AI integrations

MCP tool reference

Every tool on the hosted MCP server: what it answers, whether it reads or writes, and when it is listed. Generated from the tool catalog.

Updated November 3, 2026 · Latest terminal release: CLI 0.7.3

The hosted MCP server offers 41 tools. 38 are listed by default. The 3 write tools (propose_operations, submit_conversion, apply_mapping_answers) are listed only when NetConverter enables them for your tenant, and never in strict view. In strict view, 16 tools are listed. get_account reports how many tools your session has.

This page is generated from the tool catalog in the NetConverter code, so it changes when the catalog changes. For setup, sign-in and view modes, read the MCP server.

How job tools work

Most tools answer about one conversion job. Call list_jobs to see your recent jobs, then select_job with a job id; the selection is kept for 24 hours. You can also pass job_id to a single call. A job that does not exist, belongs to another tenant or has not been selected returns the same message.

Results follow your view mode: in the default view, IP addresses and CIDRs from your own jobs are shown; in strict view they are replaced with <ip> and <cidr>. Credential values are redacted in every view, and each result is limited to 64 KB.

Reading the tables

Column	Meaning
Kind	Read: answers a question and changes nothing. Session setting: stores your selected job or session view level, and changes no job. Write: starts new work, such as a conversion.
Needs a job	Whether the tool reads one job. Tools marked No work without one.
Listed	Default and strict: listed in both view modes. Default view: hidden in strict view. When enabled: a write tool, listed only when NetConverter enables the write tools for your tenant, never in strict view.

5 tools (kb_search, kb_explain, get_job_brief, search, fetch) send the query text, with secrets removed, to an outside embedding provider to search the knowledge base.

Knowledge base and search

Tool	What it answers	Needs a job	Kind	Listed
`kb_search` Search the migration knowledge base	Searches the NetConverter knowledge base for cross-vendor patterns, mappings and guidance. Takes `query` and an optional `top_k` of 1 to 10.	No	Read	Default and strict
`vendor_capability_lookup` Vendor capability lookup	Whether a feature is supported on a vendor platform. Takes `vendor`, `feature` and optional `technology`. Vendors: `cisco_asa`, `palo_alto_set`, `palo_alto_xml`, `palo_alto_panorama`, `fortinet`, `cisco_ios_xe`, `juniper_junos`, `aruba_cx`, `aruba_os`, `cisco_fmc`.	No	Read	Default and strict
`kb_explain` Explain from the knowledge base	Explains a config entity, selected lines or a feature using knowledge base documents, with citations and a coverage verdict of strong, weak or none. Takes `entity` and optional `focus` (`explain`, `use_cases`, `best_practices`, `all`).	No	Read	Default and strict
`search` Search jobs and knowledge	Searches the knowledge base and your jobs. Returns up to 20 results as `id`, `title`, `url`. Ids are `kb:<doc id>` or `job:<job id>`. The `url` values are NetConverter identifiers, not web links. This tool and `fetch` follow the shape that ChatGPT connectors require.	No	Read	Default and strict
`fetch` Fetch a search result	Returns one search result by id. A `kb:` id returns a knowledge base summary of up to 4 KB. A `job:` id returns the governed job summary: status, verdict, counts, abstracted findings and the list of evidence sections.	No	Read	Default and strict

Job selection

Tool	What it answers	Needs a job	Kind	Listed
`list_jobs` List my jobs	Recent conversion jobs for this account: job id, vendors, device type, status, created time. Optional `limit` of 1 to 25, default 10.	No	Read	Default and strict
`select_job` Select a job	Binds a job to your credential for 24 hours so later calls need no `job_id`. Returns the job's vendors and status.	No	Session setting	Default and strict
`set_view_level` Lower this session's view	Lowers the view for this MCP session for 24 hours: `none`, `masked` or `selected` give strict view, `full` gives your grant's view. Never shows more than your grant allows, and cannot be raised again in the same session. See View modes.	No	Session setting	Default and strict

