メニュー
Forward snapshot assurance, path search, app-aware path search, NQE, checks, vulnerabilities, diffs, configuration, lifecycle, collection, and topology workflows through the upstream forward-mcp server.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/automateyournetwork/netclaw --skill forwardコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | forward |
| description | Forward snapshot assurance, path search, app-aware path search, NQE, checks, vulnerabilities, diffs, configuration, lifecycle, collection, and topology workflows through the upstream forward-mcp server. |
| version | 1.0.0 |
| license | Apache-2.0 |
| author | forward |
| tags | ["forward","assurance","nqe","paths","diffs","collection"] |
| mcp_servers | ["forward-mcp"] |
| metadata | {"openclaw":{"requires":{"bins":"[Truncated]","env":"[Truncated]"}}} |
Skill: : :
/forwardforward-mcpUse this skill for Forward snapshot assurance, collection, and analysis:
get_default_settings to see configured defaults.list_networks with a small limit and ask
the user which network to use.network_id and snapshot_id values for repeatable results.all_results only when the user needs the
complete dataset.FORWARD_API_BASE_URL=https://fwd.app and set
FORWARD_INSTANCE_ID for local cache partitioning when multiple SaaS orgs or
accounts are used on the same NetClaw host.| User intent | Preferred tools |
|---|---|
| "List Forward networks" | list_networks |
| "Use this network by default" | set_default_network |
| "Show collection sources" | list_classic_devices, get_classic_device |
| "Add lab devices" | upsert_classic_devices |
| "Show collector status" | get_collector_status |
| "Start collection" | start_collection_task, get_collector_task, then wait_for_latest_snapshot; use start_collection only for legacy flows |
| "Show snapshots" | list_snapshots, get_latest_snapshot |
| "List devices" | list_devices, get_device_basic_info |
| "Find missing collection neighbors" | get_missing_devices |
| "Trace paths" | search_paths_bulk, then search_paths for one-off traces |
| "Trace app-aware paths" | list_l7_applications, then search_paths_bulk or search_paths with app_id, url, or domain |
| "Show blast radius" | suggest_blast_radius_sources, then get_blast_radius |
| "Find NQE checks" | search_nqe_queries, list_nqe_queries |
| "Run an NQE check" | run_nqe_query_by_id; use start_nqe_query for long-running checks |
| "Write or run ad-hoc NQE" | Prefer search_nqe_queries first; use run_nqe_query only when no built-in query fits and async NQE for long-running or large results |
| "Show predefined checks" | list_predefined_checks |
| "Show failed checks or intent status" | list_checks, then get_check |
| "Show vulnerabilities or CVE exposure" | search_nqe_queries, then run_nqe_query_by_id with the /Security/CVEs/... query IDs |
| "Draw topology from Forward" | get_snapshot_topology, then search NQE for CDP/LLDP and protocol-peer evidence when needed |
| "Summarize large results" | get_nqe_result_summary, get_nqe_result_chunks, analyze_nqe_result_sql |
| "Search configs" | search_configs |
| "Compare NQE or intent/check results" | get_nqe_diff |
| "Summarize snapshot diffs" | get_snapshot_diff_summary |
| "Show route, ACL, NAT, interface, check, or vulnerability diffs" | get_snapshot_diff |
| "Compare snapshots/configs" | get_config_diff |
| "Check hardware or OS support" | get_device_hardware, get_hardware_support, get_os_support |
| "Show locations" | list_locations, get_device_locations |
Forward MCP owns the NQE catalog. Do not copy catalog contents into NetClaw. For natural-language NQE requests:
get_device_basic_info, get_device_hardware, get_hardware_support, or
get_os_support.search_nqe_queries with the user's intent.list_nqe_queries only when the directory or query family is already
known.FQ_... query ID in the answer and execute it with
run_nqe_query_by_id.Use run_nqe_query for ad-hoc NQE source only after checking whether a
built-in query already answers the question and the expected result fits a
bounded synchronous call. For long-running or large queries, use
start_nqe_query, poll get_nqe_query_status, then fetch rows with
get_nqe_query_result. These execute raw NQE or query IDs through Forward's
native NQE APIs; they do not create or save a new query in the NQE Library. Keep
ad-hoc queries narrow, set limits by default, and explain when the result is
from custom source rather than a built-in Forward query. Use all_results: true
only when the user needs the complete table.
Prefer built-in query IDs when they fit. When a question needs raw NQE, build it incrementally and execute it through Forward MCP:
foreach d in network.devices select { Name: d.name }.start_nqe_query, poll
get_nqe_query_status, and page with get_nqe_query_result.NatType.LB; data-bearing OneOf values use when ... is.Useful raw NQE patterns:
On-prem load balancer VIPs, DNAT-style rewrites, and backend targets:
foreach device in network.devices
foreach natEntry in device.natEntries
where natEntry.natType == NatType.LB
foreach rewrite in natEntry.rewrites
select {
LoadBalancer: device.name,
Vip: natEntry.headerMatches.ipv4Dst,
Ports: natEntry.headerMatches.tpDst,
Backends: rewrite.ipv4Dst,
BackendPorts: rewrite.tpDst
}
Other VIPs in the same subnet:
targetSubnet = ipSubnet("110.240.240.0/24");
foreach device in network.devices
foreach natEntry in device.natEntries
where natEntry.natType == NatType.LB
foreach vip in natEntry.headerMatches.ipv4Dst
where vip in targetSubnet
foreach rewrite in natEntry.rewrites
select {
LoadBalancer: device.name,
Vip: vip,
Ports: natEntry.headerMatches.tpDst,
Backends: rewrite.ipv4Dst
}
Cloud VPC load balancers:
foreach cloudAccount in network.cloudAccounts
foreach vpc in cloudAccount.vpcs
foreach loadBalancer in vpc.loadBalancers
foreach rule in loadBalancer.loadBalancerRules
foreach backend in rule.backends
let server = when backend is
server(backendServerData) -> backendServerData;
otherwise -> null : BackendServer
where isPresent(server)
select {
CloudAccount: cloudAccount.name,
Vpc: vpc.name,
LoadBalancer: loadBalancer.name,
FrontendIps: rule.frontendIps,
FrontendPorts: rule.frontendPorts,
BackendIps: server.backendIps,
BackendPorts: server.backendPorts
}
VIP route propagation:
targetVip = ipSubnet("110.240.240.240/32");
foreach device in network.devices
foreach vrf in device.networkInstances
where isPresent(vrf.afts.ipv4Unicast)
foreach route in vrf.afts.ipv4Unicast.ipEntries
where targetVip in route.prefix
where length(route.prefix) >= 24
foreach nextHop in route.nextHops
select {
Device: device.name,
Vrf: vrf.name,
Prefix: route.prefix,
OriginProtocol: nextHop.originProtocol,
NextHopType: nextHop.nextHopType,
NextHopIp: nextHop.ipAddress,
Interface: nextHop.interfaceName
}
For topology, start with get_snapshot_topology for native directed links.
Then search for both link evidence and protocol-peer evidence when needed.
CDP/LLDP can describe physical neighbors; peer queries such as BGP can describe
relationships Forward models beyond discovery protocols.
If search_nqe_queries or list_nqe_queries reports that the query index is
empty, do this only in a persistent OpenClaw session and only after user
confirmation:
hydrate_database with regenerate_embeddings: false.refresh_query_index.search_nqe_queries or list_nqe_queries.Default to read-only Forward tools. Require explicit human confirmation before
tools that create, update, delete, clear, hydrate, rebuild, start/cancel
collection, or set persistent defaults. This includes collector/source,
credential, network, snapshot, location, entity/relation, observation, local
cache/index, and set_default_network operations. Creating new Forward
networks requires full org admin privileges; do not use create_network unless
the user explicitly confirms that role. Updating an existing Forward network
requires network admin privileges.
Never put Forward credentials in repository files. Use ~/.openclaw/.env.
For private CA deployments, use FORWARD_CA_CERT_PATH; do not disable TLS
verification.
get_snapshot_diff_summary first for a bounded overview.get_snapshot_diff for focused route, ACL, NAT, interface, check,
file/config, inventory-query, routing-loop, or vulnerability diffs.get_nqe_diff for arbitrary NQE and intent-style query diffs.get_config_diff when the user specifically asks for config text drift.suggest_blast_radius_sources if the source name or location filter is
uncertain.get_blast_radius with source_device for a device source, or source
when the prompt already supplies Forward LocationFilter JSON.dst_subnets, timeout_seconds, and paging_options bounded.search_paths_bulk for specific path traces.list_checks with statuses such as FAIL, WARN, or ERROR to
triage intent/check state for a snapshot.get_check for the detailed rows behind a specific failed check.list_predefined_checks when the user asks what built-in checks exist.search_nqe_queries for natural-language
discovery, then run_nqe_query_by_id./Security/CVEs/CVE violations by CVE, /Security/CVEs/CVE violations by device,
/Security/CVEs/CVE violation details by device, and
/Security/CVEs/Vendor CVE metadata.get_nqe_diff for CVE query drift between snapshots. Use
get_snapshot_diff with diff_type: "vulnerabilities" for the Forward
vulnerability diff domain.https://fwd.app/api/software/client?type=LINUX.get_collector_status and
list_classic_devices.start_collection_task, poll it with get_collector_task, then use
wait_for_latest_snapshot. Use start_collection only when task creation is
unavailable in the target deployment.start_collection, confirm the assigned Forward collector can reach
the target management network. If not, the missing step is collector
installation, assignment, or routing.