Cisco Meraki Agent

What it can do

• Organization & inventoryThe org-wide view: what every device is doing right now, how uplinks are performing, what licensing and firmware look like, and what Meraki itself has flagged.8skills

  Read-only. It cannot schedule or cancel a firmware upgrade, claim, move, or renew a license, or acknowledge and close an alert. On a long list the read stops at our page cap, and the reply says so rather than coming back quietly short. Everything here runs inside one bound Meraki organization at a time — where a connection binds several, the ask has to name which.

  • The bound organization's own record — its name, the licensing model it runs under, and how it's managed.
  • Where every piece of hardware stands at this moment — online, alerting, offline or dormant — each row carrying its network and serial.
  • The same fleet seen as uptime instead of a status colour: availability state, device by device.
  • Packet loss and latency on every MX and Z uplink in the org, sampled over the last five minutes only — a live reading, not a trend line.
  • Licensing in summary — status, expiry, counts — and the one that answers for co-termination and per-device orgs alike.
  • Licensing broken out device by device; a co-termination org has no such list and returns a 404 instead, so the summary is the answer for those.
  • The firmware record for the org: what's scheduled, what's running, and what already landed.
  • What Meraki is raising on its own — devices down, uplinks struggling, config-drift signals — narrowable by severity and by category.
• Networks & clientsThe day-to-day layer: which networks exist, what hardware sits in each, and what has been connected to them lately.6skills

  Reading only — no network is created, renamed, tagged, or deleted, and no client is blocked, unblocked, or given a group policy. Client history reaches back 31 days at the outside; that ceiling is Meraki's, not a setting here.

  • Every network under the bound org, with its product types, tags, and timezone — and filterable by tag when a client uses them.
  • A single network's record, pulled straight by its N_ identifier.
  • The hardware inventory — model, serial, home network, firmware, and site address — narrowable to one model family such as MR, MS, or MX.
  • One device on its own, looked up by the serial on its label.
  • What has actually been on a network in a given window — usage, IP, VLAN, and how each one connected. A day unless you widen it, and 31 days is as far back as it goes.
  • A single connected device on a network, found either by its client id or by its MAC.
• WirelessSSID configuration and the health of what's associating to it — the aggregate number, and the individual failures underneath it.3skills

  SSIDs are readable and never writable: none is created, renamed, enabled, disabled, or re-keyed from here. Radio settings, RF profiles, and per-client wireless history aren't part of this surface. SSID responses can include pre-shared keys, so what comes back is treated as sensitive rather than something to paste into a summary.

  • The SSIDs configured on a wireless network — read-only, and worth handling carefully, because the response can carry admin pre-shared keys.
  • Association success against failure for a whole network over the window you choose — the health number you check before going hunting.
  • The failures behind that number, one event at a time, each pinned to the stage it broke at: association, authentication, DHCP, or DNS.
• SwitchingA switch's ports both ways round: how they're configured, and what they're doing right now.2skills

  Port configuration is read-only — no VLAN, PoE setting, or port name is written from here. The one thing a session can do to a port is cut its power and restore it, and that lives with the NOC actions.

  • How a switch's ports are set up — name, VLAN, enabled state, PoE — as configuration to read, never to rewrite.
  • The live half of the same switch: link and negotiated speed, error and warning counts, traffic, and the CDP/LLDP neighbour on the far end.
• Security applianceThe MX and Z side: WAN uplinks across the org, site-to-site VPN reachability, and how hard a single appliance is working.7skills

  Status and load only. Firewall rules, VPN configuration, traffic shaping, and content filtering are neither read nor changed here — if the answer is 'a rule is wrong', fixing it is still a dashboard job.

  • Every appliance's WAN interfaces across the org — IP, gateway, and whether the connection is genuinely up.
  • Site-to-site VPN seen org-wide, appliance by appliance, with each peer and whether it can currently be reached.
  • One MX's load score — the number that decides whether the box itself is the bottleneck.
  • Per-port configuration for an MX appliance network (enabled, VLAN, access policy) — read-only.
  • Static routes configured on an MX network.
  • DHCP subnet + lease-utilization info for an MX appliance.
  • RF profiles configured for MX-integrated wireless on a network.
• NOC actionsThe five device actions — each held back and refused by our server until a person switches it on, and none is switched on today — and the fetcher for a job that outran the call that started it.1skills

  None of it writes configuration: no setting, policy, or schedule changes. Ping, cable test, and port cycle run as Meraki jobs — the call waits around thirty seconds and, if the job is still going, hands back a job id to collect later instead of blocking. The tool itself does not request typed confirmation; review the targets in the separate Switchboard approval flow: a port cycle drops what's plugged into it, and a reboot takes the device off the network for 30–60 seconds.

