An AI agent that claws through your network
This repository also configures its own agents. See what netclaw tells them →
Skill Claude CodeCodex
Cisco Meraki wireless (read-only) — SSID configuration, RF profiles, Air Marshal, channel utilization, signal quality, client connectivity events via Cisco's official Meraki MCP. Use when inspecting Meraki SSIDs, auditing RF configuration, or investigating WiFi connectivity.
Skill Claude CodeCodex
Read OneDrive and SharePoint files via the Microsoft 365 MCP server — list folder contents, fetch item metadata, inspect versions and sharing permissions. Use when locating a document in OneDrive/SharePoint, checking who a file is shared with, or reviewing file version history.
Skill Claude CodeCodex
Upload and retrieve Visio (.vsdx) and other diagram files in OneDrive/SharePoint via the Microsoft 365 MCP server. Use when publishing a generated topology diagram to OneDrive, or fetching an existing .vsdx for reference.
Skill Claude CodeCodex
Query network devices on platforms NetClaw's Cisco- and Juniper-specific servers cannot reach — MikroTik RouterOS, VyOS, SONiC, Nokia SR Linux, Extreme, Huawei, Dell, Ubiquiti EdgeOS, and roughly eighty more.
Skill Claude CodeCodex
Ask one question of many devices at once — across mixed vendors — and get per-device answers.
Skill Claude CodeCodex
Run a command on a device whose platform has no dedicated NetClaw server, and get its real output.
Skill Claude CodeCodex needs its repo
Federate your NetClaw with other NetClaw operators over the BGP mesh — exchange capability inventories and ask your claw what a peer can do. (US1; remote invocation and chat land in later phases.).
Skill Claude CodeCodex
Nautobot IPAM & source of truth — IP address queries, prefix lookups, VRF/tenant/site filtering, IPAM search, connection testing. Use when looking up IP addresses in Nautobot, checking subnet allocations, querying IPAM by VRF or tenant, or validating Nautobot as the network source of truth.
Skill Claude Code
Reconcile NetBox source of truth against live network state - detect IP drift, missing interfaces, undocumented links, cable mismatches, VLAN mismatches, and ticket discrepancies in ServiceNow. Use when validating NetBox accuracy, checking for config drift, auditing network documentation, or reconciling source of…
Skill Claude CodeCodex
Ad-hoc read-only SQL analysis over exported network data (Zeek logs, Suricata eve.json, generated reports) using DuckDB. Use when aggregating across a packet capture's sessions, correlating IDS alerts with connection metadata, or answering counting and grouping questions that a per-log view cannot.
Skill Claude Code
The four standard NetClaw document compositions — a change-record Word document from a real ServiceNow CR plus device state, an interface/config audit workbook from real device queries, an executive summary deck with an embedded topology diagram, and a required PDF form filled from real data. Use when an operator asks…
Skill Claude Code
Host discovery and port scanning using nmap — ICMP/ARP host discovery, SYN/TCP/UDP port scanning with scope enforcement and audit logging. Use when discovering live hosts on a subnet, scanning for open ports, verifying firewall rules, or doing pre/post-change port scans.
Skill Claude Code
Custom nmap scans with arbitrary flags, plus scan history retrieval and management. Use when running nmap with custom flags, reviewing past scan results, comparing before/after scans, or retrieving a previous scan by ID.
Skill Claude Code
Service fingerprinting, OS detection, NSE script execution, and vulnerability scanning using nmap MCP. Use when identifying services on open ports, fingerprinting OS versions, running NSE scripts for SSL or SMB checks, or scanning for known CVEs and vulnerabilities.
Skill Claude CodeCodex
Triage Suricata IDS alerts from a packet capture (read-only) — signature alerts with detection posture, severity filtering, and corroboration against Zeek session metadata. Use when triaging IDS alerts, checking whether a capture contains known-bad traffic, or validating that a detector was actually armed.
Skill Claude CodeCodex
Pivot through Zeek session and protocol metadata from a packet capture (read-only) — connection listing, service filtering, and following a connection uid into dns/http/ssl logs. Use when reconstructing what sessions occurred in a capture, following a connection across protocols, or investigating retrospectively.
Skill Claude CodeCodex
Cisco NSO device operations — config retrieval, state inspection, sync, platform info, NED IDs, device groups. Use when retrieving device configs from NSO, checking sync status, pulling platform inventory, or inspecting NSO device groups and NED drivers.
Skill Claude CodeCodex
Cisco NSO service management — discover service types, list service instances, orchestrate network services. Use when listing NSO services, checking service health, auditing deployed service instances, or asking what services NSO can provision.
Skill Claude Code
Search the National Vulnerability Database for CVEs - find vulnerabilities by keyword or ID, get CVSS scores, weaknesses, affected configurations, and remediation references. Use when looking up a CVE, scanning for vulnerabilities, running a security audit, or checking if a software version has known exploits.
Skill Claude CodeCodex
Analyze network packet captures (.pcap/.pcapng) using Packet Buddy MCP. Use when opening a pcap file, inspecting packet captures, troubleshooting network traffic, analyzing retransmissions, or filtering packets by protocol.
Skill Claude CodeCodex
Manage and investigate incidents in PagerDuty.
Skill Claude CodeCodex
Manage on-call schedules and escalation policies in PagerDuty.
Skill Claude CodeCodex
Manage event orchestration and routing rules in PagerDuty.
Skill Claude CodeCodex
Manage service catalog and service health in PagerDuty.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: