Network Configurator

One Python file, no pip and no venv, that opens a small local UI and runs configuration jobs against the devices in your own inventory CSV. The free Lite tier covers show-command runs with per-device logging, a dry-run plan you read before anything is sent, and SecureCRT session export.

Pro adds config-mode pushes from a template with per-device variables, before and after diffs, saved job bundles, and scheduled runs. It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.

What it does

Single file, standard library only, runs on Python 3.9 or newer on macOS, Windows or Linux
Inventory CSV with extra columns as per-device template variables
Dry run on by default; a real config push asks for confirmation as well
Per-device command output written to a folder you choose
One JSON audit line per real change, written after it succeeds
SecureCRT session export: a zip of .ini files plus sessions.csv
Pro: templates, before/after diffs, saved jobs, scheduling

Lite vs Pro

Feature	Lite (free)	Pro
Inventory CSV (hostname, ip, platform, group)	Yes	Yes
Show-command runner with per-device output logging	Yes	Yes
Dry-run plan view: exactly what would be sent, to what	Yes	Yes
SecureCRT session export from the inventory	Yes	Yes
Custom command sets	—	Yes
Config-mode push from a template with per-device variables	—	Yes
Before/after diff of show output around a change	—	Yes
Saved job bundles	—	Yes
Scheduled runs	—	Yes

Download

Download Network Configurator 1.1.0

Zip with the app, config.env.example, and the README (46 KB). Or take the single file on its own: network-configurator.py.

Verify before you run it. SHA-256 (network-configurator.py) fdb551cf5a3948945e95498d9a6eb1aa4b5b477bedaca460ff5ae982891b7ef6 SHA-256 (network-configurator.zip) 24808bdfd3b8114947f8229683ee7785f4f4b50bfd60a967f2c56f38d4dd5f78

shasum -a 256 network-configurator.py

60-second quickstart

Unzip it anywhere. There is nothing to install: no pip, no venv.
cp config.env.example config.env and fill in the host and username for whatever you are pointing it at.
python3 network-configurator.py
Your browser opens on http://127.0.0.1:8781/. Any password you left blank is asked for once, at the prompt, and is never written to disk.
Point INVENTORY at a CSV and press Show plan. Dry run is on by default, so nothing leaves your machine until you turn it off and confirm.

Python 3.9 or newer, which includes the python3 already on macOS. Tested on 3.9 and 3.13.

The license key

Lite needs no key and no account. Pro unlocks with the same API key your CiscoTools Pro account already issues on the account page — there is no second key type and nothing extra to manage. Paste it into config.env as CISCOTOOLS_API_KEY and press Refresh license.

The app then calls the license endpoint once, sending your key and the app's version and nothing else: no inventory, no hostnames, no telemetry. It receives a grant signed with Ed25519, caches it, and verifies it offline for 30 days, so the app keeps working on an air-gapped jump box. After 30 days it asks again. If the subscription lapsed or the key was rotated, that refresh fails, the Pro cards lock, and every Lite feature keeps working exactly as before.

Where your data goes

It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.

Frequently asked questions

Does CiscoTools connect to my devices?

No. The app runs on your machine and talks to your devices over your own SSH client with your own credentials. The only thing that reaches ciscotools.dev is the license check, which carries your API key and the app version and nothing else.

What do I need installed?

macOS: python3 (3.9 or newer) and ssh are already there. Windows: Python 3.9 or newer from python.org or the Microsoft Store, and PuTTY (0.75 or newer) for its plink.exe, which the app uses for both password logins and key logins (Pageant or a .ppk key); Windows' built-in OpenSSH client cannot be driven by a program. Linux: python3 and openssh-client. There is nothing to pip install and no virtual environment on any of them.

Can it change a device by accident?

Dry run is on by default and a dry run opens no connection at all. Turning it off is still not enough: a config-mode push additionally requires an explicit confirmation, and every real change is written to an audit log after it succeeds.

What happens to Pro if my subscription lapses?

The cached grant is honoured offline for 30 days from the day it was issued. After that the app asks the server again; a lapsed or revoked key fails that check, the Pro cards lock, and Lite keeps working.

Where do SecureCRT sessions go on macOS, Windows and Linux?

Quit SecureCRT, then copy the Sessions folder from the zip into its sessions folder. macOS: press Shift-Cmd-G in Finder and go to ~/Library/Application Support/VanDyke/SecureCRT/Config/Sessions/. Windows: %APPDATA%\VanDyke\Config\Sessions\. Linux: ~/.vandyke/SecureCRT/Config/Sessions/. No password is stored in the exported files.

Open Network Configurator (download) in the app

All tools: CiscoTools.dev · Config Diff · IOS to NX-OS Translator · Config Sanitizer · Template Manager · Subnet and VLAN Planner · Config Compliance Checker · BGP Best-Path Explainer · Interface Cleanup Auditor · Network Script Builder · SanitizeDrop (Desktop) · NetOps Widgets (download) · Pro