use when asked whether the outside world can reach a service, to compare latency between regions, to check DNS propagation, or to answer 'is it us or the internet?'. Public targets only.

testing623

halo-change-request

Open a change request in HaloPSA / HaloITSM through a discover-preview-confirm-submit workflow, with the confirmed change ticket type cached in Memory. Use when raising a Halo change, opening a CR in Halo, submitting a change ticket, or asking NetClaw to file a change in HaloPSA.

data-ai623

workspace/skills/multivendor-fleet-ops

# Multivendor Fleet Ops Ask one question of many devices at once — across mixed vendors — and get per-device answers. **MCP server:** `multivendor-cli-mcp` · **Tools:** `run_fleet`, `get_facts` ## `run_fleet` `target` is a group name, a comma-separated device list, or `all`. Supply exactly one of: - `command` — raw CLI, only for platforms this server owns - `getters` — NAPALM normalized facts, permitted read-only on any platform ``` run_fleet(target="edge", getters=["get_facts","get_interf

tools623

halo-ticket-context

Review a HaloPSA / HaloITSM ticket for resolution context — its detail, action/note history, linked assets, and related KB runbooks — read-only. Use when investigating a Halo ticket, gathering resolution context, reading a ticket's note history, or finding runbooks for an open issue.

data-ai623

workspace/skills/multivendor-device-query

# Multivendor Device Query Query network devices on platforms NetClaw's Cisco- and Juniper-specific servers cannot reach — MikroTik RouterOS, VyOS, SONiC, Nokia SR Linux, Extreme, Huawei, Dell, Ubiquiti EdgeOS, and roughly eighty more. **MCP server:** `multivendor-cli-mcp` (results identify themselves as `multivendor-cli`) --- ## Decide which server to use FIRST This skill is wrong for most Cisco and Juniper work. Check here before using it: | Your device | Use | |---|---| | Cisco IOS / IO

tools623

kepner-tregoe-network-troubleshooting

Structured Kepner-Tregoe (K-T) rational-process methodology for network operations. Use this whenever diagnosing a network fault, outage, or performance deviation; triaging multiple concurrent alarms or an alert storm; choosing between remediation options, designs, or vendors; or planning and protecting a network change, migration, or upgrade. Apply it to ANY network troubleshooting task — routing/BGP, wireless/RF, firewall/security, SD-WAN/overlay, DNS/DHCP, cloud/hybrid connectivity, or performance — even when the request is only "why is X down", "figure out what's wrong", or "the network is slow". It exists to stop guess-and-swap troubleshooting: it forces you to specify the fault's boundary before hypothesizing, test causes against evidence, verify the root cause before changing anything, and separate the fast reversible incident fix from the permanent fix. Consult it before making state-changing actions on a network.

development623

workspace/skills/multivendor-raw-cli

# Multivendor Raw CLI Run a command on a device whose platform has no dedicated NetClaw server, and get its real output. **MCP server:** `multivendor-cli-mcp` · **Tools:** `run_command`, `check_reachability` ## Check routing first Refuses raw execution on Cisco and Juniper, naming `pyats` / `junos-mcp`. Those servers are richer for their own platforms. Use `list_devices` and look at `owning_server` before reaching for this. ## Start with `check_reachability` On any newly added device, run

tools623

halo-asset-context

Review a HaloPSA / HaloITSM asset (Device) with its related tickets and CMDB/CI relationships — read-only. Use when investigating a Halo asset, checking a device's ticket history, mapping CI dependencies, or gathering asset context before a change.

development623

auvik-inventory

Auvik device, network, interface, and component inventory across MSP tenants — including entity notes, audit logs, and billing usage. Use when discovering what devices Auvik manages, listing networks or interfaces, checking component health, reviewing annotated entity notes, auditing who changed managed entities, or pulling billing/usage data for a date range.

development623

auvik-network-alerts

Surface and triage Auvik network alerts by severity, status, dismissed state, or time window across MSP tenants. Use when reviewing active alerts, investigating a specific device's alert history, filtering by severity (emergency/critical/warning), checking whether alerts are resolved or still open, or pulling alerts within a date range for incident review.

