In the next iteration of MCP, you could

actually write two lines of code to your

MCP server provided the open API specs

and it's going to basically build the

entire MCP server from the open API

spec. On top of it, we're introducing a

new piece to that which is MCP that will

remove a lot of and you'll see it. It's

going to take away a bunch of headache

and it's going to make your life so much

easier. If I was new to this break and I

don't know Splunk and I don't know Moroi

that well, this makes my job a lot

easier. Oh, absolutely. Everyone, I'm

back with Kareem. Kareem, great to have

you back on the show, man. Thanks for

having me, David. I love this cuz this

is not chitchat. This is a demo. Yes.

And hopefully, I understand correctly.

You're going to demo configuration of

devices using AI. I'm actually going to

demo self-healing network. Oh wow. Using

AI. Okay. You got to show us that. So we

talked about configuration. We talked

about configuration drift. You and I are

network engineers. Configuration drift

is a huge pain. So with the tools that

we have today, incorporating some of the

AI tools that we are being introduced

to, how do we take that, import it, and

bring it into our automation skills

without automation skills and have our

network fix itself? I love this because

it's a practical demonstration rather

than just talking. So take it away.

Okay. So, how much do you know what MCP

and what is MSUP? Now, I know what it

is, but a lot of people might not. So,

can you give us like sort of a breakdown

like what it is? Yeah. MCP is model

context protocol. And I want you to

think of MCP as basically this hole that

you open up in your LLM. So, it knows

about your world. We talked a little bit

before about ragging, right? when when

we rag uh an LLM, we upload documents to

chat GPT, so it knows and it knows the

context of what you're trying to to

query. Yeah. Right. With MCP, when it

comes to automation, it allows you to

open that that like that that little

hole into the LLM so you can feed it the

data that you care about and it's going

to make the the LLM aware of it. So,

it's a open- source protocol. It's a

client server protocol where you build a

server, you make these tools and that

server server available in the the

clients that we use. It could be claw

desktop, it could be chat GPT, it could

be your own uh LLM that you're running

on your local machine. As long as it

supports MCP in knows of your work, it

in some ways it's similar to an API,

right? Exactly. It's think of it as

that's perfect. It's an API endpoint for

your LL. Okay, great. So, we have

traditional APIs, but this is like APIs

for LLM. Yeah. And basically, you're

you're creating this API for the LLM to

ingest all the data from the different

data sources, and it makes it aware of

what you're trying to do. And this is

where it plays really nicely with

network automation. Yeah. So, when we

talk about network automation, we talked

about this for like a while for five

years ago, right? When we talked about

network automation, it's about, you

know, having this this script, this

automation layer on top of your your

network devices and your controllers

where you basically via uh

programmatically you're calling these

API endpoints, you're creating logic,

you're doing something with it, whether

it's getting a list of devices from your

network, looking at configuration from

your cattle, etc. You're doing all of

that. Now, on top of it, we're we're

introducing a new piece to that, which

is MCP that will remove a lot of and

you'll see it. It's going to take away a

bunch of headache and it's going to make

your life so much easier. You're selling

it. I you know, I was skeptical in the

beginning, but um but I am I'm a

believer now. Uh and and and I'm only

touching the surface on this and I

haven't even started yet. So, I want you

to think of the scenario, okay? Uh

you're a network engineer. uh you're

monitoring your network and uh you

realize typically in in an environment

in production, you probably have a

source of truth somewhere that's

documenting all your network and that

source of truth truth netbox or whatever

it is that you're using. Um you're

trying to keep your network config to

the source of truth and anytime it

drifts you either have to update the

source of truth or deny the drift

configuration objective. What takes the

network down our networks down is

configuration. Yeah. Now, what if we

introduce MCP to the current tools that

we have and have the agent itself

monitor that and if it detects a drift

when it not supposed to happen, it

reverts back to original setting. Oh, I

like that. So, in other words, the AI is

monitoring the network. Exactly. and

it's taking it's taking action for you

actions that you've thought and you told

it available at its surveys and it goes

back and reverts all of that for you and

this is what I've done. So I'm going to

show you a quick demo and I'm going to

show you once we we go through the demo

I'm going to show you what actually is

happening underneath the hood. So we're

looking at uh at cloud desktop claw I I

chose cloud desktop as my client. Um

they have a really nice uh LLM that I

can use a model that uh that's really

nice as well as it out of the boxes

supports MCP which is the protocol we

just talked about that I'm going to be

using in my network automate show.

Didn't they was it anthropic? Didn't

they create MCP? Yeah. So MCP the

protocol itself is uh anthropics and and

claude is anthropics version of uh uh um

model. So when we're looking at this I

you know I I brought in a couple of

pieces from a Cisco perspective here. We

have Splunk is you know for those who

don't know what Splunk is think of it

Splunk as a massive log server. Yeah.

