CloudLabBox
Try the free demo

Network automation lab 20 of 27

AI in network automation: an MCP tool server and reviewing AI-generated code

Build a read-only MCP server that gives an AI agent live interface, routing and configuration data from two routers, make it safe (allow-listed commands, secret redaction, untrusted device text), then catch the mistakes in an AI assistant's Netmiko script before they reach the network.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then Network Automation - CCNA and CCNP Automation guided labs, then 20 - AI in network automation - an MCP tool server and reviewing AI-generated code

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
3 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

Kestrel Freight's NOC wants to let an AI assistant answer questions such as "is r1's link to r2 up?" or "what does r2's routing table look like?" without giving it the keys to the network. The standard way to plug tools into AI assistants is the Model Context Protocol (MCP). You'll build the team's MCP server, netinfo: read-only tools backed by Netmiko and ntc-templates, with the guard rails a security review will ask for. Then you'll do the other half of the job: review a script an AI coding assistant wrote for r1, find what's wrong with it, and fix it properly.

DeviceAddressState at start
devbox10.10.20.10~/lab: netinfo_mcp.py (server starter), mcp_client.py (test client), inventory.yaml, ai_suggestion.py
r110.10.20.11Gi0/1 10.1.12.1/30, Lo0 10.255.0.1; no routing yet
r210.10.20.12Gi0/1 10.1.12.2/30, Lo0 10.255.0.2; OSPF area 0 ready; one interface description is hostile

What you’ll practise

  • Explain how an AI host, an MCP client and an MCP server work together, and what tools, resources and prompts are
  • Implement the MCP handshake and the tools/list and tools/call methods over JSON-RPC 2.0 on stdio
  • Expose network data as tools with JSON schemas and structured results
  • Defend an AI-facing tool against excessive agency, data leakage and indirect prompt injection
  • Evaluate AI-generated network code, find its errors and fix it with verification

The tasks

  1. Understand the architecture
  2. Implement the handshake and the two tool methods
  3. Call the tools
  4. Stop excessive agency: allow-list the commands
  5. Stop data leakage: redact secrets
  6. Recognise indirect prompt injection
  7. Review the AI assistant's script before running it
  8. Compare with FastMCP

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of AI in network automation - an MCP tool server and reviewing AI-generated code3 nodes and 1 network, 4 links. Every link is listed as text below the diagram.devboxr1r2Mgmteth0Gi0/1Gi0/1Gi0/0Gi0/0
3 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • devbox eth0 to Mgmt (network)
  • r1 Gi0/0 to Mgmt (network)
  • r2 Gi0/0 to Mgmt (network)
  • r1 Gi0/1 to r2 Gi0/1
Nodes in AI in network automation: an MCP tool server and reviewing AI-generated code, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
devboxEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
r1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
r2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Network Automation - CCNA and CCNP Automation guided labs.

  3. Open 20 - AI in network automation - an MCP tool server and reviewing AI-generated code and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network automation labs

All Network automation labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.