development623

auvik-performance

Auvik time-series performance stats for devices, interfaces, services, and hardware components — plus SNMP poller history for custom OID values. Use when checking device CPU or memory utilization over time, reviewing interface throughput or packet loss, checking service (ping) latency, pulling component-level stats (fan temperature, PSU power), or querying custom SNMP poller values.

development623

cisco-psirt-advisories

Check whether a running Cisco software version is affected by a published PSIRT security advisory - by OS version, CVE, or advisory ID, with severity and CVSS. Covers IOS, IOS-XE, NX-OS, ASA, FTD, FMC and ACI. Use when asked if a device or fleet is vulnerable, when triaging a Cisco CVE, or when auditing software versions against Cisco advisories.

development623

auvik-lifecycle

Auvik device end-of-life posture, warranty/service coverage, and configuration backup history for refresh and renewal planning. Use when identifying devices past or approaching end-of-life, auditing warranty and service contract coverage, reviewing configuration backup history, planning hardware refreshes, or preparing QBR lifecycle reports for MSP clients.

tools623

subnet-calculator

IPv4 and IPv6 subnet calculator - CIDR breakdown, usable hosts, previous/next subnets, address classification, VLSM planning, and dual-stack analysis. Use when calculating subnets, figuring out how many hosts fit in a prefix, planning IP addressing, getting wildcard masks for ACLs, or checking if two IPs are in the same subnet.

testing613

ue5-network-viz

3D network topology visualization and interactive digital twin in Unreal Engine 5.8 via the built-in UE5 MCP server.

tools613

pyats-security

Network security audit - ACLs, AAA, control plane policing, management plane hardening, encryption, port security, and CIS benchmark checks. Use when auditing device security posture, checking compliance, hardening a router or switch, reviewing access lists, or investigating unauthorized access.

development613

pyats-dynamic-test

Generate and execute deterministic pyATS aetest validation scripts - interface state, OSPF neighbors, BGP paths, ping matrices, and custom compliance tests. Use when writing a network test, validating post-change state, running pass/fail checks, or building automated regression tests.

development613

servicenow-change-workflow

Full ITSM-gated change lifecycle - CR creation, pre-change incident validation, approval gate, execution via pyats-config-mgmt, post-change verification, and closure with GAIT audit trail. Use when creating a change request, making a network change that needs approval, tracking change management, or following ITIL change process.

testing613

slack-incident-workflow

Manage network incident response workflows in Slack - incident channels, status updates, escalation, resolution tracking, and post-incident review coordination. Use when declaring a network incident, coordinating outage response in Slack, tracking incident status, or running a post-incident review.

testing613

pyats-troubleshoot

Systematic network troubleshooting - connectivity, routing, interface, protocol, and performance issues using structured OSI-layer and divide-and-conquer methodology. Use when something is broken, a device is unreachable, a link is flapping, users report slow performance, or an OSPF/BGP adjacency is down.

development613

netbox-reconcile

Reconcile NetBox source of truth against live network state - detect IP drift, missing interfaces, undocumented links, cable mismatches, VLAN mismatches, and ticket discrepancies in ServiceNow. Use when validating NetBox accuracy, checking for config drift, auditing network documentation, or reconciling source of truth after changes

testing613

pyats-topology

Network topology discovery via CDP/LLDP neighbors, ARP tables, routing peers, and interface mapping to build complete network maps. Use when mapping the network, building a diagram, discovering what is connected to what, or documenting device neighbors and links.

development613

pyats-linux-network

Linux host network operations via pyATS — interface configuration, routing tables, network connections, and multi-table route inspection across fleet hosts. Use when checking Linux interface status, viewing routing tables, auditing host network config, or comparing routes across hosts.

testing613

nvd-cve

Search the National Vulnerability Database for CVEs - find vulnerabilities by keyword or ID, get CVSS scores, weaknesses, affected configurations, and remediation references. Use when looking up a CVE, scanning for vulnerabilities, running a security audit, or checking if a software version has known exploits.

testing613

pyats-f5-ltm

F5 BIG-IP LTM/GTM operations via pyATS iControl REST — virtual servers, pools, nodes, monitors, profiles, iRules, persistence, GTM wide IPs, DNS, data groups. Use when checking F5 virtual server status, auditing pool members, reviewing iRules, or inspecting GTM wide IP health.

