Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/multivendor-raw-cli
Run a command on a device whose platform has no dedicated NetClaw server, and get its real output.
Passed 16 of 19 test cases with the skill, and 8 of 19 without it.
and 9 more in the full report
11 fixed8 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
Before invoking raw CLI execution on an unfamiliar device, what inventory field should be inspected to verify if a dedicated server exists?
| Checked | Without skill | With skill |
|---|---|---|
| Checks the owning_server attribute in inventory via list_devices. | Missed | Passed |
The instructions your model reads when the skill loads.
Run a command on a device whose platform has no dedicated NetClaw server, and get its real output.
MCP server: multivendor-cli-mcp · Tools: run_command, check_reachability
Refuses raw execution on Cisco and Juniper, naming pyats / junos-mcp. Those servers are richer for
their own platforms. Use list_devices and look at owning_server before reaching for this.
check_reachabilityOn any newly added device, run it first. It separates three failures that look identical in a generic error message and need three different fixes:
| Status | Means | Fix |
|---|---|---|
unreachable | TCP/port problem | network, or the device is down |
auth_failed | credentials resolved but rejected | check Vault path or env vars |
platform_mismatch | inventory platform ≠ reality, or no driver | correct the inventory |
not_found | device in no inventory source | add it |
Filtering is server-side and runs before connecting — a denied command never opens a session. In
read-only mode the first verb must be show/display/get/… Ordering: chaining is rejected first,
then per-platform destructive verbs, then the allowlist.
CLI wrappers are unwrapped and their inner command judged. On FRR the only read path is
vtysh -c "show ip route", whose first token is vtysh — so the wrapper is stripped and
show ip route is what gets evaluated. This means vtysh -c "configure terminal" is correctly
denied: allowlisting vtysh itself would have turned the wrapper into a config escape.
Aliases are normalised, so nokia_srl, srl and nokia_srlinux all resolve to the same policy — and
to the SR Linux-specific denylist rather than only the universal baseline.
Verified live against Nokia SR Linux (native CLI) and FRR (shell-hosted).
test cases passed, vs 8 / 19 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.