rConfig Iris · Draft · Private and Confidential · 15 slides
rConfig V8 · Iris · AI Center

rConfig Iris

The most fully featured AI in network configuration management. Ten capabilities in one governed place: AI that reads your network and explains it, and rConfig made available to the AI tools your engineers already use. Read-only to your network, on the model you choose.

Versionv1.2 draft
Available inrConfig V8.3 and later
EditionsPro Standard and above
Webrconfig.com/ai
Draft · Private and Confidential
Ask.Explain.Govern.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202601 / 15
Iris in one viewDraft · Private and Confidential

Ask your network a question. Get a clear answer.

Iris is the AI built into rConfig. It reads your network configs and explains them in plain words. It also lets the AI tools your team already uses read the same facts, safely. It never changes a device.

Inside rConfig · 4 assistantsAsk

Ask about a config, a change, a failed check or a setting. The answer shows up on the screen you are already on.

MCP server · 7 read-only toolsConnect

Claude Code, Codex, Cursor and other AI agents can read your network facts. They can look. They cannot touch.

Agent Skills · API-ready docsTeach

Your agents learn how rConfig works, so the scripts and reports they build are right first time.

13 AI providersChoose

Use the AI model you already trust. Run it in the cloud, or keep it fully inside your own network.

Each part helps. Together they do more.One real morning, start to finish.1. Iris spots itA change opened a firewall rule. Iris explains the risk in plain words.›2. Your agent widens itThrough MCP, it finds every other device with the same problem.›3. Work gets raisedTickets are opened, each with the config lines as proof.›4. It is all on recordWho asked, which model, and when. Ready for audit.
10AI capabilities, in one place
13AI providers to choose from
0per-prompt fees from rConfig
Neverwrites to a device
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202602 / 15
Our approach to AIDraft · Private and Confidential

AI helps. Your engineers decide.

It reads. It never writes.

Iris explains and suggests. It does not change a device. Write access stays closed until you choose to open it.

Your model. Your data.

Questions go straight from your server to the AI provider you picked. rConfig, the company, never sees your data.

It follows your rules.

Your existing roles decide who can use AI. Every question is logged, so there is always a record.

One step at a time.

Each stage has to be useful by itself and earn the next one. A wrong answer said with confidence breaks trust, so we start careful.

The network AI maturity modelFour steps. We tell you which one we are on.
4Autonomous OperationsGoverned jobs, end to end. The horizon.TMF L4-L5
3Supervised AutomationAI proposes. A person approves.TMF L3
2Augmented OperationsTuned to your standards. Still read-only.TMF L2
1Assisted InsightReads, explains, narrates. Read-only.rConfig is here today
Mapped to the TM Forum L0 to L5 scale. Full model: rconfig.com/ai/maturity-model
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202603 / 15
In rConfig · Config Analysis and ExplainDraft · Private and Confidential

Ask your network anything, in plain English

Type a question the way you would ask a colleague. Iris reads the configs and answers, and shows you the lines that prove it.

  • Where: the config viewer, on the device in front of you.
  • Across the estate: one question can cover every device.
  • Shows its work: each answer points at the exact config lines.
  • Great for new engineers: routing, ACLs and QoS explained line by line.
We are prepping for a PCI audit. Across all edge routers, which ones allow inbound management (SSH or Telnet) from outside the 10.0.0.0/8 management range?
I checked 48 edge routers. 6 permit inbound management from outside your management range. The worst is edge-rtr-11: its VTY ACL allows SSH from any, and Telnet is still enabled on the same lines.
edge-rtr-11 · running-config
line vty 0 4 transport input telnet ssh access-class 23 in ! permits any
6 of 48 exposedgrouped by severityevidence per device
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202604 / 15
In rConfig · Drift Detection and NarrationDraft · Private and Confidential

See what changed, and whether it matters

A diff shows red and green lines. Iris tells you what they mean. Small changes get a short note. Risky ones get flagged.

  • Where: the config changes panel.
  • Plain words: what changed between two versions.
  • Sorts the noise: routine change or real risk.
  • Knows the standards: CIS, NIST and ISO 27001 where they apply.
Simple change
core-sw-22 · v44 → v45
snmp-server community public RO
- ntp server 10.0.0.9
+ ntp server 10.0.0.12
Routine. An NTP server was repointed. No security impact.
Complex change
core-rtr-02 · v91 → v92
router bgp 65010
- neighbor 10.0.0.9 route-map DENY-TRANSIT in
+ neighbor 10.0.0.9 route-map ALLOW-ALL in
This one matters. The BGP inbound route-map changed from DENY-TRANSIT to ALLOW-ALL, which could leak transit routes to a peer. Flagged as high risk for review.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202605 / 15
In rConfig · Policy and Compliance NarrationDraft · Private and Confidential

Know why a check failed. Write the next rule faster.

