One Python file, no pip and no venv, that opens a local dashboard of widget cards for the controller work that eats an afternoon. The free Lite tier is read only: the Catalyst Center device picker, port status, find-a-MAC, and SecureCRT session export from the inventory.
Pro adds the writes: ISE endpoint pushes for MAB with MAC normalize, dedupe, and the bulk path at 20 or more, and Windows DHCP reservations over SSH. It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.
| Feature | Lite (free) | Pro |
|---|---|---|
| Catalyst Center device picker (Intent API v1, read only) | Yes | Yes |
| Port status for a selected device | Yes | Yes |
| Find a MAC address across the fabric | Yes | Yes |
| SecureCRT session export from the Catalyst Center inventory | Yes | Yes |
| Cisco ISE endpoint push for MAB, create-or-update | — | Yes |
| MAC normalize and dedupe, bulk submit path at 20 or more | — | Yes |
| Every MAC reported by ISE identity group name, with group moves named before you confirm | — | Yes |
| Windows DHCP reservations over SSH and PowerShell | — | Yes |
| Audit log of every real write | — | Yes |
Zip with the app, config.env.example, and the README
(42 KB). Or take the single file on its own:
netops-widgets.py.
Verify before you run it.
SHA-256 (netops-widgets.py) 67dafe8d3bf7b6c72e7445cf12a22df3c5d6d071967495e36581449a82d07252
SHA-256 (netops-widgets.zip) 8db298ebcb75f451ed18dd6f468c8dd07b8615dcaa3369dae54b3a9b8d513cde
shasum -a 256 netops-widgets.py
cp config.env.example config.env and fill in the
host and username for whatever you are pointing it at.python3 netops-widgets.pyhttp://127.0.0.1:8782/. Any
password you left blank is asked for once, at the prompt, and is
never written to disk.Python 3.9 or newer, which includes the python3 already on macOS. Tested on 3.9 and 3.13.
Lite needs no key and no account. Pro unlocks with the same API
key your CiscoTools Pro account already issues on the
account page — there is no second key type and
nothing extra to manage. Paste it into config.env as
CISCOTOOLS_API_KEY and press Refresh license.
The app then calls the license endpoint once, sending your key and the app's version and nothing else: no inventory, no hostnames, no telemetry. It receives a grant signed with Ed25519, caches it, and verifies it offline for 30 days, so the app keeps working on an air-gapped jump box. After 30 days it asks again. If the subscription lapsed or the key was rotated, that refresh fails, the Pro cards lock, and every Lite feature keeps working exactly as before.
It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.
No. Every call goes from your machine straight to your Catalyst Center, your ISE node, and your DHCP host. The only thing that reaches ciscotools.dev is the license check, which carries your API key and the app version and nothing else.
Python 3.9 or newer on macOS, Windows or Linux, and nothing to pip install. The Catalyst Center and ISE widgets are plain HTTPS. The DHCP widget uses your own ssh client with a key or ssh-agent (it never asks for or passes a password): built in on macOS and Linux. On Windows 10 and 11 it uses the built-in OpenSSH client, verified on Windows 11 with Python 3.9 and 3.13. Use a key loaded in ssh-agent, or a key file under the default name in your .ssh folder, because the ssh-agent service is off by default on Windows.
Catalyst Center: a read-only account is enough, because the app has no write path against it at all. ISE: the ERS Admin role, with ERS enabled on the node. DHCP: an account in DHCP Administrators on a Windows host running the OpenSSH server.
Dry run is on by default and composes the request without sending it. Turning it off is still not enough: every write path additionally requires an explicit confirmation, and a successful write appends one JSON line to the audit log.
Paste them in any format. They are normalised to colon-separated upper case, deduped with the order preserved, and anything that is not a unicast MAC is listed back to you as rejected rather than pushed. At 20 or more the app uses the ERS bulk submit path.
The cached grant is honoured offline for 30 days from the day it was issued. After that the app asks the server again; a lapsed or revoked key fails that check, the Pro cards lock, and the Lite read widgets keep working.
Open NetOps Widgets (download) in the app
All tools: CiscoTools.dev · Config Diff · IOS to NX-OS Translator · Config Sanitizer · Template Manager · Subnet and VLAN Planner · Config Compliance Checker · BGP Best-Path Explainer · Interface Cleanup Auditor · Network Script Builder · SanitizeDrop (Desktop) · Network Configurator (download) · Pro