NetOps Widgets
One Python file, no pip and no venv, that opens a local dashboard of widget cards for the controller work that eats an afternoon. The free Lite tier is read only: the Catalyst Center device picker, port status, find-a-MAC, and SecureCRT session export from the inventory. Pro adds the writes: ISE endpoint pushes for MAB with MAC normalize, dedupe, and the bulk path at 20 or more, and Windows DHCP reservations over SSH. It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.
Open the NetOps Widgets pageWhat it does
- Single file, standard library only, runs on the python3 already on your Mac
- Catalyst Center Intent API v1 with token auth, read paths only
- Find a MAC in any spelling: dots, colons, hyphens, or bare hex
- SecureCRT session export: a zip of .ini files plus sessions.csv
- Pro: ISE MAB endpoint groups, create-or-update, bulk submit at 20 or more
- Pro: every MAC reported by ISE identity group NAME, and a push that changes a MAC's group names both groups before you confirm it
- Pro: Windows DHCP reservations with every PowerShell argument allowlisted
- Dry run on by default; a real write needs a confirmation and is audited
Lite vs Pro
| Feature | Lite (free) | Pro |
|---|---|---|
| Catalyst Center device picker (Intent API v1, read only) | Yes | Yes |
| Port status for a selected device | Yes | Yes |
| Find a MAC address across the fabric | Yes | Yes |
| SecureCRT session export from the Catalyst Center inventory | Yes | Yes |
| Cisco ISE endpoint push for MAB, create-or-update | — | Yes |
| MAC normalize and dedupe, bulk submit path at 20 or more | — | Yes |
| Every MAC reported by ISE identity group name, with group moves named before you confirm | — | Yes |
| Windows DHCP reservations over SSH and PowerShell | — | Yes |
| Audit log of every real write | — | Yes |
Download
Zip with the app, config.env.example, and the README
(42 KB). Or take the single file on its own:
netops-widgets.py.
Verify before you run it.
SHA-256 (netops-widgets.py) a58029a6bfe037155e858a0fdfd53e3bcfaa8f3dfa05cdb8ba91036df931e00c
SHA-256 (netops-widgets.zip) 90cbc1145dda7b427643363639da9e665113b9ddf184a097bf75551afab6609c
shasum -a 256 netops-widgets.py
60-second quickstart
- Unzip it anywhere. There is nothing to install: no pip, no venv.
cp config.env.example config.envand fill in the host and username for whatever you are pointing it at.python3 netops-widgets.py- Your browser opens on
http://127.0.0.1:8782/. Any password you left blank is asked for once, at the prompt, and is never written to disk. - Press Load inventory. Every write widget starts in dry run: it composes the exact request and shows it to you without sending it.
Python 3.9 or newer, which includes the python3 already on macOS. Tested on 3.9 and 3.13.
The license key
Lite needs no key and no account. Pro unlocks with the same API
key your CiscoTools Pro account already issues on the
account page — there is no second key type and
nothing extra to manage. Paste it into config.env as
CISCOTOOLS_API_KEY and press Refresh license.
The app then calls the license endpoint once, sending your key and the app's version and nothing else: no inventory, no hostnames, no telemetry. It receives a grant signed with Ed25519, caches it, and verifies it offline for 30 days, so the app keeps working on an air-gapped jump box. After 30 days it asks again. If the subscription lapsed or the key was rotated, that refresh fails, the Pro cards lock, and every Lite feature keeps working exactly as before.
Where your data goes
It runs on your machine, against your network, with your credentials. CiscoTools.dev never touches a device, never sees a credential, and never proxies a connection: we serve the file, the docs, and a license check.
Frequently asked
Does CiscoTools see my controllers?
No. Every call goes from your machine straight to your Catalyst Center, your ISE node, and your DHCP host. The only thing that reaches ciscotools.dev is the license check, which carries your API key and the app version and nothing else.
What permissions do the accounts need?
Catalyst Center: a read-only account is enough, because the app has no write path against it at all. ISE: the ERS Admin role, with ERS enabled on the node. DHCP: an account in DHCP Administrators on a Windows host running the OpenSSH server.
Can it write something I did not mean to write?
Dry run is on by default and composes the request without sending it. Turning it off is still not enough: every write path additionally requires an explicit confirmation, and a successful write appends one JSON line to the audit log.
How are MAC addresses handled?
Paste them in any format. They are normalised to colon-separated upper case, deduped with the order preserved, and anything that is not a unicast MAC is listed back to you as rejected rather than pushed. At 20 or more the app uses the ERS bulk submit path.
What happens to Pro if my subscription lapses?
The cached grant is honoured offline for 30 days from the day it was issued. After that the app asks the server again; a lapsed or revoked key fails that check, the Pro cards lock, and the Lite read widgets keep working.