Evidence and reports

Tool	What it answers	Needs a job	Kind	Listed
`get_target_config` Translated configuration summary	The post-translation target sections with counts and samples. Available only when a target result exists, so a blocked, validate-only or in-progress job returns a governed "not available" result. It returns samples, not the full configuration file. Hidden in strict view.	Yes	Read	Default view
`get_evidence` Validation evidence	The trust summary for a conversion. With no arguments: translation status, overall verdict and confidence, per-checkpoint pass or fail and severity counts, behavior check verdicts, NAT and flow proof counts, finding counts with abstracted titles, and an index of sections. Pass `section` to drill into one. `section='unparsed_lines'` lists the source lines the parser could not read, with their credential-redacted, address-tokenized text (at most 240 characters each); it is refused in strict view mode. Returns a governed "not available" result when evidence was not generated.	Yes	Read	Default and strict
`why_needs_review` Why this job needs review	One ranked answer to "why does this job need review?": blocking reasons for a blocked job, then each readiness check that holds the job (critical, review, advisory) with a count, up to five items, what to do and the `get_evidence` section to read next. `basis` is `ledger` for jobs converted on the current engine and `legacy_text_match` for older jobs, which are explained from their warning text. It never changes a job's status.	Yes	Read	Default and strict
`get_report` Job report	The validation or optimization report. `report_type` is `validation` (findings and warnings) or `optimization` (unused objects, redundant rules, cleanup). Returns a governed "not available" result when that report was not produced.	Yes	Read	Default and strict
`compare_against_intent` Compare against intent	A deterministic comparison of the job against an intent that is attached to it. It refuses if no intent is attached. Optional `focus`.	Yes	Read	Default view
`get_job_brief` Job overview	A job artifact by `focus`: `evidence`, `optimization`, `target` or `best_practice`. Optional `query`.	Yes	Read	Default and strict
`get_diagram` Get a branded diagram	Source or target diagrams bound to stored job evidence. Returns availability, coverage, provenance and authenticated download descriptors for SVG, PNG, PDF, editable draw.io and JSON. The download checks the expected evidence hash and current access/view level. Missing evidence remains unavailable; configuration-derived relationships do not prove live topology or traffic.	Yes	Read	Default and strict

Configuration summaries

Tool	What it answers	Needs a job	Kind	Listed
`get_interface_summary` Interface summary	Interface inventory: name, nameif, address, prefix, security level, zone, status, VLAN.	Yes	Read	Default view
`get_route_summary` Routing summary	Static routes (destination, gateway, administrative distance, metric), OSPF processes, BGP neighbors, EIGRP.	Yes	Read	Default view
`get_nat_summary` NAT summary	NAT rules with original and translated source and destination, services, zones, and an aggregation by type. Direction is given per rule.	Yes	Read	Default view
`get_acl_summary` Access-list summary	Up to 200 rules with action, zones, addresses and service, with aggregations by action and zone. The total count is always reported.	Yes	Read	Default view
`get_zone_summary` Security zone summary	All zones and their member interfaces.	Yes	Read	Default view
`get_object_summary` Address and service object summary	Networks, network groups, services and service groups, up to 100 each with full totals. Pass `object_type` (`networks`, `network_groups`, `services`, `service_groups`, `all`) to get one type complete, up to 500.	Yes	Read	Default view
`get_vpn_summary` VPN summary	IPsec tunnels (peer, subnets, IKE version, crypto, lifetime, PFS) and IKE policies. `data_quality` is `empty` when there is no VPN.	Yes	Read	Default view
`get_management_config` Management settings summary	Hostname, domain, NTP, SNMP, syslog and AAA. Credentials such as SNMP communities are redacted, with a count kept.	Yes	Read	Default view
`get_unused_objects` Unused objects	Objects that no rule or group references, with a total and a percentage. Top 100 names per section.	Yes	Read	Default view
`get_object_dependencies` Object dependencies	Everything that references `object_name`, one hop, with a `safe_to_delete` flag.	Yes	Read	Default view
`query_ir` Query the configuration model	A natural-language query over the parsed configuration, up to 50 matches plus aggregations. A fallback for when no purpose-built tool fits. Query up to 500 characters.	Yes	Read	Default view
`list_objects_with_attribute` Find objects by attribute	Objects by attribute: `ip_address`, `subnet`, `name_pattern`, `type`, `zone`, `interface` or `tag`. Takes `attribute` and `value`.	Yes	Read	Default view
`list_rules_matching` Find matching rules	Security rules that match a predicate: `src_zone`, `dst_zone`, `src_object`, `dst_object`, `service`, `action` (`allow` or `deny`).	Yes	Read	Default view