Um, and I have I'm using Moroi dashboard

as my uh controller that manages my

devices. And what I've done is I' I've

hooked up Moroi dashboard to Splunk. So

whenever any events or any changes

happen in Moro, it just pushes that log

into into Splunk. Oh, nice. Now, if you

overlay AI on top of that and you use

MCP with the log server and with the

Moroi configuration, you can actually do

that entire cycle where you're

monitoring what's happening with your

network. Nice. Okay. So, I'm going to

start the prompt. And before we drill

into the the fun and cool nerdy stuff,

uh I'm going to start the prompt with um

this simple I'm going to start with this

simple prompt here where I'm going to

ask it. Okay. And let's have fun with

it. So, you know, your name is network

pharaoh. And what I want you to do is I

want you to look into my uh Splunk logs.

And I want you to look at only the Moroi

network where it's um where it's coming

the alerts from because I'm managing a

bunch of organizations. So I want to

specify on the network that I care about

as well as I want you to search for a

specific header into my Splunk. So if

you and I were doing this manually, we

would go into Splunk, log in, do a

search query, and we have to exactly

pinpoint which index the the the log is

saved in, and then have to do a lot of

labor there to get to it. And it's, you

know, searching the learning about

learning the Moroi query is not very

trivial. It's like, okay, so I'm going

to hand that off to the to the LLM and

I'm going to say, okay, do this for me.

So notice a couple of things. So it's

searching the exactly the instruction

that I gave it. It didn't find anything.

So it actually continues. She it says,

"Okay, I I didn't come back. It came

with an error. So what I'm going to do

is I'm going to expand out the search

quer." So it it figured this out on its

own. That's like an agent run it. Yeah.

I didn't have to tell it any look. I

just said go do it. It did the critical

those parts that we would be doing as

humans for us. It kept going. It used

some of the tools that's that's

available to say okay in Moroi instance

I have this list of indexes indexes that

I came back with and voila finally after

trial and error and tried different

things in my search query it came back

and said yep I found exactly what you're

looking for here's the JSON payload and

the response from my Splunk instance and

it printed out exactly what's happening

so look at this so network pharaoh

here's your latest Moroi This is it got

that wrong. The instruction was that

that the the AI is called network feral,

not me. But we'll we'll ignore that. So

if we're looking at this, it listed

what's going on with my my Moroi uh

network from a Splunk alerts. It told me

that as of today 12:46 p.m. Uh these are

the configuration. There's some settings

that have changed and I've changed them.

uh the IP addresses and uh I've changed

the name of some devices and it tells me

exactly which devices. It aggregated all

this data from my Morati log. So this is

simple because you're going to say okay

well this is cool but this is just me

reading logs. Yeah right now it also

summarizes but if I was new to this

right and I don't know Splunk and I

don't know Moroi that well this makes my

job a lot easier. Oh, absolutely,

absolutely. And it actually told me it

it if I were to do this in Splunk, and

if I can, you know, show you real quick,

here's a query that very similar to what

the AI has done for us. This is the

Splunk query that was returned. Look at

this. This is the data. This I'm not

going to know. Yeah. If you don't if you

don't know it. Yeah. This I mean, can

you Yep. Exactly. I mean, this is all

old text, new text on the device. It's

like you need to you need to find write

an elaborate query to get exactly what

you want. Okay. But now that we have AI

on top of it, the next logical step that

we should do and say is okay, I want you

to tell me side by side what changed in

my network and by who. So this is this

is part of what we were doing. Now I'm

I'm using Claude as a client to do this.

But it printed out a nice report for me.

That is great. It told me the changes,

my configuration changes. It told me who

changed them and when. And it gave me a

timeline of the changes. It told me

these are test cases that I was running

against my network. So this I've done

this. This was a demo that I did a

session that I was doing. So I was doing

those changes live and it gave you the

switch changes. But this is unacceptable

because you know this configuration

drift should not have happened. Um we

didn't use a source of truth for this.

There was no net box or anything

involved. So somebody manually went into

the the Moroi dashboard and made those

changes and we can't have that because

our network is probably now. So what do

we do? We got to fix it. Yeah. Now in

the old days to fix it what would you

have done? We would have gone into the

devices. We would have had to look at

the documentation, find out which VLANs

were deleted. What documentation?

Exactly. What documentation? It's

probably an Excel file somewhere, right?

So, it's just it's pain, right? I love

this because someone with your

experience or CCIE, you know, maybe for

them it's quicker to go and do it the

manual way, but if I'm just starting out

on the help desk or someone who's new to

this, I mean, that's a lot of knowledge

that you can just pull out very, very

easily. Absolutely. And all I needed to

know is the components, right? I needed

to know that I could I can search data

in Splunk and I needed to know that

there was an MCP MCP server for Splunk

and we'll talk about what that is in a

little bit here. And then I also needed

to know that I could change go back to

make changes to my network via Muraki

dash. But you could have taught someone

to write prompts like you can say here's

some standard prompts to find out what's

going on and they could learn from that.

