{"name":"netloop.ai","description":"Query network devices (switches, routers, APs, firewalls) in natural language through a CLI-based connector. Device access is **read-only by default** (`read_only: true` in the connector config); write operations require `read_only: false` and, when detected, trigger a Human-in-the-Loop approval flow — the task becomes `input-required` with a `config_change_approval` payload; use `confirm_change` to approve and execute. In **demo mode** (demo tenant / playground) write operations are never possible. Other actions are `submit_credential` (delivers the device login for an `input-required` credential task — it changes no device configuration) and `netloop_support_grant` (an admin action, MCP only, not exposed over A2A). Ask your question in plain language (name the device in the text or via metadata.host) — do NOT try to run raw CLI commands; the platform-appropriate command is chosen for you. Long tasks can run asynchronously (configuration.blocking:false) and be polled via tasks/get; task results are kept in memory for up to 10 minutes and then discarded — if a task is not ready within that window, re-issue the request. If the connector has no login for the target device, the task becomes input-required: deliver the device login encrypted (RSA-OAEP) with the submit_credential action (metadata.challenge_id + metadata.blob), then re-send your original request, or continue the task that returned input-required by its taskId. Usage guide: https://netloop.ai/agents.md (MCP clients can also load the prompt `netloop_usage`). This is A2A spec v1.0; the transport is JSON-RPC 2.0.","supportedInterfaces":[{"url":"https://a2a.netloop.ai/a2a","protocolBinding":"JSONRPC","protocolVersion":"1.0"}],"provider":{"organization":"netloop.ai","url":"https://netloop.ai"},"version":"1.0","capabilities":{"streaming":false,"pushNotifications":false,"extendedAgentCard":false,"extensions":[{"uri":"https://netloop.ai/agents.md#request-parameters-a2a","description":"netloop.ai A2A request fields and task outcomes (see agents.md).","required":false,"params":{"metadata":["skill","host","connect_token","include_raw","include_version","include_docs","challenge_id","blob","plan_id","approve","save"],"message":["taskId","contextId"],"configuration":["blocking"],"skill_values":["identify_platform","netloop_ask","netloop_fetch","netloop_explain","netloop_path","netloop_vuln","vendor_lookup","skill_lookup","acronym_lookup","netloop_commands","submit_credential","connector_health","confirm_change"],"outcomes":["device_rejected","generation_failed","invalid_request","timeout","expired","canceled","credentials_warming_up"]}}]},"securitySchemes":{"bearer":{"httpAuthSecurityScheme":{"scheme":"Bearer","bearerFormat":"auth_token"}}},"securityRequirements":[{"schemes":{"bearer":{}}}],"defaultInputModes":["text/plain"],"defaultOutputModes":["text/plain"],"skills":[{"id":"identify_platform","name":"Identify platform","description":"Identify the platform/vendor of a reachable network device (probe of the device's version output). Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue.","tags":["network","discovery","read-only-by-default"],"examples":["Identify the platform of 192.0.2.10"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_ask","name":"Ask a device (natural language)","description":"Answer a natural-language question about a reachable network device. Best quality, slower. Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue. A configuration-change (write) request parks the task in `input-required` too, with a `config_change_approval` data part (`plan_id`, `commands`, `save_mode`); nothing is sent until you approve it via the `confirm_change` skill. Tell the two apart by the `data` part: `config_change_approval` = approval needed, `credentials_required` = login needed.","tags":["network","question","read-only-by-default"],"examples":["Which VLANs are configured on 192.0.2.10?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_fetch","name":"Fetch device output","description":"Run a CLI command on a reachable network device and return the raw output. Faster than a natural-language question. Read-only by default; write commands are blocked unless the connector has `read_only: false`. Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue. A configuration-change (write) request parks the task in `input-required` too, with a `config_change_approval` data part (`plan_id`, `commands`, `save_mode`); nothing is sent until you approve it via the `confirm_change` skill. Tell the two apart by the `data` part: `config_change_approval` = approval needed, `credentials_required` = login needed.","tags":["network","cli","read-only-by-default"],"examples":["Run 'show version' on 192.0.2.10"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_explain","name":"Explain device output","description":"Interpret a network device's output using the documentation database (standard show commands only). Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue.","tags":["network","explain","read-only-by-default"],"examples":["Explain 'show interfaces' on 192.0.2.10"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_path","name":"Show network path","description":"Show the network path from a device up to the Internet (short ASCII path + `netloop.path/v2` JSON graph — nodes/links/path), or, with a target IP/MAC, where that device hangs (port annotation; only the involved devices). Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue.","tags":["network","topology","path","read-only-by-default"],"examples":["Show the path of 192.0.2.10 to the Internet","Where is the device 00:1B:44:11:3A:B7 connected?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_vuln","name":"Network vulnerability check","description":"Match a device's platform + firmware against the ENISA EUVD advisory database and return a deterministic verdict (affected / not_affected / unknown). Over A2A the default is the netloop.vuln/v1 JSON (CVSS, severity, KEV, EPSS and the CVSS vector per finding); `metadata.format=\"table\"` returns the human markdown table instead (fixed CVSS bands with a traffic-light emoji, linked CVE, short description, recommendation related to the device's version). Informational only, test phase - not a scan/pen-test, and never \"the device is safe\": no matching advisories is not proof of absence. Requires a device login — if the connector has no stored login for the target, the first call becomes input-required (`TASK_STATE_INPUT_REQUIRED`); deliver the login encrypted via the `submit_credential` action, then continue.","tags":["network","vulnerability","cve","advisory","read-only-by-default"],"examples":["Is 192.0.2.10 affected by known vulnerabilities?","Are there security advisories for the firmware of 192.0.2.10?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"vendor_lookup","name":"Look up MAC vendor","description":"Look up the hardware vendor for one or more MAC addresses (IEEE OUI registry). No device required.","tags":["network","mac","lookup","read-only"],"examples":["Which vendor owns 00:1B:44:11:3A:B7?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"skill_lookup","name":"Search documentation","description":"Search the vendor documentation / command database. No device required.","tags":["documentation","lookup","read-only"],"examples":["How do I configure PIM-SM on ArubaOS-Switch?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"acronym_lookup","name":"Expand an acronym","description":"Expand a network acronym/abbreviation from the vendor documentation (e.g. L2VNI -> Layer 2 VNI) and cite the source document. Deterministic dictionary, no device required.","tags":["documentation","acronym","lookup","read-only"],"examples":["What does L2VNI mean?","Expand EVPN (aoscx)"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"netloop_commands","name":"Look up documented commands","description":"List the CLI commands documented for a platform (deterministic index built from the vendor documentation), optionally filtered by a query; or validate a command against it. No device required.","tags":["documentation","commands","lookup","read-only"],"examples":["Which VLAN commands does aoscx document?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"submit_credential","name":"Submit device credential","description":"Deliver the target device's login for a task that is parked in input-required: send it encrypted (RSA-OAEP) as `metadata.challenge_id` + `metadata.blob` — never plaintext. This changes no device configuration.","tags":["credentials","input-required","auth"],"examples":["Deliver the encrypted login for the input-required task"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"connector_health","name":"Connector status","description":"List the connectors of your tenant and whether they are connected (masked id, label, connected since, connector version). No device required. Set `metadata.include_capabilities` to include what each connector is allowed to do.","tags":["connector","health","status","read-only"],"examples":["Which of my connectors are connected?"],"inputModes":["text/plain"],"outputModes":["text/plain"]},{"id":"confirm_change","name":"Confirm configuration change","description":"Approve or reject a pending configuration change (Human-in-the-Loop). When a write operation (config change, reboot, firmware update) is detected in `netloop_ask`/`netloop_fetch`, the task parks in input-required with a `config_change_approval` payload containing the `plan_id`, the `commands` (nothing is sent yet), `save_mode` and an `expires_in_seconds` window. Call this skill with `metadata.plan_id` (`metadata.approve: false` to reject, `metadata.save: true` to also persist the change in the same step) to execute or discard the change. On approval the result is a `data` part (`kind: config_change_result`: per-command status, a diff **excerpt** plus `diff_note`, `save_mode`, `saved`). Responsibility and the applicable terms are stated in https://netloop.ai/agents.md.","tags":["network","change","approval","hitl"],"examples":["Approve the pending configuration change plan p_abc123"],"inputModes":["text/plain"],"outputModes":["text/plain"]}],"documentationUrl":"https://netloop.ai/agents.md"}