testing613

pyats-parallel-ops

Fleet-wide parallel device operations - concurrent health checks, config audits, routing snapshots, severity-sorted reporting, and failure-isolated multi-device automation. Use when checking all devices at once, running bulk health checks, collecting configs from the entire fleet, or comparing state across multiple routers and switches.

tools613

pyats-junos-routing

JunOS routing operations via pyATS — OSPF/OSPFv3, BGP, route table, MPLS/LDP/RSVP, TED, PFE, ping, traceroute across Juniper devices. Use when checking Juniper OSPF neighbors, viewing BGP summary, inspecting MPLS LSPs, tracing routes, or auditing the JunOS route table.

development613

pyats-asa-firewall

Cisco ASA firewall operations via pyATS — VPN sessions, failover state, interfaces, routing, service policies, resource usage, AnyConnect monitoring. Use when checking ASA failover status, monitoring VPN sessions, auditing ASA security, or troubleshooting AnyConnect connectivity.

testing613

pyats-linux-vmware

VMware ESXi host operations via pyATS — VM inventory, snapshot management, hypervisor inspection across ESXi hosts in the testbed. Use when listing VMs on ESXi, checking snapshot age, auditing VMware inventory, or verifying pre-change snapshots exist.

testing613

pyats-linux-system

Linux host system operations via pyATS — process monitoring, filesystem inspection, Docker container stats, package/tool verification across fleet hosts. Use when checking running processes, monitoring Docker containers, inspecting log files, or verifying system tools on Linux hosts.

tools613

pyats-health-check

Comprehensive network device health monitoring - CPU, memory, interfaces, hardware, NTP, logging, environment, and uptime analysis. Use when running a device health check, monitoring CPU or memory usage, checking interface errors, or validating NTP sync.

development613

pyats-network

Network device automation via pyATS - run show commands, ping, apply config, learn config/logging, list devices, run Linux commands, execute dynamic tests on Cisco IOS-XE/NX-OS devices. Use when running CLI commands on routers or switches, checking interface status, applying configuration changes, or collecting device data via pyATS.

tools613

pyats-junos-interfaces

JunOS interface operations via pyATS — physical/logical interfaces, LACP, CoS, LLDP, ARP, BFD, IPv6 neighbors, traffic monitoring, optics diagnostics. Use when checking Juniper interface status, auditing LACP members, inspecting optics power levels, or reviewing ARP and LLDP neighbors.

testing613

pyats-routing

CCIE-level routing protocol analysis - OSPF, BGP, EIGRP, IS-IS, static routes, RIB/FIB verification, redistribution audit, and convergence validation. Use when analyzing routing tables, debugging OSPF neighbors, checking BGP peering, verifying route redistribution, or validating convergence after changes.

development613

pyats-config-mgmt

Network change management - pre-change baselines, configuration deployment, post-change verification, rollback procedures, and compliance validation. Use when pushing config to a device, planning a network change, rolling back a configuration, or running compliance checks.

development613

pyats-f5-platform

F5 BIG-IP platform operations via pyATS iControl REST — system, networking, HA/CM, auth, analytics, security, APM, live-update, ADC certs, file management. Use when checking BIG-IP system health, verifying HA sync status, auditing certificates, or inspecting F5 platform resources.

testing613

humanrail-escalation

Human-in-the-loop escalation via HumanRail — route low-confidence agent decisions, pre-destructive operation approvals, and ambiguous incident tickets to real human engineers. Human answers are verified and returned as structured output. Workers are paid via Lightning Network. Use when the agent is uncertain, when a destructive change needs explicit human sign-off beyond a ServiceNow CR, or when an ambiguous ticket requires human triage before automated handling.

testing613

catc-troubleshoot

Catalyst Center troubleshooting workflows - device unreachable investigation, client connectivity issues, interface down analysis, site-wide outage triage, wireless roaming problems, integration with pyATS for CLI-level diagnostics. Use when a device is unreachable, a user reports connectivity problems, an interface is down, a site has an outage, or wireless clients have roaming issues.

