SSH MCP Gives AI a Universal Key — OLAV Gives AI Constrained Capability

Giving an AI agent an SSH MCP tool lets it operate your core switch in three minutes. The question isn’t “can it” — it’s “do you know what it typed?”

The SSH MCP discussion has been heating up in the community. Engineers are excitedly hooking SSH into Claude Code, then hesitating over whether to give it the enable password. That’s not a security audit. That’s gambling.

This article isn’t about whether AI should operate networks. It’s about this: when you decide to let AI touch production, the shape of your tool interface defines your safety floor.

---

The Hallucination Death Spiral

SSH MCP’s core operation is dead simple: give the LLM a ssh_exec(command) function.

Here’s what happens next:

1. Agent calls ssh_exec("show running-config")
2. Device returns 8,000 lines of raw Cisco IOS configuration
3. A small model’s 8K context window fills instantly. Safety rules in the system prompt are truncated
4. The agent makes decisions on partial context it doesn’t know is partial
5. By step five, it’s operating on a network it no longer understands

We confirmed this experimentally. gemma4 31B with raw CLI output achieves 100% failure on write tasks. Not intermittent. Every. Single. Time.

OLAV’s fix isn’t a better prompt. It’s changing the granularity of tool output:

# What SSH MCP returns to the LLM:
NYC-core-1#show running-config
Building configuration...
Current configuration : 45821 bytes
! ... (8,000 lines of raw config) ...
end

# What OLAV returns to the LLM:
{
  "NYC-core-1": {
    "vendor": "cisco_ios",
    "version": "17.3.5",
    "interfaces": 48,
    "bgp_peers": 4,
    "ospf_areas": 3
  }
}

50 tokens versus 8,000. OLAV processes raw output in Python; the LLM receives only the structured summary it needs to decide. When details are required, the agent calls query_evidence or describe_table — pulling data on demand, never flooding the context window.

---

Safety That Doesn’t Live in a Prompt

Most SSH MCP setups model safety like this:

system prompt:
"You are a network engineer. Do not execute dangerous commands.
Never use write memory, reload, or erase."

Putting safety in a prompt means putting it in the one place small models are least reliable at enforcing. Our five-repeat experiment consistently showed: when the 8K context fills with raw CLI output, safety rules vanish with the truncated tokens.

OLAV’s 7-layer write protection requires no LLM compliance:

Layer	Mechanism	Enforced By
1	Read-only by default	Python hard lock
2	--enable-api-write global flag	Startup parameter
3	Per-service write permissions	Configuration file
4	Mandatory dry-run gate	Python enforcement
5	Config diff verification	DuckDB diff engine
6	CLAB simulation validation	Container-level data plane
7	Human approval	External confirmation

The LLM cannot bypass any layer. It doesn’t need to “remember” not to write memory — the system never grants it write access in the first place.

---

Don’t Hallucinate Network Behavior — Prove It

The biggest hidden cost of SSH MCP isn’t safety. It’s treating the LLM as the sole reasoning engine — forcing it to hallucinate network behavior it has no capacity to model.

When an agent sees a routing table through SSH MCP and asks, “will changing this route-map break my OSPF neighbors?” — the LLM says “probably not.” That’s a language model guessing at a mathematical problem it cannot model.

OLAV doesn’t guess. It calls batfish_q — Batfish mathematically computes whether your OSPF neighbors will survive the change. Not a confidence score. A proof.

The same pattern extends across the verification chain:

LLM generates change plan
  → Batfish diff: which BGP routes will change?
  → NetworkX blast radius: how many upstream devices?
  → CLAB simulation: run it in real containerized network OS images
  → diff_snapshots timeline: last known state before change
  → dry-run output → approval → execute

Every step is deterministic computation, not LLM “I think.” The gap between the two architectures is filled with Batfish’s control-plane mathematics, NetworkX’s graph algorithms, and CLAB’s real data-plane behavior.

---

Troubleshooting as Causal Chain, Not Guessing

SSH MCP troubleshooting is LLM-generated grep commands → skimming logs → guessing root cause. No audit trail. No reproducible reasoning path.

OLAV troubleshooting is a causal chain:

1. query_evidence("BGP neighbor down", sources=["syslog", "command_output"])
   → Pinpoints time T: BGP session dropped at 14:32:15

2. diff_snapshots(device="core-1", before=T-1h, after=T)
   → BGP peer-group remote-as was modified at 14:01:48

3. batfish_q("bgpSessionCheck", nodes=["core-1"])
   → Mathematical verification: the change broke the BGP session

4. NetworkX topology trace
   → Blast radius: 3 downstream leaf switches lost default route

Every step produces queryable, replayable artifacts. Not “the agent’s reasoning” — the chain of facts. diff_snapshots provides sub-second configuration timelines. query_evidence runs unified full-text search across syslog and command output. These tools transform troubleshooting from “the agent told me what it thinks” to “I can show you what happened.”

---

Tool Design Is Safety Design

The same model produces radically different outcomes depending on whether safety lives in prompts or in tool code:

Capability	SSH MCP	OLAV
Default permissions	Full shell access	Read-only, Python-enforced
Command execution	LLM types directly	Structured tool wrappers
Context cost	8,000 tokens/query (raw CLI)	50 tokens/query (structured)
Change verification	LLM guesses	Batfish mathematical proof
Topology analysis	LLM looks at diagram	NetworkX graph computation
Simulation	LLM imagines	CLAB container-level real behavior
History comparison	None	diff_snapshots sub-second timeline
Audit	Unknown what was typed	DuckDB — every tool call queryable
Memory	Starts fresh every time	AutoRecall + L1/L2 experience distillation

The core question was never “can AI operate networks?” It was always: is your safety in the prompt, or in the tool?

Prompts get truncated, forgotten, and priority-shifted out of the context window. Tools don’t.

---

OLAV is an open-source AI-native infrastructure operations platform. Read-only by default, write after approval, every step auditable. github.com/james-olavai/olav