# Switch Desk

> Paste one Cisco IOS / IOS-XE device's own output - `show running-config` and `show interfaces`,
> together or separately - and get either a configuration review with paste-ready remediation and a
> matching rollback, or a per-interface health read that says which layer each port is failing at.
> A free in-browser prescan runs first and costs nothing.

Live at https://switch-desk.skillsafe.ai/
API docs: https://switch-desk.skillsafe.ai/api.html
Token panel: https://switch-desk.skillsafe.ai/tokens.html

## What it is for

One engineer, one device, one maintenance window. The work object is the device's own show output -
nothing else is needed and nothing else is used. There is no topology, no SNMP poll, no login: you
paste the text you already have in your terminal buffer.

Two lanes read the same paste, selected by a `task` field:

- `task: "config"` - what is wrong with how this device is configured, the exact ordered command
  lines that fix each defect, a rollback for each one, the blast radius, whether it needs a
  maintenance window, and a change plan whose verification steps are read-only commands.
- `task: "health"` - which interfaces are actually failing, at which layer (physical, datalink,
  config, capacity, control-plane), the mechanism rather than the symptom, symptoms grouped into
  root causes with one read-only test that discriminates between rival causes, and a watch list of
  what is not broken yet.

The usual order is `health` first when something is broken now, `config` first when nothing is
broken and an audit is coming. Either lane's output can be handed to the other with one button.

## The free half runs in your browser and no model is involved

This is the part that distinguishes it from asking a chatbot to look at a config. Before anything is
sent anywhere, the page parses the paste and computes:

- **The config hierarchy** - every interface with its addressing, mode, VLANs, speed/duplex, ACL
  bindings and spanning-tree settings; every `line con/vty` block; the VLAN database; static routes;
  and every global hardening line.
- **Real subnet arithmetic** per addressed interface: network, broadcast, first and last usable
  host, host count. That is what catches the two mistakes nobody sees by eye - an interface
  addressed as its own network address, or as its own broadcast address.
- **Overlapping subnets** across every addressed interface in the same VRF, by masking both
  addresses to the shorter prefix and comparing.
- **Netmask and wildcard-mask contiguity.** A dotted mask is only a netmask when its bits run
  contiguously from the top, so `255.255.0.255` is reported as the typo it is instead of being
  quietly misread - and the same rule, inverted, catches `0.255.0.255` in an access list.
- **ACL rule shadowing**, proved arithmetically. A rule is shadowed when an earlier rule of the same
  protocol family, with no narrower port predicate, contains it on BOTH the source and the
  destination prefix. `permit ip 10.10.10.64 0.0.0.63 any` is dead behind
  `permit ip 10.10.10.0 0.0.0.255 any`, and the two strings share not one character - text
  comparison cannot find this.
- **ACLs applied but never defined** (a critical finding: an undefined ACL name behaves differently
  across platforms) and **defined but never applied**.
- **Counter rates, not totals.** Input and output errors, CRC, and drops are all expressed per
  million frames against that interface's own packet count, plus load against its own configured
  bandwidth and its reliability figure. 18,401 CRC errors across 800 million frames is background;
  the same 18,401 across 40,000 frames is a dead cable, and only the rate tells them apart.
- **The duplex-mismatch signature**, read properly: late collisions at all, collisions while
  operating full duplex, half duplex on a switched port, and a speed that negotiated below the
  port's own bandwidth.
- **Cross-reference between the two halves.** Configured interfaces missing from the show output,
  shown interfaces with no config block, and - the sharpest check available - a port configured
  `duplex full` or `speed 1000` whose show output reports something else. Neither half alone can
  find that.
- **Credentials by location, never by value.** Type-0 and type-7 passwords, SNMP communities and
  line passwords are counted and located. Nothing here decodes a type-7 string; it is reversible
  obfuscation, which is the reason to rotate every one of them rather than a puzzle to solve.

All of that is exportable for free, with no account: interfaces CSV, access-list CSV, counters CSV,
and the prescan as Markdown.

## The paid half, and how it is held accountable

The prescan's findings are passed into the run as facts with stable ids, and the reply is checked
back against them afterwards. Shown to you, in the page, every time:

- a prescan flag the answer never reconciled - and a `critical` one that goes unmentioned is called
  out by name;
- an interface the answer named that does not exist in either half of your paste;
- a prescan id the answer cited that was never raised;
- a health grade that contradicts what the port's own counters say;
- a `verify_command` or a root-cause `test` that is not a read-only command;
- generated configuration containing a destructive command, or a `shutdown` aimed at an interface
  this device's own description calls an uplink or a management port.

## Output contract

Both lanes return one JSON object with the same envelope: `task`, `title`, `posture`, `confidence`,
`verdict`, `exec_summary`, `assumptions[]`, `open_questions[]`, `coverage_check[]`, `artifacts[]`,
`next_steps[]`, `summary`.

`config` adds `findings[]` (id, severity, area, title, target, evidence, impact, `fix_lines[]`,
`rollback_lines[]`, risk_of_fix, window, refs, confidence), `acl_review[]` and `change_plan[]`, and
ships three artifacts: `remediation.cfg`, `rollback.cfg`, `verify.txt`.

`health` adds `interfaces[]` (name, grade, layer, cause, evidence, `counters_cited[]`, remedy,
confidence), `root_causes[]` and `watch_list[]`, and ships two artifacts: `triage.md`, `verify.txt`.

Full field tables, the error-code table and one worked example per lane in eight languages are at
/api.html.

## Limits, stated plainly

- It sees only the text you paste. No topology, no neighbour output, no logs, no traffic. A
  conclusion about the far end of a link is a hypothesis, and it arrives with a test attached.
- It generates configuration; it never applies it. Read every line first.
- It is tuned for Cisco IOS and IOS-XE syntax. NX-OS, IOS-XR and Arista EOS output will partly
  parse - the counter reader and the subnet arithmetic are largely portable, the config-hierarchy
  keywords are not.
- Running either lane costs credits; the whole prescan does not, and neither do the exports.
- Nothing you paste is stored unless you are signed in, in which case the review - not the raw
  paste beyond what fits a 64 KB record - is saved to your own account so it follows you to another
  browser.

## Sources

Derived from two agent skills published on SkillSafe, both by @affaan-m, from the
`everything-claude-code` collection:

- **@affaan-m/cisco-ios-patterns** - Cisco IOS and IOS-XE review patterns for show commands, config
  hierarchy, wildcard masks, ACL placement, interface hygiene and safe change-window validation.
  Drives the `config` lane.
- **@affaan-m/network-interface-health** - diagnosing interface errors, drops, CRC, duplex
  mismatch, flapping, speed-negotiation problems and counter trends on routers, switches and Linux
  hosts. Drives the `health` lane.

This is a derived work. It is not affiliated with those skills' author, and not affiliated with or
endorsed by Cisco Systems; Cisco, IOS and IOS-XE are trademarks of their owner.