tools613

catc-inventory

Catalyst Center device inventory and site management - list/filter devices by hostname, IP, platform, family, role, reachability; view site hierarchy; get interface details per device; device reachability monitoring; cross-reference with pyATS. Use when listing network devices, checking device reachability, auditing software versions, viewing site hierarchy, or finding a device by serial number.

development613

pyats-junos-system

JunOS system operations via pyATS — chassis health, hardware inventory, system info, NTP, SNMP, files/logs, firewall counters, DDoS protection, services accounting. Use when checking Juniper chassis alarms, auditing hardware inventory, reviewing system uptime, or inspecting JunOS firewall counters.

testing613

workspace/skills/rag

# Skill: RAG Knowledge Base **Purpose**: Give NetClaw a fully offline, user-curated document knowledge base — vendor guides, standards (RFC/IEEE/vendor), customer design documents, install guides — with agentic retrieval, mandatory citations, and opt-in point-in-time snapshots. ## Overview Users teach NetClaw by uploading documents (Slack attachment, HUD Knowledge panel, or URL). Documents are parsed, chunked structure-aware, embedded locally, and stored at `~/.openclaw/rag/`. Retrieval is a

testing611

workspace/skills/memory

# Skill: Persistent Memory **Purpose**: Provide persistent context across NetClaw sessions through structured facts, semantic search, and entity relationships. ## Overview The Memory skill enables NetClaw to remember information about your network across sessions. Instead of re-explaining your topology, device names, and past issues every time, NetClaw builds a memory that grows smarter with each interaction. > **Memory vs. the RAG Knowledge Base**: Memory (`memory_*` tools, `~/.openclaw/mem

tools611

desktop-gui-inspect

Full-desktop automation for targets that have no browser and no API at all — a legacy Java-based NMS client, a vendor's Windows-only configuration utility, a terminal emulator with no scriptable interface. Drives OpenClaw's ClawHub computer-use skill (Xvfb+XFCE virtual desktop, xdotool input automation) to read, confirm, or search state in a desktop-only application. Includes a VNC/noVNC Watch Mode so an operator can watch or take over live, the direct desktop analogue of the Chrome DevTools Watch Mode. Never used to submit, apply, or commit a configuration change — that remains the job of the relevant API-based skill.

tools598

browser-viz-verify

Verifies that a NetClaw-generated visualization HTML file (three.js, canvas, drawio, UML, markmap) actually renders correctly — screenshot, console-error check, and an optional Lighthouse audit. Use immediately after generating any browser-based visualization output, to close the QA gap that otherwise requires a human to manually open the file. Never touches an external site or the authenticated browser profile.

development598

browser-gui-inspect

Controller-agnostic browser automation and inspection — navigate, read, click, fill, and capture network traffic on any web GUI using a persistent, manually-authenticated Chrome profile. Use to (1) pull a GUI-only report a vendor's REST API doesn't expose, (2) discover the undocumented API behind a dashboard feature, (3) automate a one-off interaction with a web tool that has no NetClaw API integration, or (4) run any of the above in Watch Mode — a real, visible Chrome window an operator can watch work live. Never used to submit, apply, or commit a configuration change — that remains the job of the relevant API-based skill.

tools598

workspace/skills/threejs-network-viz

# Three.js Network Topology Visualization Skill **Version**: 1.0.0 **Feature**: 046-threejs-network-viz **Status**: Active ## Overview Renders network topologies as interactive, fully-labeled 3D scenes directly in a web browser, using Three.js. Unlike NetClaw's UE5 (`ue5-network-viz`) and Blender (`blender-3d-viz`) visualization skills, this skill needs **no desktop application, no GPU, and no cross-OS bridge** — every visualization is a single, self-contained HTML file that opens directly in

development594

infrahub-sot

OpsMill Infrahub — infrastructure source of truth with schema-driven nodes, GraphQL queries, and branch-isolated changes. Use when querying Infrahub for device/IPAM inventory, browsing infrastructure schemas, running GraphQL queries, or making infrastructure changes safely via an auto-created session branch and a Proposed Change for human review.

