---
name: automateyournetwork/nso-device-ops
source: https://app.decimal.ai/s/automateyournetwork-nso-device-ops@1/SKILL.md
source_sha256: 3166c9d2d289
---

# NSO Device Operations

## MCP Server

- **Command**: `cisco-nso-mcp-server` (pip-installed, stdio transport)
- **Requires**: `NSO_ADDRESS`, `NSO_USERNAME`, `NSO_PASSWORD` environment variables
- **Optional**: `NSO_SCHEME` (default: http), `NSO_PORT` (default: 8080), `NSO_VERIFY`, `NSO_TIMEOUT`
- **API**: RESTCONF (RFC 8040)

## Available Tools

| Tool | Parameters | What It Does |
|------|-----------|-------------|
| `get_device_config` | `device_name` | Get the full configuration for a device from NSO's CDB |
| `get_device_state` | `device_name` | Get operational state data for a device (interfaces, counters, status) |
| `check_device_sync` | `device_name` | Check if NSO's copy of the device config is in sync with the actual device |
| `sync_from_device` | `device_name` | Pull the current config from the device into NSO's CDB (sync-from) |
| `get_device_platform` | `device_name` | Get platform info: model, OS version, serial number, hardware details |
| `get_device_ned_ids` | none | List all Network Element Driver (NED) IDs — shows what device types NSO can manage |
| `get_device_groups` | none | List all device groups defined in NSO |

## MCP Resource

| Resource URI | What It Returns |
|-------------|----------------|
| `https://resources.cisco-nso-mcp.io/environment` | NSO environment summary: device count, OS distribution, unique models, device series, group membership |

## Workflow: Device Configuration Audit

When a user asks "show me R1's config from NSO" or "what does NSO have for the core routers":

1. **Get device groups**: `get_device_groups` to see how devices are organized
2. **Get config**: `get_device_config` for each target device
3. **Present**: Format the configuration in a readable way
4. **Cross-reference**: Compare with pyATS live config if discrepancies suspected

## Workflow: Sync Check and Remediation

When a user asks "are my devices in sync?" or "is NSO up to date?":

1. **Check sync**: `check_device_sync` for the target device(s)
2. **If out of sync**: Report which devices are out of sync and why
3. **Remediate**: Use `sync_from_device` to pull current config from the device into NSO
4. **Verify**: Run `check_device_sync` again to confirm sync is restored
5. **Record in GAIT**: Log the sync operation for audit trail

## Workflow: NSO Environment Overview

When a user asks "what's in NSO?" or "show me the NSO inventory":

1. **Environment resource**: Read the NSO environment resource for the summary
2. **Device groups**: `get_device_groups` to see organizational structure
3. **NED IDs**: `get_device_ned_ids` to see what device types are managed
4. **Platform details**: `get_device_platform` for specific devices of interest
5. **Report**: Summary table of devices, OS types, models, and group membership

## Workflow: Pre-Change Baseline from NSO

Before making configuration changes:

1. **Get current config**: `get_device_config` to capture the NSO baseline
2. **Check sync**: `check_device_sync` to ensure NSO is current
3. **If out of sync**: `sync_from_device` first to get the latest state
4. **Save baseline**: Commit the config to GAIT or GitHub for audit trail
5. **Proceed with change**: Use pyATS or NSO services to apply changes

## Workflow: Device Platform Inventory

When a user needs hardware/software details:

1. **Get platform**: `get_device_platform` for each device
2. **Compile report**: Model, serial, OS version, hardware
3. **Cross-reference**: Check NVD for CVEs against OS versions (use nvd-cve skill)
4. **Cross-reference**: Compare with NetBox records for accuracy (use netbox-reconcile skill)

## NSO Concepts

| Concept | Meaning |
|---------|---------|
| **CDB** | Configuration Database — NSO's copy of all device configs |
| **NED** | Network Element Driver — plugin that translates between NSO's model and device CLI/NETCONF |
| **sync-from** | Pull config from device into NSO CDB |
| **sync-to** | Push NSO CDB config to device (not available in this MCP — use services instead) |
| **Device Group** | Logical grouping of devices for bulk operations |
| **Service** | NSO service instance that provisions config across devices (see nso-service-mgmt skill) |

## Integration with Other Skills

| Scenario | Integration |
|----------|-------------|
| Config differs from NSO | Compare `get_device_config` (NSO) vs pyATS `show running-config` (live) |
| Device inventory audit | Compare `get_device_platform` (NSO) vs NetBox records |
| Pre-change validation | NSO config baseline → ServiceNow CR → pyATS apply → NSO sync verify |
| Vulnerability scanning | `get_device_platform` (OS version) → NVD CVE search |
| Config backup to GitHub | `get_device_config` → github-ops commit to repo |

## Important Rules

- **NSO is the orchestration layer** — it manages device configs through RESTCONF/NETCONF, not CLI
- **Always check sync before trusting config** — `check_device_sync` first
- **sync_from_device pulls FROM the device** — it overwrites NSO's CDB with what's actually on the device
- **Read-heavy operations are safe** — get_device_config, get_device_state, check_device_sync are non-destructive
- **sync_from_device modifies NSO CDB** — it's safe for the device but changes NSO's database
- **Record in GAIT** — log all NSO operations for audit trail

## Environment Variables

- `NSO_SCHEME` — http or https (default: http)
- `NSO_ADDRESS` — NSO server address (default: localhost)
- `NSO_PORT` — RESTCONF port (default: 8080)
- `NSO_USERNAME` — NSO username (default: admin)
- `NSO_PASSWORD` — NSO password (default: admin)
- `NSO_VERIFY` — Verify SSL certificate (default: true)
- `NSO_TIMEOUT` — Connection timeout in seconds (default: 10)