Iris explains each pass and fail in plain words. It can also draft a new CIS or NIST style rule for a person to check.

  • Where: compliance results and the policy editor.
  • Explains results: why a device passed or failed.
  • Drafts rules: you review, then keep or bin.
  • The one thing it saves: an approved rule, to rConfig's own policy store. Never to a device.
Compliance · CIS L1 · core-sw-04
RuleResult
SSH timeout setPass
No Telnet inboundFail
AAA enabledPass
The Telnet rule failed because transport input still lists telnet. I have drafted a CIS-aligned rule to flag this fleet-wide. Review and save?
Draft rule readySaved only on approval
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202606 / 15
In rConfig · Optimization AssistantDraft · Private and Confidential

Get rConfig itself running at its best

Ask how to tune your rConfig server. Iris answers from the official rConfig docs, not from guesswork.

  • Where: the system optimisation settings.
  • Grounded: answers come from docs.rconfig.com.
  • Self-serve: no ticket, no waiting.
  • Advice only: you make the change.
How should I size queue workers for 5,000 devices?
For 5,000 devices on a nightly window, the docs recommend 8 to 12 workers with a 300s timeout. Your current setting is 4. Here is the relevant tuning section.
docs.rconfig.com · optimisation
# queue WORKERS=10 JOB_TIMEOUT=300 BATCH_SIZE=250
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202607 / 15
For your AI tools · MCP serverDraft · Private and Confidential

Let your AI agents read your network, safely

Claude Code, Codex, Cursor and Gemini CLI can ask rConfig for live facts, then carry on the job in your other tools.

  • Seven read-only tools: inventory, configs, history, diffs, search and compliance.
  • Look, do not touch: the server has no write tools.
  • Same rules as people: the agent sees only what its token's user may see.
  • Secure by default: streamable HTTP and SSE, with a bearer token shown once.
Claude Code · rConfig MCP + Jira
Audit our core switches for the CVE in the advisory, then open tickets for the affected ones.
rconfig · search_configs("version 15.2")
matched 34 devices running affected IOS
rconfig · get_compliance_status (batch)
12 of 34 also fail the hardening policy
jira · create_issue × 12
NET-4471 … NET-4482 created, linked to advisory
Done. 34 core switches run the affected release; 12 are also non-hardened and now have tickets, each with the config evidence attached.
get_devicessearch_configsget_config_diffget_compliance_status
rConfig supplies the truth; the agent orchestrates the rest. Read-only and token-scoped.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202608 / 15
For your AI tools · Agent SkillsDraft · Private and Confidential

Teach any agent how rConfig works

Download the rConfig Skill and load it into your agent. From then on it knows rConfig's terms and rules, so it gets the job right first time.

  • One package: download it from Iris, load it once.
  • Built-in know-how: devices, tasks, policies, naming.
  • Pairs with MCP: the Skill explains, MCP supplies live data.
  • Made for: integrators, MSPs and automation engineers.
Claude Code · rConfig Skill
Set up our new customer "Northwind": 120 devices from this CSV, nightly backups, CIS baseline.
skill · rconfig loaded
knows devices, tags, tasks, policies and your naming rules
rconfig api · import devices (120)
117 imported, 3 held back: no credentials set
rconfig api · create task "Northwind nightly" 02:00
task created, CIS policy attached
Northwind is ready. 117 devices back up tonight. Here are the 3 that still need credentials.
Works inClaude CodeCodexCursorGemini CLI
The Skill teaches the agent how rConfig works, so the job is right first time.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202609 / 15
For your AI tools · API-ready docsDraft · Private and Confidential

API docs your AI agents can read

Export the rConfig REST API as clean Markdown. Your agent reads it and writes calls that work, instead of guessing.

  • Written for agents: Markdown that an AI model can take in.
  • The whole REST API: everything needed to script rConfig.
  • Matches your version: exported from your own instance.
  • Right first time: real endpoints, not made-up ones.
Codex CLI · rConfig API docs
Write a script that lists every device whose backup failed last night, as a CSV.
read · api-docs/v2/docs.md
found the devices, tasks and config history endpoints
write · failed_backups.py
ran against your instance: 9 devices, CSV saved
failed_backups.py
import requests, csv r = requests.get(BASE + "/api/v2/devices", headers=AUTH, params={"status": "failed"}) for d in r.json()["data"]: out.writerow([d["device_name"], d["device_ip"]])
Real endpoints, read from your own instance. No guessing, no made-up calls.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202610 / 15
On your terms · Bring your own modelDraft · Private and Confidential

Use the AI model you already trust

rConfig does not host AI models. You connect your own, from 13 providers. Pick a cloud service, or run a local model that never leaves your building.