  Writes: Five device operations, and nothing beyond them: send a ping from a Meraki device, cable-test named switch ports, power those ports off and back on, blink a chassis light, and reboot the device. That list is the complete write surface — the client refuses any other action path outright.

  • Collect a ping, cable test, or port cycle by its job id when the original call stopped waiting — a read, not a second run of the action.
• Agent & sessionWhat this connection is: the Meraki organizations it's bound to, and whether the key behind it still works.1skills

  Read-only, and it reports the binding rather than altering it — it cannot add an organization to the roster, swap the API key, or repair a connection Meraki has stopped accepting. When a key is revoked in the dashboard the next call fails and the connection is marked invalid; this is where that shows up.

  • Which Meraki organizations this connection binds, what the session is allowed to do, and whether the stored key is still valid and when it was last checked.
• Audit9skills
  • The org's configuration change log (who changed what, old/new value, when) — the primary audit trail.
  • Dashboard admins on the org and their access privileges. Contains admin email addresses — treat as sensitive, do not echo into shared summaries.
  • The org's login security policy (password requirements, 2FA enforcement, idle timeout, IP allowlisting).
  • Whether SAML SSO is enabled for the org dashboard.
  • The org's configured SAML identity providers. May include IdP metadata — treat as sensitive.
  • The org's SAML role mappings (which IdP role maps to which dashboard access level).
  • Recent Dashboard API request log for the org (path, method, admin/PAT, status, response time).
  • Aggregate API request volume/response-code breakdown for the org over a timespan.
  • The org's white-label / branding policies (custom logos, support contact overrides per admin group).
• Camera14skills
  • Video settings for an MV camera (external RTSP enabled, RTSP URL).
  • Video quality and retention settings for an MV camera (resolution, quality, motion-based retention).
  • MV Sense (computer vision) settings for a camera: enabled, sense API, audio detection.
  • Wireless uplink profiles configured on an MV camera.
  • A viewing link (video wall URL) for an MV camera, optionally at a given timestamp. The returned URL grants video access to whoever holds it — treat as sensitive, do not echo into shared summaries.
  • MV Sense analytics zones configured on a camera.
  • Person/vehicle entrance counts and time-in-zone history for one analytics zone.
  • Live MV Sense analytics state for a camera (current object counts).
  • Recent MV Sense analytics detections for a camera.
  • Summary MV Sense analytics (object counts over time) for a camera.
  • Custom analytics (customer-provided vision model) config for a camera, if configured.
  • Camera recording schedules configured on a network.
  • Camera-role permission sets defined for the org (who can view which cameras).
  • Onboarding/setup status for MV cameras across the org (video settings applied, wireless profile pushed).
• Security19skills
  • L3 outbound firewall rules for an MX network (protocol/src/dst/policy).
  • L7 application-layer firewall rules for an MX network.
  • Application categories/known apps available for L7 firewall rules on a network.
  • Outbound firewall rules applied when an MX is on its cellular (failover) uplink.
  • Inbound firewall rules for an MX network (WAN -> LAN).
  • Inbound firewall rules applied on the cellular uplink.
  • 1:1 NAT mappings configured on an MX network.
  • 1:many NAT mappings configured on an MX network.
  • Port-forwarding rules configured on an MX network.
  • Network-wide firewall settings (spoofed-IP protection mode, allowed IPs).
  • Firewall rules for Meraki-hosted services (web UI, SNMP, ICMP ping) on an MX network.
  • Content filtering config for an MX network (allowed/blocked URL patterns, blocked categories).
  • Content filtering categories available to block on a network.
  • Global traffic-shaping settings for an MX network (default rules, per-client bandwidth limits).
  • Custom traffic-shaping performance classes defined on a network.
  • Intrusion detection/prevention (IDS/IPS) settings for an MX network (mode, ruleset).
  • Advanced Malware Protection (AMP) settings for an MX network (mode, allowed-file-hash list).
  • IDS/IPS and AMP security events detected on an MX network over a timespan.
  • Air-Marshal rogue AP / rogue SSID / spoofed-network detections for a wireless network.
• Sensor8skills
  • Most recent reading of every metric for every MT sensor in the org.
  • Historical MT sensor readings over a timespan (org-wide, filterable).
  • MT sensor alert profiles configured on a network (thresholds, recipients).
  • One MT sensor alert profile by id.
  • MT sensor-to-device pairings (which sensor monitors which door/camera/switch) for a network.
  • The paired-device relationship for one MT sensor.
  • Past commands issued to an MT sensor (e.g. button-press-simulated actions) — history only, does not issue new ones.
  • One past MT sensor command by id, with its result status.
• Systems Manager12skills
  • Enrolled Systems Manager (MDM) devices on a network (owner, OS, tags, enrollment status).
  • CPU/memory/network performance history for one SM-managed device.
  • Cellular data usage history for one SM-managed device.
  • A device's installed certificates. Includes cert subjects/issuers — treat as sensitive, do not echo into shared summaries.
  • A device's network adapters (interface, MAC, IP).
  • A device's applied MDM restriction policies.
  • A device's OS-reported security center status (AV, firewall, disk encryption).
  • A desktop device's SM agent event log.
  • A device's installed applications (name, version, publisher) as reported to SM.
  • Configuration profiles (payloads) defined for Systems Manager on a network.
  • Systems Manager end users on a network (BYOD identities tied to devices).
  • Profiles assigned to one Systems Manager user, across their devices.

