CliDeck MCP — Network Evidence Workbench

Turn real network evidence into version-aware, source-backed answers that people and WebMCP agents can inspect together.

Comment

CliDeck MCP — Network Evidence Workbench

One-line Summary

Turn real network evidence into version-aware, source-backed answers that a person and a WebMCP agent can inspect together without giving the agent hidden access to the complete file.

Problem

Network engineers regularly work from device output, configurations, logs, and vendor manuals. A general-purpose agent can reason about that material, but it may rely on stale command knowledge, mix guidance from the wrong platform, or lose the exact device and software context as the investigation changes.

Copying an entire configuration or manual into a chat is also a poor control boundary. The engineer needs to decide which evidence is shared, see what was redacted, and distinguish verified product results from the agent's own interpretation.

Solution

CliDeck's Network Evidence Workbench gives the engineer and browser agent one revision-safe case workspace. The engineer supplies a question and real device evidence, chooses the exact line or PDF-page window, and reviews local redaction before anything leaves the browser. CliDeck detects the device context and searches its active, version-aware network knowledge and operational workflows.

The browser agent discovers six narrowly scoped WebMCP tools for the same live case. It can analyze the selected evidence, search CliDeck, explain only the current sourced results, and track a real research task when the answer is unknown. Agent interpretation is visibly separated from official CliDeck results, and stale responses cannot overwrite a newer case.

The page never connects to a network device and never executes commands.

Why This Matters

This is a concrete example of a web application becoming better when people and agents use it together. The engineer keeps the controls that require judgment: which evidence to share, which context is correct, and whether a result is applicable. The agent gets a typed, current capability surface instead of guessing from pixels or asking the user to copy data back and forth.

For network operations, the difference is material. An answer for Cisco IOS XE 16.10 must not silently become an answer for NX-OS or for a newer release. The workbench carries model, operating-system, version, result revision, provenance, and case version through the interaction so that the collaboration remains inspectable.

How We Used AI

The browser agent uses WebMCP to reason over the current case and place a bounded interpretation beside CliDeck's deterministic results. The agent does not become the source of truth and does not receive the selected evidence until the person enables one explicit sharing control.

CliDeck's production knowledge-growth pipeline also uses isolated GPT-5.6 Luna runs for work that requires semantic judgment: discovering official material, analyzing ambiguous fragments, independent verification, and deep review. The deterministic core—not the model—enforces schemas, applicability, provenance, risk rules, conflict handling, quality thresholds, and immutable publication. Once published, a known answer is returned without a model call.

How We Used Codex

Codex was the primary engineering environment and collaborator throughout the project. During the challenge it helped replace an early artificial simulator with the real Network Evidence Workbench, design the WebMCP lifecycle, implement the React and TypeScript surface, add local text/PDF processing and redaction, connect the workbench to production MCP services, and build the evaluation and deployment workflow.

Codex also helped find and correct material boundary defects before release, including over-wide evidence exposure, incomplete structured-secret redaction, stale async updates, missing production grants, and cross-platform retrieval mixing. The final release was exercised against unit, integration, privacy, security, WebMCP lifecycle, product-evaluation, production smoke, and browser tests.

Key Features

  • Six stable WebMCP tools: read_network_case, analyze_network_case, search_network_case, present_network_case_analysis, start_case_research, and get_case_research_status.
  • A complete manual experience through ordinary controls when WebMCP is not available.
  • TXT, LOG, MD, CSV, JSON, JSONL, HTML, and text-layer PDF input with explicit file, page, line-window, and byte limits.
  • Local secret redaction before network requests, with a visible disclosure of the operational identifiers intentionally retained as diagnostic context.
  • A monotonically increasing case_version, request cancellation, and stale-result rejection across parsing, analysis, search, presentation, and research polling.
  • Version-aware knowledge and workflow retrieval with active-revision source metadata and honest nearest-version or cross-platform warnings.
  • A separate agent-analysis block whose citations are limited to the current result set.
  • Real tracked expert research for genuinely unknown questions, with idempotency and no task credential exposed to the browser agent.

Architecture

The public React/Vite application is served at /webmcp. Complete files and raw extracted text stay in browser memory. Only the explicit, locally redacted evidence window is sent through a byte-bounded same-origin JSON-RPC client to CliDeck's public MCP endpoint.

The six WebMCP tools are registered with document.modelContext.registerTool. Their React lifecycle carries WebMCP's AbortSignal into the same-origin MCP request and aborts registrations on unmount. The backend is TypeScript/Hono with PostgreSQL for immutable knowledge revisions, applicability, provenance, workflow retrieval, research tasks, audit, and publication state.

Testing Instructions

  1. Open https://mcp.clideck.com/webmcp in ChatGPT's in-app browser, or in a WebMCP-enabled Google Chrome browser.
  2. Click Load Cisco 16.10 sample, then Analyze evidence.
  3. Confirm that the detected context is Catalyst 9300 / IOS XE / 16.10 and the case version increases.
  4. Click Search knowledge. The closest EFSU guidance should be labelled as nearest guidance rather than an exact version match.
  5. Enable Share redacted evidence with browser agent and ask the agent to read the case and explain the current result. Its text should appear in the separate Browser agent analysis section.
  6. Click Load Cisco 17.8.1 sample, analyze, and search again. Confirm that the case version changes and the EFSU result now shows an applicable version range.
  7. Optionally upload a safe text-layer PDF or LOG, select a page/line window, and repeat the flow. Complete files remain local to the browser session.
  8. Ask a genuinely unanswered question and use Research this gap to see the real tracked research lifecycle.
  9. Click Reset and confirm that evidence, results, analysis, polling, and local file references are cleared.

No credentials are required for the public demo.

Public Demo Link

https://mcp.clideck.com/webmcp

Public Repository Link

https://github.com/SmartRoot7/clideck-mcp

The repository is public and includes a visible Apache-2.0 license, all source code, test suites, deployment scripts, and judge walkthrough instructions. Production knowledge and third-party manuals are intentionally not bundled.

Built With

Share this project:

Updates

Submission history