  • 11 cloud providers: use your own keys and contracts.
  • 2 self-hosted options: Ollama, or any OpenAI-compatible server.
  • Air-gapped ready: a local model makes zero outbound calls.
  • No extra fees: rConfig does not charge per prompt.
In the cloud · 11 providersone active at a time
AAnthropicClaude
OOpenAIGPT
AzAzure OpenAIyour deployment
BkAWS BedrockClaude on AWS
GGoogle GeminiGemini
MMistralMistral
CoCohereCommand
DSDeepSeekDeepSeek
GqGroqopen models, fast
xxAIGrok
OROpenRoutermany models, one key
+Your own keysno per-prompt fees
Inside your own network · 2 optionsnothing leaves
OlOllamalocal models, air-gapped
{ }OpenAI-CompatiblevLLM, LM Studio, LiteLLM
Your rConfig serverdirectThe provider you chose
rConfig, the company, never sees your data. No hosted models, no data path through us.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202611 / 15
On your terms · Governance and auditDraft · Private and Confidential

You decide who uses AI. Every question is on record.

Iris works inside the access rules you already have. An admin picks the model. Each time someone uses AI, rConfig writes down who, what and when.

  • Two permissions: one to use AI, one to manage it.
  • One provider at a time: added, tested and switched on by an admin.
  • A full record: user, capability, provider, model, tokens, IP and time.
  • Off means off: no provider set, no AI anywhere in the product.
Who can askYour existing roles decide.aicenter.view
Which modelAn admin picks one provider.aicenter.update
The answerAdvice only. No device change.read-only
On the recordEvery call is logged.audit log
AI audit log · GET /api/ai/audit-logs
UserWhat they usedModelTokensWhen
a.okaforConfig Analysis · edge-rtr-11Anthropic4,21209:12
s.nolanDrift Narration · core-rtr-02Ollama (local)1,87009:09
a.okaforCompliance · CIS L1, fleetAnthropic6,03408:55
svc-claudeMCP · search_configstoken-scopedn/a08:41
No provider set = no AI anywhereFilter by user, capability, date
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202612 / 15
On your terms · PrivacyDraft · Private and Confidential

Know exactly what leaves your network

Each capability sends only what it needs. The list is published inside Iris, so your security team can check it line by line.

  • Published per capability: on the Iris Privacy page.
  • Smallest share: a diff, not the whole config, where a diff will do.
  • Local model: nothing leaves at all.
  • Built into the code, not just written in a policy.
Iris · Privacy · what each capability sends
What is sentYour questionConfig textThe diffNames and results
Config Analysis
Drift Narration
Compliance Narration
Rule drafting
Optimization
sentonly if you paste it (up to 8 KB)never sent
Cloud modelOnly the ticked items go out, straight to the provider you chose.
Local modelNothing leaves your network. At all.
rConfig never stores AI answers, prompt text in audit records, or config beyond the conversation.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202613 / 15
Addendum · The network AI maturity modelDraft · Private and Confidential

A four-step path for AI on your network

Some vendors sell the top of the ladder. We show every rung, and we tell you which one we are on. Mapped to the TM Forum L0 to L5 scale, for enterprise and MSP networks.

Stage 1 · rConfig is here today

Assisted Insight

The AI reads, explains and narrates your estate in plain language. Read-only by design.

TMF L1-L2
Stage 2

Augmented Operations

You extend the AI's knowledge with your own conventions, golden configs and standards. Still read-only.

TMF L2
Stage 3

Supervised Automation

The AI proposes changes. Nothing is applied without a human in the loop.

TMF L3
Stage 4

Autonomous Operations

Governed jobs run end to end, inside bounds you set. The horizon.

TMF L4-L5
Read the full model: rconfig.com/ai/maturity-model. Stages 2 to 4 are future work. We will only claim a stage when rConfig reaches it.
rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202614 / 15

The most fully featured AI in NCM. In your network, on your model, answering to your team.

Draft. Based on the rConfig V8 AI Center as documented on rconfig.com and docs.rconfig.com. See it on your own configurations: rconfig.com/ai.

rConfig Iris · AI Center feature overview · v1.2 draft · 12 Nov 202615 / 15