┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│  CLAUDE.md  │──▶│   Skills    │──▶│    Hooks    │──▶│  Subagents  │──▶│   Plugins   │
│  sets rules │   │  provide    │   │  enforce    │   │  delegate   │   │  distribute │
│             │   │  expertise  │   │  quality    │   │  work       │   │  to team    │
└─────────────┘   └─────────────┘   └─────────────┘   └─────────────┘   └─────────────┘
       │                │                 │                  │                  │
       └────────────────┴────────┬────────┴──────────────────┴──────────────────┘
                                 │
                          ┌──────┴──────┐
                          │  MCP Layer  │
                          │  external   │
                          │  tools,     │
                          │  databases, │
                          │  APIs       │
                          └─────────────┘

Claude Code for network engineers, by a network engineer.

A free 2-hour course on the 5-layer Agent Development Kit — CLAUDE.md, Skills, Hooks, Subagents, Plugins. Built for multi-vendor networks: IOS-XE, EOS, Junos, PAN-OS.

Book a 30-min callStart the course

Compress the troubleshoot loop

A 45-minute BGP-flap-to-resolution cycle compresses to six minutes of engineer engagement. Cross-device correlation, transceiver checks, root cause — described once, executed in parallel.

Safety as a physical lock

Hooks block 'configure terminal', 'write memory', and 'terraform apply' at the OS level — deterministically, regardless of what Claude decides or you accidentally approve. Not a guideline. A shell exit code 2.

Institutional knowledge, installable

Package CLAUDE.md, skills, hooks, subagents, and slash commands into a plugin. New NOC engineer runs one install command and gets the whole team's runbook on day one.

The 12 sections

1What Claude Code Is and What It Isn'tWhat this tool does that your terminal, vendor docs, and a Python script don't. 2Reading Your Network — @-Mentions and Bash ExecutionLoading configs, SSH'ing into devices, chaining commands across the path. 3Slash Commands and Session Management/compact, /resume, /export, /branch — the controls you actually use. 4Permissions — The Read/Write Safety BoundaryAllow read-only show commands. Physically deny configure mode. The settings.json that enforces it. 5Layer 1 — CLAUDE.md (The Memory Layer)Stop re-explaining your vendor stack, naming convention, and IP plan every session. 6Layer 2 — Skills (The Knowledge Layer)Auto-invoked expertise — BGP troubleshooting trees, audit checklists, config generation. 7Layer 3 — Hooks (The Guardrail Layer)Deterministic guardrails. Block dangerous commands. Auto-lint every generated file. 8Layer 4 — Subagents (The Delegation Layer)Parallel investigation across sites and vendors with isolated context windows. 9Layer 5 — Plugins (The Distribution Layer)One install command. Every teammate gets the same skills, hooks, and audits. 10MCP — Connecting Your Network's External SystemsNetBox, Grafana, syslog database — Claude queries them directly, no copy-paste. 11Headless Mode and CI/CD PipelinesRun continuous compliance scans in CI. Open Jira tickets per finding. 12Complete Workflow — Incident to ResolutionAn incident from page to documented close in eight minutes, all five layers in play.

How I help beyond the course

vExpertAI services for engineering teams ready to deploy Claude Code in production. vexpertai.com ↗

AI custom training

Hands-on workshops scoped to your stack

Half-day to multi-week training tailored to your vendors (IOS-XE, EOS, Junos, PAN-OS), your IPAM, monitoring, and ticketing. Engineers leave with a CLAUDE.md, skills, and hooks they wrote themselves — not slides they forgot.

Discuss training

AI pilots for NOC and SOC

4–6 week production pilots

Scope one operational area (incident triage, compliance scanning, change validation), measure baseline, deploy Claude Code, measure outcome. Time-to-resolution, MTTR, audit findings closed. You decide whether to scale based on data, not pitch decks.

Scope a pilot

AI Champion programs

Two-track for executives and engineers

Executives get strategic framing — cost, risk, integration patterns, what to fund and when. Engineers get operational depth — custom skills, MCP integrations, headless pipelines, plugin distribution. Six-week cohort with weekly office hours.

Champion program

FAQ

Is this for Cisco shops only?
No. Examples cover Cisco IOS-XE, Arista EOS, Palo Alto PAN-OS, Juniper Junos, F5 BIG-IP, Cisco Viptela, and Aruba Central. The doc explicitly notes Cisco and Arista have the strongest training-data coverage; for Junos and PAN-OS your CLAUDE.md and skills become more important.
Will Claude touch my routers without permission?
Not if you set up permissions correctly. The settings.json deny list blocks 'configure terminal', 'write memory', 'reload', 'terraform apply' at the system level — even if you accidentally approve a prompt. PreToolUse hooks add a second deterministic layer.
How is this different from ChatGPT or Copilot?
Claude Code is an agentic CLI. It reads your configs, executes your bash commands, and connects to NetBox or Grafana via MCP. ChatGPT can't run 'show interfaces transceiver detail' on your switch. Copilot is for IDE inline completion. This is for operations.
What does it cost to run?
Pro subscription is $20/month. A typical operational session runs $0.10–$0.45 with Sonnet, $0.50–$2.25 with Opus. Use /cost to see token spend per model. Most NOC tasks are Sonnet-level; reach for Opus on multi-device correlation and architecture review.
Can I gate this behind change control?
Yes. PreToolUse hooks block configuration commands. PostToolUse hooks post Slack notifications when files change. Headless mode (-p flag) lets you run read-only compliance scans in GitHub Actions on every PR. Section 11 walks through the pipeline.
What about air-gapped networks?
Claude Code itself needs internet to reach Anthropic's API. Your data flows out of the air gap to the model. For truly isolated networks, run Claude Code on a jump host with controlled egress and use local MCP servers for NetBox or syslog rather than cloud equivalents.
Vendor coverage — Junos, PAN-OS, EOS?
All supported. Coverage quality follows training-data representation: Cisco IOS-XE and Arista EOS are most accurate, Junos and PAN-OS slightly less consistent. For weaker areas, your skills and CLAUDE.md fill the gaps. Always validate generated commands before production use.
Is my data sent to Anthropic?
Yes — prompts and tool results go to Anthropic's API for inference. Files you @-mention are included in the context. Anthropic's API terms govern data handling. For sensitive networks, scrub configs of credentials and customer data before passing them in, or use sandbox mode to restrict file access.

Roll this out at your NOC

If your team is past the curiosity phase and ready to deploy Claude Code in production network operations, book a 30-minute call. We'll walk through your vendor stack, current change control process, and where the 5-layer ADK fits. You leave with a concrete next step, not generic advice.

What we cover

  • Your current operational pain points and where Claude Code compresses them
  • Permission and hook design for your safety boundary
  • Custom skills for your platforms (IOS-XE, EOS, Junos, PAN-OS, others)
  • MCP servers for your IPAM, monitoring, and ticketing
  • Plugin packaging and team rollout sequence

Who it's for

  • Network engineering teams at 50+ device scale
  • NOC managers evaluating AI tooling for production operations
  • Platform/automation leads building internal Claude Code distributions

Not for

  • One-person home labs — work through the free course first
  • Teams without a network automation repo or CI/CD process to build on