automateyournetwork/netclaw

NetClaw – An AI‑powered network‑engineering coworker

What it is – NetClaw is an autonomous “agent” that sits on top of the OpenClaw (or Hermes) runtime and talks to a large language model (default Claude) to automate day‑to‑day network‑operations tasks. It bundles 222 pre‑written “skills” and 165 MCP (Managed‑Component‑Provider) integrations that let the LLM invoke real network‑tool APIs, run commands on devices, query observability platforms, and push changes through ITSM systems.

Why it matters – Network teams spend most of their time gathering data from dozens of vendor APIs, correlating that data with source‑of‑truth databases (NetBox, Nautobot, ServiceNow, etc.), and manually applying configuration changes. NetClaw gives a single conversational interface (CLI TUI or browser HUD) that can:

monitor device health, routing protocols, and telemetry streams;
diagnose failures, audit security posture, and reconcile inventory;
execute vendor‑specific actions (Cisco ACI, Juniper PyEZ, Arista CVP, Meraki, Palo Alto, FortiManager, …);
drive change‑management workflows that are gated by ServiceNow/ITSM tickets;
visualise topology and live metrics in a Three.js 3‑D dashboard.

All of this is driven by LLM‑generated prompts that are guard‑railed by the DefenseClaw proxy and run inside NVIDIA OpenShell sandboxes, giving enterprise‑grade audit trails (GAIT immutable git log) and least‑privilege secret handling.

Core concepts

Concept	What it does
OpenClaw / Hermes runtime	Provides the agent framework, state storage, and the “skill” execution engine. NetClaw can run on either; the installer lets you pick.
MCP servers	Small micro‑services that expose vendor APIs (e.g., pyATS, NetBox, ServiceNow, Grafana). NetClaw registers 165 of them and calls them on demand.
Skills	Python‑style modules that translate a natural‑language request into a sequence of MCP calls. 222 skills cover monitoring, troubleshooting, configuration, security audit, lab simulation, cloud networking, etc.
Risk of NetClaws (iN2N)	A deployment pattern where a Border claw routes requests to a set of lightweight Member claws, each holding only a few skills. This reduces token/context usage, enforces least‑privilege secrets, and isolates failures.
Production mode	Hardened systemd units, kernel confinement, LLM guardrail (DefenseClaw), immutable GAIT audit, and optional TLS‑authenticated federation between multiple NetClaw instances.
Visual HUD	A browser‑based 3‑D dashboard that shows the live skill inventory, device topology, and integration status; you can chat with the agent directly from the UI.

Quick start (from the README)

# Clone and run the interactive installer (no sudo!)
git clone https://github.com/automateyournetwork/netclaw.git
cd netclaw
./scripts/install.sh          # pick a profile or customise components

# Choose runtime (default = OpenClaw)
#   --runtime hermes   to use the Hermes agent instead

# After install, run the two‑phase setup
openclaw onboard               # pick LLM provider, gateway, chat channels
./scripts/setup.sh            # enter device credentials, identity info

# Start the gateway and the TUI
openclaw gateway &
openclaw tui

Profiles let you install a curated subset (e.g., Recommended, Cisco, Multivendor, Cloud, Security, Labs, Observability, Minimal, or Everything). Non‑interactive installs are also supported with --profile or --components flags.

What you can ask NetClaw to do

Health checks – “Show CPU and interface errors for all routers.”
Routing analysis – “Explain why route X is not being selected in BGP.”
Security audit – “List any ACLs that permit traffic from 10.0.0.0/8 to the DMZ.”
Source‑of‑truth reconciliation – “Find devices in NetBox that are missing from the live inventory.”
Change execution – “Open a ServiceNow change, push the new OSPF area config to device R1, and verify adjacency.”
Lab simulation – “Spin up a Cisco CML topology, run a BGP convergence test, and export the results.”
Observability queries – “Plot interface‑in‑bytes for switch SW1 over the last 24 h from Prometheus.”
Cloud networking – “Create a new VPC‑peering between AWS and Azure, then update the route tables.”
Security tooling – “Run a nmap scan on 192.168.10.0/24 and summarize open ports.”
Federated operation – “Connect to a peer NetClaw instance and request a BGP‑policy audit from its Border claw.”

All responses are accompanied by audit entries (GAIT git commits) and, when enabled, LLM guardrail logs that record the original prompt, the model’s output, and the executed tool calls.

Security & compliance features

DefenseClaw LLM guardrail – a Go proxy that inspects every prompt/response for policy violations before the model runs.
OpenShell sandbox – Docker‑based containers with YAML‑defined file‑system and network policies for each skill.
Immutable audit trail – GAIT stores every delegation in an append‑only Git repository (~/.openclaw/n2n/gait/).
TLS‑certified federation – optional ACME/Let’s Encrypt or pinned self‑signed certificates for Border‑Member communication (N2N_CERT_MODE).
Least‑privilege secret slices – each Member claw receives only the .env variables it needs; the master .env is hidden from the sandbox.
Production enforcement mode – N2N_RISK_MODE=production makes missing guards cause a hard failure rather than a warning.

Who would use this?

Audience	Value proposition
Large enterprise network ops	Consolidates dozens of vendor APIs into a single conversational interface, reduces manual ticket handling, and provides auditable, policy‑enforced automation.
Managed‑service providers	Can spin up a “risk of NetClaws” per customer, keeping credentials isolated while sharing the same underlying runtime.
Network test‑lab engineers	One‑click provisioning of CML, ContainerLab, Batfish, and traffic‑analysis tools, all controllable via chat.
Security teams	Integrated vulnerability scanning, firewall policy review, and LLM‑guarded execution to avoid accidental changes.
DevOps / SREs	Unified observability (Grafana, Prometheus, Loki, Kubeshark) and IaC‑style config‑as‑code via GitHub/GitLab pipelines.

Limitations (as described in the README)

The iN2N federation subsystem is still OpenClaw‑only; Hermes does not yet support the mesh daemon.
Running a full “Everything” profile pulls in hundreds of MCP servers, which can be heavy on storage and may require careful API‑key management.
The visual HUD requires a running OpenClaw gateway and a modern browser; it is optional but not part of the core CLI workflow.
Production‑mode hardening relies on systemd user services and kernel confinement; on systems without systemd (e.g., some container‑only environments) those protections are unavailable.
The LLM guardrail is a separate Go process; if it crashes, NetClaw will refuse to delegate actions (fail‑closed), which may interrupt automation.

Bottom line

NetClaw is a real, open‑source AI agent that brings large‑language‑model‑driven automation to the full stack of modern network engineering—from device health monitoring to change‑management‑gated configuration, from on‑prem lab simulation to cloud networking, all wrapped in enterprise‑grade security and audit capabilities. Its modular installer lets you start small (a minimal pyATS + audit‑trail setup) or deploy the entire ecosystem, and the “risk of NetClaws” architecture offers a scalable way to keep token usage and secret exposure low while still leveraging a powerful LLM backend.