It's much easier to learn that than it

is to learn all the APIs and everything

else. easily done something as here are

uh 10 prompts that you should use to

troubleshoot your network and copy paste

them and have the the agent configure it

and figure it out. So you said the

problem is now the network there's been

drift now we need to fix it now we need

to fix it. So I'm going to tell the AI

to say okay this kare scander shouldn't

have guys shouldn't have made any

changes to the network. What I want you

to do is I want you to revert back all

those changes for me. This on its own

it's going to know a couple of things.

Now, it's not going to go to Splunk to

make those changes because Splunk

doesn't manage my network. But it's

aware that it also has another MCP

server that's a Moroi MCP server that

allows it allows the AI to access those

APIs in Moro. And so by me telling it

this, it's going to go say, okay, based

on the analysis and the devices, here's

what I'm going to do. And I love this

because when when we traverse the code,

I want to show you this. First of all,

it knew that it needs to go get Moroi

organization. If you're familiar with

Moroi or if you're not familiar with

Moroi, the the way that Moroi works is

you have an organization within an

organization you have your uh network

and within your network you have the

different devices and network types.

Okay. So, in order via API, if I was

automating this, in order for me to go

do it, I have to go um find out what my

organization ID is by doing one API

call, traverse that JSON that I get

back, pull out the ID that I care about,

do a bunch of if and else statements,

and then I have to go from there, find

out the network ID, and then from the

network ID, I start pulling in the

devices so I can start reverting those

changes. This this AI does not know any

of that. It only knows that it has

access to to get organization. It knows

to get networks. So, and it did it it

made those jumps and those logics on its

own. So, it went out and it got a list

of organizations.

Next, it looked at the Moroi network

itself that we made changes to and

pulled the network ID followed by looked

at the devices cuz it has access to the

device IDs and figure out which device

the changes need to be reverted on.

That's amazing. You got to show us the

code in a moment because it's like it's

like magic. It's it's and it's done.

Look, so it told me that Kareem's first

change was this and Kareem's final

change with this. I've correlated the

changes. I've configured and I made the

changes and it reverted back to what it

originally was. I love this cuz this is

a nice demo of like LLMs and what they

powerful at doing. Y but they can't

configure a network. No, but now you're

interfacing it with your is it Python

code or something? It's pure Python

code. Wow, dude. And it's easy Python.

You got to show us. Okay, so you can see

how easy this is and how cool this is.

And if I go back before I show you dive

into the code, if I show you this was

the the change that happened. If I

refresh my network here, you could see

that it actually changed to the previous

value that it found into Splunk for us

automatically. And it probably changed

also the IP address and configuration in

there now. And this is a super simple

Yeah, see it changed all my gateways and

my uh IP LAN IP address. So you this is

a super simple example. It's a proof of

concept but exactly but imagine doing

this at scale. Yeah. Okay. Now let's

look at how easy and what it is that

happened underneath the hoodie. So first

of all there are two pieces. We have a

Splunk MCP server for logging for

logging and we have uh a Moroi MCP

serge. And the way that MCPA I mentioned

earlier it does two things. It does it's

a client server. So our client it was

this interface this this was our client

you needed to build a server for the LLM

to know of all the tools that it has

that it's available to it. So if I look

at anthropics uh cloud here and if I

click on this notice how it's aware of

two MCP servers. Yeah. Okay. the MCP

server for Splunk, it knows that it has

all these functions, these tools

available for it, which is things like

list index. And if you see when it was

correcting itself, it pulled a list of

index. Uh it does it did a query. So

there's a search splunk here. That's how

it searched our splunk. Then if we take

that and go over to our code itself and

and by the way, I'll share all this code

with uh with our audience here. So on

it's on your GitHub, right? It's on my

GitHub. So I'll make sure the link is

there. But if you if you look at this um

I'm using there's a couple pieces that

are important and and the code is is big

but it's simple. Um there are a couple

pieces that are important. Um there's

fast MCP. This is the Python library

that allows you to build that MCP

server. Now once you have fast MCP, you

define your schema. You tell it a whole

bunch of stuff that um honestly I just

got I found that MCP server. I just

needed to implement it against my ins

but I also needed to edit it a little

bit and I added some tools. So tools are

basically the functions that the LLM is

going to look for to execute some of the

things we ask it to do. Okay. And so you

see the MCP server is using async. It

has multiple ways to communicate from

the client back to the server. You know

I don't want to get into so much of

that. There's a lot of reading that you

need to learn to to get started with MCP

or at least write your MCP from scratch.

A bunch of MCP servers out there. You

never have to write anything.

