A multi-MCP NOC copilot on a ~200-device network

The challenge

Troubleshooting a fault means correlating config, state, syslog, alerts and topology across many devices, and it leans on senior engineers. A single investigation sends engineers between topology views, device CLI, logs and alerts. Tool integrations become a bottleneck, so teams want standard interfaces and the freedom to change models. A year earlier, at AutoCon2, CodiLime’s first assistant worked on three routers; Net-Inspector had to work on a 200-node network.

What was at risk:

• Slow triage that depends on a few senior engineers, constant context switching between tools, and tool integrations tied to a single model

What we did

• Built a ~200-device Containerlab network with a reactive topology UI and a chat frontend, and gave each workshop participant their own environment
• Wrote scripts that inject failures and misconfigurations, so participants diagnose real faults against the live lab
• Exposed ~30 tools through 5 MCP servers, one each for topology, control-plane queries, data-plane queries, syslog retrieval and alerts
• Implemented two agent patterns: a Power ReAct agent with all tools, and a Router agent that hands each question to a specialized ReAct agent per MCP domain
• Kept the same MCP tool layer under several LLM backends, so participants could switch models on the fly and compare quality, cost and latency

How it works

An engineer describes a symptom in the chat, and the agent gathers evidence from the network through MCP until it can name the likely cause.

1. Lab Each participant gets a Containerlab environment with a multi-node topology of about 200 devices, a reactive topology view and a chat frontend.
2. Fault Scripts inject failures and misconfigurations into the running network. The participant’s task is to find the root cause.
3. Tools Five MCP servers expose about 30 tools through standard interfaces: topology context, control-plane queries, data-plane queries, syslog retrieval from a collector, and alert queries.
4. Agent A LangChain ReAct agent picks tools on its own and reasons iteratively. In the Power pattern one agent holds all tools; in the Router pattern a router sends each step to a specialized agent for one MCP domain.
5. Diagnosis The agent correlates config and state with syslog and alerts and proposes the likely misconfiguration behind the symptom. Participants can change the LLM mid-session, choosing from four models with different reasoning capabilities, context windows and accuracy, and see how the choice affects diagnostic quality, speed and interpretability.

CodiLime later used Net-Inspector as the reference for securing MCP-connected agents on live networks, demonstrating role-based tool filtering, attribute-based access control, dynamic maintenance windows and end-to-end auditing.