Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add automateyournetwork/netclaw --skill meraki-network-opsgit clone --depth 1 https://github.com/automateyournetwork/netclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/automateyournetwork/netclaw/meraki-network-ops)<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/meraki-network-ops"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/meraki-network-ops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/automateyournetwork/netclaw/meraki-network-ops"><img src="https://agentmods.dev/badge/skills/automateyournetwork/netclaw/meraki-network-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.01568 |
| Opus 5 | $0.00036 | $0.00784 |
| Sonnet 5 | $0.00014 | $0.00314 |
| Haiku 4.5 | $0.00007 | $0.00157 |
Grade A, and why
meraki-network-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Meraki Network Operations (read-only)
MCP Server
- Server: Cisco's official Meraki MCP — developer.cisco.com
- Endpoint:
https://mcp.meraki.com/mcp(remote HTTP, no local install) - Self-host fallback: CiscoDevNet/cisco-meraki-mcp-official (Apache-2.0)
- Requires:
MERAKI_DASHBOARD_API_KEY— use a read-only dashboard key - Tools: exactly two —
semantic_search(discover) andexecute_api(invoke)
Read-only, structurally
All 431 mutating Meraki operations (174 POST, 186 PUT, 71 DELETE) are absent from the
capability catalogue. Only non-deprecated GETs are built in, so updateNetwork,
rebootDevice, blinkDeviceLeds and friends return Capability not found.
Do not attempt writes and do not offer them. There is no ServiceNow CR path here because there is nothing to gate — a change must be made in the Meraki dashboard directly.
How to call it
Two capability IDs may be called directly; everything else must be discovered:
execute_api→getOrganizations— find accessible org IDsexecute_api→getOrganizationNetworks— find network IDs in the chosen orgsemantic_search→ describe the intent in words → returns rankedcapability_idsexecute_api→ the chosencapability_id+ its required parameters
Discover, do not guess. An earlier version of this skill hardcoded 80 method names and
54 of them did not exist in the Meraki API at all — they failed regardless of server.
semantic_search is the guard against that: it can only return IDs that exist.
Reading results honestly
- One page only.
execute_apireturns a single page. Request a bounded page size when supported, and never present a page as the complete dataset. - Empty is not absent.
n=0means this network reported none, never none exist. Live proof from a real sandbox org:getOrganizationDevicesreturns 0 devices while the same org has a fully configured network with 15 SSIDs. - Three distinct errors, three different fixes:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 133 lines · 72 tokens per session scan A 2ac1ec8094a1
meraki-network-ops is a skill published in the GitHub repository automateyournetwork/netclaw (652 stars, last pushed 3d ago), licensed Apache-2.0. It adds 72 tokens to every session and 1,568 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
hdhr-discovery-ops
Find HDHomeRun tuner devices on the network via the hdhomerun-mcp MCP server — local UDP broadcast/targeted discovery on port 65001, and the SiliconDust cloud discovery endpoint (http://ipv4-api.hdhomerun.com/discover) for when broadcast can't reach the device (different VLAN/subnet). Use when the agent doesn't yet…
srx-mnha
Design, configure, audit, and troubleshoot Juniper SRX Multi-Node High Availability. Use when handling routed, default-gateway, or hybrid modes, chassis-cluster migration, SRGs, ICL or ICD, session sync, BGP or BFD failover, VIPs, IPsec, NAT, proxy ARP, routing instances, or DHCP. Use focused SRX skills for non-MNHA…
srx-nat
Design, configure, audit, and troubleshoot Juniper SRX NAT. Use when handling source, destination, static, NAT64, DNS64, CGN, PBA, persistent or address-persistent NAT, hairpinning, proxy ARP, rule order, pool exhaustion, security nat configuration, show security nat output, sessions, or RTNAT logs.
srx-initial-setup
Bring a new or factory-reset Juniper SRX from its shipped state to a reachable, zoned, screened, and minimally policied device. Use when performing first-time setup or Day-0 and Day-1 bring-up on SRX300 or SRX400 Branch, SRX1600 or SRX4120 campus, or SRX4300, SRX4700, or SRX5000 datacenter platforms, when removing or…
network-aiops
Use this skill whenever the user needs to operate a network device — read device facts, interfaces (+ counters/IP), BGP/LLDP neighbors (summary and detail), ARP/MAC tables, VLANs, routes, hardware environment (fans/temp/power/CPU/mem), optics, NTP, users, SNMP info, VRFs, and an aggregated device-health summary; run…
ha-discovery-augment
Augments an existing Home Assistant Custom Integration with one network or bus discovery mechanism beyond Zeroconf — DHCP, SSDP/uPnP, USB, HomeKit, or MQTT discovery — conforming to spec/ha/discovery-mechanisms. Sets the manifest matcher list, implements the typed asyncstep in configflow.py, forwards into a confirm…