development586

workspace/skills/twilio-outbound-call

# Twilio Outbound Call Skill **Feature**: 042-twilio-voice-mcp **Priority**: P2 **User Stories**: US2 (On-Demand), US3 (Situation Updates) ## Purpose Enable John to request on-demand phone calls for network status updates and schedule periodic update calls during ongoing incidents. ## Trigger Conditions This skill activates when: 1. **Explicit Request** - "Call me with network status" - "Phone me about router-1" - "Give me a voice update" 2. **Scheduled Updates** - "Call me ev

tools575

workspace/skills/twilio-daily-briefing

# Twilio Daily Briefing Skill **Feature**: 042-twilio-voice-mcp **Priority**: P3 **User Story**: US4 - Daily Check-in Calls ## Purpose Provide optional daily phone briefings at a scheduled time with overnight event summaries. ## Trigger Conditions This skill activates when: 1. **Scheduled Time** (e.g., 8 AM daily) - If `daily_briefing.enabled: true` in config - Integrated with NetClaw heartbeat system 2. **Manual Request** - "Give me my daily briefing" - "What happened overnig

tools575

workspace/skills/twilio-emergency-call

# Twilio Emergency Call Skill **Feature**: 042-twilio-voice-mcp **Priority**: P1 (MVP) **User Story**: US1 - Emergency Alert Calls ## Purpose Automatically call John when critical network events occur (P1 incidents, core device failures). Emergency calls bypass quiet hours and are auto-approved without user confirmation. ## Trigger Conditions This skill activates when: 1. **PagerDuty P1 Incident** - Source: `pagerduty` - Match: `severity:P1` - Auto-approved: Yes 2. **Core Device

tools575

workspace/skills/twilio-inbound-voice

# Twilio Inbound Voice Skill **Feature**: 042-twilio-voice-mcp **Priority**: P2 **User Stories**: US5 (Inbound Conversations), US6 (Voice Commands) ## Purpose Enable John to call NetClaw's Twilio number and have a bidirectional voice conversation for status queries and network commands. ## Trigger Conditions This skill activates when: 1. **Inbound Call Received** - Call from whitelisted number ([WHITELIST_NUMBER]) - Caller ID authenticated ## Architecture ``` John's Phone │

tools575

workspace/skills/twitter-check

# Skill: Twitter Check **Purpose**: Quick invocation to check mentions and respond to #netclaw threads. **Trigger**: `/twitter-check` or "check twitter" or "#netclaw check" **MCP Server**: twitter-mcp ## Overview This skill provides a quick way for John to invoke the Twitter mention check and auto-respond workflow directly from Claude Code. ## Usage ``` /twitter-check # Check and respond to mentions /twitter-check dry # Preview what would happen (no posting) /twitter-check

tools572

workspace/skills/twitter-respond

# Twitter Respond Skill **Skill ID**: twitter-respond **Category**: Social Media / Engagement **Feature**: 040-twitter-mentions ## Overview Enables bidirectional Twitter interaction by monitoring @mentions of @John_Capobianco and generating CCIE-level technical replies. All replies require human approval per Constitution Principle XIV. ## Capabilities 1. **Mention Detection** - Poll for @mentions and classify them 2. **Reply Generation** - Create context-aware, technically accurate replies

development572

workspace/skills/twitter-heartbeat

# Skill: Twitter Heartbeat **Purpose**: Autonomous periodic tweeting AND mention monitoring to maintain NetClaw's Twitter presence with CCIE-level network engineering content. **MCP Server**: twitter-mcp ## Overview The twitter-heartbeat skill enables NetClaw to: 1. **Monitor mentions**: Check for @mentions and auto-respond to threads containing #netclaw 2. **Post heartbeat tweets**: Autonomously post every 4 hours (configurable) with varied content This combined approach maintains an activ

tools572

workspace/skills/twitter-share

# Skill: Twitter Share **Purpose**: Manual tweet posting with content guardrails and human approval flow. **MCP Server**: twitter-mcp ## Overview The twitter-share skill enables users to ask NetClaw to tweet specific content. All tweets go through content guardrails and require explicit human approval before posting (per Constitution Principle XIV - Human-in-the-Loop for External Communications). ## Workflow ``` 1. User requests a tweet - "Tweet about BGP path selection" - "Tweet: He

tools572

forward

Forward snapshot assurance, path search, app-aware path search, NQE, checks, vulnerabilities, diffs, configuration, lifecycle, collection, and topology workflows through the upstream forward-mcp server.