But the the point is we're going to take

yours. Yeah, you can. Or take mine.

Absolutely. Exactly. You connect your

MCP server to your instance of uh Splunk

and all it's doing from this point on is

actually using the Splunk SDK to make

those API calls back and no logic

whatsoever. They're simple API calls.

Similarly for our Moroi and this I

actually wrote this Moro myself, the

Moroi MCP server itself because there

wasn't one out there or at least I

wasn't aware of one. But I want you to

look at this. So this is my Maro MCP.

Again, I'm using fast MCP. I am using

the Moroi SDK. I'm doing nothing more

than basically what we've been talking

to you about from an automation

perspective for the longest time where

I'm saying I'm instantiating

MCP. It's going to run on this uh IP

address. I'm also in starting a new

instance of uh the dashboard APIs and

all I did was I defined the tools for

the MCP and then basically I went and

made those tools those API calls

available to the LLM. So get

organization it's a simple go get me the

list of organizations. There's no logic

here. This is just a pure JSON dump

that's coming back to my API. get me the

networks. I'm not I'm not telling it,

hey, first you need to get the

organization, next you need to get

networks. I'm just making it available.

It made that decision. It influenced

from my prompt and from its knowledge.

But I mean, how does Claude actually

know this? Because I mean, this is very

specific to Cisco knowledge. I it it

must be trained on those APIs out there.

Um, Claude learned from my code that

these tools are available, but it has

the knowledge of Moroi API because it's

out there. It's been trained. Exactly.

And that's that's the power of having an

LLM at your fingertips. I mean, it's

amazing to see this. So, Kareem, Mom,

Slow, I have the LLM. How did did you

have to do something in Claude to link

it to this? What did you have to do?

Good question. It's the the simplest

thing that I needed to do is in my cloud

configuration um in the client

configuration cloud was just an option.

You can build your own client. It could

be anything, right? Um in my

configuration, I actually had to go

specify where the MCP server lives in my

cloud configuration itself. Basically, I

have a JSON here that that defines my

different MCP servers. It says Splunk

with the Splunk credentials lives in

this directory. Here's the this is

basically how it's executed. So it's

executed by running Python. This is the

Python file and this is where it lives

via standard IO. That's it. And

similarly for Moroi. It's just a Is this

an online LLM or is it a local LLM? That

this is an online. If you go download

cloud desktop, this is exactly where

you're going to go. Okay. So it's a

clawed client just like chat GBPD client

that's interfacing with the online

brains if you like. Y that your client

has a has that configuration that links

it to your MCP server. My local MCP

server and that MCP server has APIs that

it's talking to to Moroi and Splunk.

Exactly. Wow. And it it contextualized

all of that for the the brain that's in

the intern in the internet. And the

power here is you're using the LLM for

what it's really good at is passing all

this data coming back using its

pre-trained model to actually make sense

of all that data because imagine trying

to do this with APIs, man. And then the

APIs change. Exactly. And that's another

thing is API change. What's really cool

too and I haven't done it here. You'll

see it in some of my uh my blogs that I

release in the next iteration of MCP.

You could actually write two lines of

code to your MCP server provided the

open API specs and it's going to

basically build the entire M MCP server

from the open API specs. You're going to

show us how to do that at some point. At

some point yes that's next on my list

once I I I release all of that. That's

brilliant. So people I'm sure the same

as me, right? Where can I get this is so

your GitHub which we'll link below? Yep.

And I'm I have a I'm planning a Cisco

tutorial or blog or something blog write

up uh on our uh blogs.isco.com. I

started a new series called um the AI

break where you take a break and play

with AI. Um so that's uh the blog is

coming out. You will see I'm we're I'm

writing a step-by-step instructions on

Cisco U on how to implement and and do

all of this um outside of my blog. And

that's going to be a Cisco U tutorial.

It's going to probably be released in

about um two to three weeks from now. So

stay tuned for that. Make sure that you

check out our uh our social channels.

All of that on uh Cisco, Learn with

Cisco will all be shared there. If I

follow Learn with Cisco on X or

LinkedIn, etc. I'll see the these

notifications, right? All of that um

posts once the blogs go out and I will

make sure that in my blog you'll have

access to all this code. So for everyone

who's watching, I've put links below to

Kareem's GitHub and some other places

that you can follow. Kim, this is like

one of the best demos I've ever seen

because, you know, it's all this theory

talking, but to actually see it, I mean,

that's that's what that's what counts.

It's really cool. I'm super excited

about it and I think there's a lot of I

get excited when there's innovation and

there's a lot of innovation that could

happen here and and you see it and this

was not hard at all. If I do it, anybody

can. Yeah. Not all of us, but I I love

what you've done here. I mean, it's

brilliant. Thanks so much, man.

Appreciate it, man. Thank you.