How it has been taught to work it

Playbooks are the vetted techniques a session loads for this platform — what to check, in what order, and what a number means before it is reported.

• Cisco Meraki domain model (per-client orgs, and why every call names one)Always when Meraki is attached. Its entity model, the multi-org binding that gates every call, the device families, and the read/device-ops/DARK-write boundary.
  Vetted Sep 2, 2026Always on
• Meraki appliance config & security reads — firewall, content filtering, traffic shaping, IDS/IPS, rogue APAuditing or reviewing an MX network's firewall rules (L3/L7/cellular/inbound/NAT/port forwarding), content filtering, traffic shaping, intrusion/malware protection, security events, rogue-AP (Air Marshal) detections, or basic appliance config (ports, static routes, DHCP, RF profiles).
  Vetted Sep 2, 2026
• Meraki camera (MV) reads — video/quality settings, MV Sense analytics, schedules, permissionsMV camera config (video settings, quality/retention, sense settings, wireless uplink profile), MV Sense analytics (zones, live/recent/overview counts, custom analytics), getting a video link, or org-level camera admin (recording schedules, view permissions, onboarding status).
  Vetted Sep 2, 2026
• Meraki device-ops — the safe diagnostics and the outage rulesRun a diagnostic on a Meraki device, ping from a device, cable test, blink/locate a device, reboot or power-cycle a port — and when NOT to.
  Vetted Sep 2, 2026
• Meraki network health — is a client's network up, and what's wrongIs client X's network healthy, what's down, device/uplink/wireless problems, alerts firing, network status check for one client or across clients.
  Vetted Aug 31, 2026
• Meraki org audit trail reads — config changes, admins, login security, SSO, API log, brandingWho changed what and when in a client's org, the dashboard admin roster and their access, the org's login/2FA/SSO posture, or recent Dashboard API request activity.
  Vetted Sep 2, 2026
• Meraki sensor (MT) reads — environmental readings, alert profiles, device pairings, command historyTemperature/humidity/water/door/CO2 (or other MT metric) readings, sensor alert thresholds, which device an MT sensor is paired to/monitors, or MT sensor command history.
  Vetted Sep 2, 2026
• Meraki Systems Manager (MDM) reads — enrolled devices, posture, profiles, usersMDM/endpoint posture questions answered via Meraki Systems Manager — enrolled device inventory, installed certs/apps, security-center (AV/firewall/disk encryption) status, network adapters, restriction policies, desktop logs, configuration profiles, or SM end users.
  Vetted Sep 2, 2026
• Querying Meraki — the merakiOrg rule, paging, and the live trapsAlways when Meraki is attached. The read + device-ops + DARK-write surface, resolving client→org→network→device, paging, scopes, and the co-term/PSK/VPN gotchas.
  Vetted Sep 2, 2026Always on