Flow simulation

Tool	What it answers	Needs a job	Kind	Listed
`simulate_flow` Simulate a traffic flow	A deterministic packet trace through ingress, zone, route, NAT, layer 4, application and rule evaluation. Returns a verdict and an evidence chain. `source_ip` and `destination_ip` accept an address or an object or host name from the job. A group name returns `needs_disambiguation`, and you re-call with a member. Optional `protocol` (default `tcp`), `destination_port`, `source_port` and `application`. The `application` field feeds App-ID on Palo Alto and is ignored for ASA and Fortinet. Full support for ASA, Palo Alto and Fortinet.	Yes	Read	Default view

Graph

Tool	What it answers	Needs a job	Kind	Listed
`get_dependency_chains` Dependency chains	Transitive dependencies of `object_name`, depth 1 to 3, default 2. Prefer this over `get_object_dependencies` for relationship questions.	Yes	Read	Default view
`get_critical_object_impact` Critical object impact	Blast radius of `object_name`: direct and indirect references, affected rule and NAT counts, and a severity of low, medium, high or critical.	Yes	Read	Default view
`get_translation_edge_summary` How objects were translated	Lineage of `object_name` from source to target objects, with confidence and job id. `limit` 1 to 50, default 10, and an average confidence.	Yes	Read	Default view

Guided mapping

Tool	What it answers	Needs a job	Kind	Listed
`get_mapping_questions` Mapping questions for a job	The decisions for a completed conversion or prescan: the target zone name for each source zone, the target port for each source interface, and options such as zone naming, the Palo Alto routing engine, an explicit deny-all rule, logging on all rules and cleanup. Each question has a `decision_id`, its options, the value the job used, a recommended value and the reason.	Yes	Read	Default and strict
`validate_mapping` Check mapping answers	Checks answers `[{decision_id, value}]` without applying them and lists errors by `decision_id` (unknown name, an interface where a zone is required, two interfaces on one port, an invalid value).	Yes	Read	Default and strict
`apply_mapping_answers` Apply mapping answers and re-convert	Validates the answers and, when all are valid, starts a new conversion of the same source with them. Returns the new job id. Nothing is applied if any answer is refused. Pass `idempotency_key` to make a retry safe. A write tool: listed only when NetConverter enables the write tools for your tenant, and never in strict view.	Yes	Write	When enabled

Account

Tool	What it answers	Needs a job	Kind	Listed
`get_account` My account and usage	Your MCP access: tier, sign-in kind, the view mode in force and what each mode means, how many tools your session has, the per-minute and daily request limits, and today's tool calls and attributed cost with what remains. Takes no arguments.	No	Read	Default and strict

Operations catalog

Tool	What it answers	Needs a job	Kind	Listed
`list_operations` Migration operations catalog	The migration operations you can select (cleanup, policy and routing changes). With `job_id` set to a prescan, or to a conversion built from one, each row shows whether it applies and whether it was decided. Without a job, pass `source_vendor`, `target_vendor` and `device_type`.	Optional	Read	Default view
`get_decision_document` Decision document (YAML v2)	The prescan's decision document: the current revision or revision N, its sha256, the revision list and the operations ledger. These are your decisions, not your configuration.	Yes	Read	Default view
`validate_decision_document` Validate decision document	Validates a stored revision exactly as the worker will and returns line-numbered errors.	Yes	Read	Default view
`propose_operations` Propose operations (new revision)	Write tool, off unless enabled for your tenant. Applies 1 to 50 catalogued changes to the decision document and stores a new revision. Each change is `{operation, parameters}`: `operation` is the `operation_id` of a `list_operations` row (`operation_id` is also accepted as the key), and `parameters` matches that row's `parameters` schema. Pass `base_sha256` so a concurrent edit is refused.	Yes	Write	When enabled
`submit_conversion` Submit conversion from prescan	Write tool, off unless enabled for your tenant. Queues a conversion from the prescan using a decision-document revision. Refuses with `decision_required`, queuing nothing, while a decision is still open.	Yes	Write	When enabled

Not available

No tool returns raw configuration text, changes or deletes an existing job, or connects to your devices. The hosted server cannot read files from your computer; the local bridge submits a selected file instead.

Source and release context: MCP server · Trust and AI data-use statement