tools569

claroty-ot-topology

Render Claroty xDome OT / IoT communication maps and zone segmentation as inline Canvas/A2UI topology, draw.io diagrams, and timeline summaries.

tools564

claroty-risk-triage

Triage Claroty xDome alerts and vulnerabilities, compute blast radius, correlate with NVD CVE data, and drive ITSM-gated workflow actions (acknowledge, label, assign, set relevance).

data-ai564

claroty-asset-inventory

Discover and classify OT / IoT / IoMT assets via Claroty xDome. List devices by site, Purdue level, and device purpose; assign Purdue layers and custom attributes; cross-reference with Nautobot / NetBox SoT to surface drift.

development564

workspace/skills/checkpoint

# Check Point Security Platform A comprehensive skill for interacting with Check Point enterprise security infrastructure through 15 MCP servers. ## Activation This skill activates when user queries involve: - Check Point firewall policies, rules, or objects - Security policy auditing or compliance - Threat intelligence (IP/URL/file reputation) - Gateway diagnostics and troubleshooting - SASE management and cloud security - Threat prevention profiles and IPS - Malware analysis and file sandbo

tools562

workspace/skills/ipfabric

# IP Fabric Network Assurance Skill **Skill**: `/ipfabric` **MCP Server**: ipfabric-mcp (remote HTTP via mcp-remote) **Tools**: 10 (health, path lookups, diagrams, API discovery) > Developed in collaboration with **Daren Fulwell** (Field CTO, IP Fabric) and **John Capobianco** (Creator, NetClaw), representing nearly a decade of professional partnership. ## Overview The IP Fabric skill provides natural language access to IP Fabric's network assurance platform. IP Fabric discovers, models, and

tools562

eve-lab-topology-design

Design EVE-NG lab topology and coordinate the design workflow. Use when the user asks for lab design, architecture advice, topology planning, design review, or a build plan, especially when requirements, trade-offs, or validation need to be structured first.

development491

eve-ng-config-ops

Manage EVE-NG startup configurations stored in lab files. Use when exporting configs natively into the lab, reading embedded startup configs, pushing startup config before boot, clearing config without full NVRAM wipe, or bulk-checking stored configs after lab changes.

testing491

eve-lab-topology-discovery

Gather missing requirements for EVE-NG topology design. Use when the request is vague or incomplete, when you need discovery questions, defaults, trade-off framing, image recommendations, or domain guidance before proposing a topology.

data-ai491

eve-lab-topology-validation

Validate EVE-NG topology designs and enforce final delivery structure. Use when reviewing a design, checking build readiness, producing the final design output, building an implementation plan, or running topology QA before implementation.

development491

eve-ng-node-operations

Manage EVE-NG node lifecycle. Use when listing nodes, checking runtime state, creating or deleting nodes, starting or stopping nodes or whole labs, verifying node details, or wiping node NVRAM back to factory defaults.

testing491

eve-lab-topology-build

Build or rewire EVE-NG lab topology. Use when creating or deleting virtual networks, connecting node interfaces to networks, inspecting topology links, checking interface mappings, or listing available node templates before wiring a lab.

development491

eve-ng-console-ops

Execute live CLI commands on running EVE-NG nodes over telnet console. Use when running show commands, making live config changes, verifying protocol state, testing connectivity, checking console readiness, or interacting with IOS, Junos, VPCS, EOS, or NX-OS nodes.

tools491

eve-ng-lab-management

Manage EVE-NG labs and platform inventory. Use when listing labs, checking lab metadata, creating or deleting labs, importing or exporting lab archives, checking EVE-NG health or auth, or verifying available node images before build work.

development491

aci-fabric-audit

Comprehensive Cisco ACI fabric health audit - node status, tenant/VRF/BD/EPG policy review, contract analysis, fault triage, and endpoint learning verification. Use when auditing ACI fabric health, checking for faults, reviewing tenant policies, or running pre/post-change baselines on APIC.

development433

aruba-cx-config

View and manage Aruba CX switch configurations, perform ISSU upgrades, and firmware operations