Network Configurator

One Python file, no pip and no venv, that opens a small local UI and runs configuration jobs against the devices in your own inventory CSV. The free Lite tier covers show-command runs with per-device logging, a dry-run plan you read before anything is sent, and SecureCRT session export. Pro adds config-mode pushes from a template with per-device variables, before/after diffs, saved job bundles, and scheduled runs. It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.

Open the Network Configurator page

What it does

Single file, standard library only, runs on the python3 already on your Mac
Inventory CSV with extra columns as per-device template variables
Dry run on by default; a real config push asks for confirmation as well
Per-device command output written to a folder you choose
One JSON audit line per real change, written after it succeeds
SecureCRT session export: a zip of .ini files plus sessions.csv
Pro: templates, before/after diffs, saved jobs, scheduling

Lite vs Pro

Feature	Lite (free)	Pro
Inventory CSV (hostname, ip, platform, group)	Yes	Yes
Show-command runner with per-device output logging	Yes	Yes
Dry-run plan view: exactly what would be sent, to what	Yes	Yes
SecureCRT session export from the inventory	Yes	Yes
Custom command sets	—	Yes
Config-mode push from a template with per-device variables	—	Yes
Before/after diff of show output around a change	—	Yes
Saved job bundles	—	Yes
Scheduled runs	—	Yes

Download

Download Network Configurator 1.0.0

Zip with the app, config.env.example, and the README (40 KB). Or take the single file on its own: network-configurator.py.

Verify before you run it. SHA-256 (network-configurator.py) 4b70a62673cc28f506e64717f7bdc1c6912bb13d3a5c9f12eca52fa0295da6a4 SHA-256 (network-configurator.zip) 020dabe85ddec9e83f45d6028ee8c5bac6cb793926dbdc016288772ead0bcf71

shasum -a 256 network-configurator.py

60-second quickstart

Unzip it anywhere. There is nothing to install: no pip, no venv.
cp config.env.example config.env and fill in the host and username for whatever you are pointing it at.
python3 network-configurator.py
Your browser opens on http://127.0.0.1:8781/. Any password you left blank is asked for once, at the prompt, and is never written to disk.
Point INVENTORY at a CSV and press Show plan. Dry run is on by default, so nothing leaves your machine until you turn it off and confirm.

Python 3.9 or newer, which includes the python3 already on macOS. Tested on 3.9 and 3.13.

The license key

Lite needs no key and no account. Pro unlocks with the same API key your CiscoTools Pro account already issues on the account page — there is no second key type and nothing extra to manage. Paste it into config.env as CISCOTOOLS_API_KEY and press Refresh license.

The app then calls the license endpoint once, sending your key and the app's version and nothing else: no inventory, no hostnames, no telemetry. It receives a grant signed with Ed25519, caches it, and verifies it offline for 30 days, so the app keeps working on an air-gapped jump box. After 30 days it asks again. If the subscription lapsed or the key was rotated, that refresh fails, the Pro cards lock, and every Lite feature keeps working exactly as before.

Where your data goes

It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.

Frequently asked

Does CiscoTools connect to my devices?

No. The app runs on your machine and talks to your devices over your own SSH client with your own credentials. The only thing that reaches ciscotools.dev is the license check, which carries your API key and the app version and nothing else.

What do I need installed?

Python 3.9 or newer, which is already on macOS, plus the system ssh client. There is nothing to pip install and no virtual environment.

Can it change a device by accident?

Dry run is on by default and a dry run opens no connection at all. Turning it off is still not enough: a config-mode push additionally requires an explicit confirmation, and every real change is written to an audit log after it succeeds.

What happens to Pro if my subscription lapses?

The cached grant is honoured offline for 30 days from the day it was issued. After that the app asks the server again; a lapsed or revoked key fails that check, the Pro cards lock, and Lite keeps working.

Where do SecureCRT sessions go on macOS?

Quit SecureCRT, press Shift-Cmd-G in Finder, go to ~/Library/Application Support/VanDyke/SecureCRT/Config/Sessions/ and copy the Sessions folder from the zip into it. No password is stored in the exported files.