# brent.leekley.me blog Field notes on networks, automation, AI infrastructure, and answer-engine optimization by Brent Leekley. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Patching This Site's MCP Endpoint and Limiting What It Can Do DevFeed: [Patching This Site's MCP Endpoint and Limiting What It Can Do]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [Model Context Protocol](), [MCP Server](), [API](), [HTTP](), [JSON]() Tags: [aeo](), [agent-ready-website](), [agentic-ai](), [agents](), [api](), [api-security](), [clients](), [json-rpc](), [logs](), [mcp](), [mcp-server](), [model-context-protocol](), [prompt-injection](), [protocol](), [rate-limiting](), [retry](), [server](), [streamable-http](), [webmcp]() ### AI overview This article explains how to patch a website's public, unauthenticated MCP endpoint. It covers updating to the current protocol revision while retaining compatibility with older clients, and applying limits including read-only tools, per-IP rate limiting, request-size caps, Origin checks, POST-only access, non-reflected strings, and privacy-preserving logs. ### Source excerpt An MCP server on your website is a public, unauthenticated API. Bringing one to the current protocol revision while keeping older clients working, and the seven limits that bound it: read-only tools, a per-IP rate limit that always sends Retry-After, hard caps on body and argument size, an https-only Origin check, POST only, no reflected strings, and logs that store a salted hash instead of an address. ## No Lab, No Problem: Record CML2 Devices into pyATS Mocks for CI DevFeed: [No Lab, No Problem: Record CML2 Devices into pyATS Mocks for CI]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-27T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [GitHub Actions](), [Testing](), [GitHub](), [Network]() Tags: [ci](), [ci-cd](), [cisco](), [cisco-modeling-labs](), [cml](), [cml2](), [genie](), [github-actions](), [mock-devices](), [network-automation](), [network-testing](), [ospf](), [playback](), [pyats](), [record-and-replay](), [testing](), [unicon]() ### AI overview This tutorial explains how to record responses from real Cisco Modeling Labs 2 devices with pyATS and unicon, commit the recordings, and replay the same test suite in GitHub Actions. Replay allows the tests to run offline without booting or connecting to the lab. ### Source excerpt Develop against the live CML2 lab, then record it once with unicon playback and replay the exact same pyATS suite in GitHub Actions with no lab to license or reach. Point the testbed at an unreachable address and the suite still passes, because replay never opens a socket. Includes a real companion repo with a green Actions run. Fourth in a pyATS + CML2 network programmability series. ## The Snapshot Machine: genie learn and diff as a Change-Validation Safety Net on CML2 DevFeed: [The Snapshot Machine: genie learn and diff as a Change-Validation Safety Net on CML2]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-22T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [networking](), [Cisco](), [Routing (disambiguation)](), [Structured-data](), [Command-line interface]() Tags: [change-validation](), [cisco](), [cisco-modeling-labs](), [cli](), [cml2](), [genie](), [genie-diff](), [genie-learn](), [maintenance-window](), [network-automation](), [network-testing](), [ospf](), [pyats](), [routing-table](), [snapshot](), [structured](), [validation]() ### AI overview This tutorial demonstrates using Cisco Modeling Labs 2 with Genie learn and diff to validate network changes. It snapshots structured operational state before and after a maintenance change, then compares the snapshots to reveal side effects that routine show commands may miss. The source summary reports that a changed OSPF cost reroutes three destinations while adjacencies remain FULL. ### Source excerpt Snapshot a CML2 fabric with genie learn before and after a maintenance change, then genie diff the structured state. One fat-fingered OSPF cost quietly reroutes three destinations while every adjacency stays FULL. Structured before-and-after diffs catch the side effects that show commands miss. ## From Intent to Reality: Driving pyATS Tests from NetBox Against a CML2 Fabric DevFeed: [From Intent to Reality: Driving pyATS Tests from NetBox Against a CML2 Fabric]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-15T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [NetBox](), [Network](), [Cisco](), [data](), [Structured-data]() Tags: [cisco-modeling-labs](), [cml](), [cml2](), [custom-fields](), [genie](), [ids](), [intent-based-networking](), [netbox](), [network](), [network-automation](), [network-testing](), [ospf](), [pyats](), [pynetbox](), [router-id](), [source-of-truth](), [spine-leaf](), [structured](), [testbed]() ### AI overview This tutorial shows how to store declared OSPF router-IDs in NetBox and use Cisco pyATS to compare them with the router-IDs on a live CML2 spine-leaf fabric. The comparison turns network intent validation into a pass-or-fail test. ### Source excerpt NetBox holds the intent (declared OSPF router-IDs), a CML2 spine-leaf is the network under test, and pyATS is the judge. Close the loop and prove the live network matches what you said it should be, with real pass and fail output. ## Build the Lab Once, Test It Forever: A CML2 Spine-Leaf Wired for pyATS DevFeed: [Build the Lab Once, Test It Forever: A CML2 Spine-Leaf Wired for pyATS]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-14T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [Network](), [Testing](), [Cisco](), [Code](), [API](), [Parser]() Tags: [api](), [cisco](), [cisco-modeling-labs](), [cml](), [cml2](), [code](), [genie](), [iol-xe](), [network-automation](), [network-testing](), [ospf](), [parsing](), [pyats](), [spine-leaf](), [testbed](), [virl2-client]() ### AI overview This tutorial describes a four-node spine-leaf lab in Cisco Modeling Labs 2 (CML2) that generates a Cisco pyATS testbed from the CML API. The approach treats the lab definition as the source of truth so regenerated inventories remain aligned with topology changes, and uses an OSPF underlay with a management network. ### Source excerpt Stop hand-maintaining your pyATS testbed. Build a four-node spine-leaf in CML2 as code, then generate the testbed straight from the CML API so it never drifts from the lab, with live Genie-parsed proof over a System Bridge management network. ## AI agents gain distinct identities and permissions, but accountability remains the harder problem DevFeed: [AI agents gain distinct identities and permissions, but accountability remains the harder problem]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-12T00:00:00Z Content type: opinion Language: en Sources: [brent.leekley.me blog]() Topics: [Artificial Intelligence](), [Cisco](), [Duo](), [Authorization](), [trust]() Tags: [aeo](), [agent-identity](), [agentic-ai](), [agenticops](), [ai](), [ai-agents](), [answer-engine-optimization](), [cisco](), [cisco-cloud-control](), [cisco-live](), [cisco-live-2026](), [duo](), [duo-iam](), [identity](), [jeetu-patel](), [non-human-identity](), [permissions]() ### AI overview This commentary argues that AI agents are becoming operational actors with distinct identities, permissions, and lifecycles. It describes Cisco's approach of assigning agents identities, linking them to accountable humans, limiting permissions, and requiring human approval for proposed changes, while emphasizing that accountability and ongoing oversight remain unresolved challenges. ### Source excerpt Cisco Live 2026 made AI agents their own kind of identity, with permissions and an accountable human owner. Why issuing the identity is the easy 20 percent, what real accountability takes, and how the same agents quietly became the audience we now write for. ## Your robots.txt Says Yes. Your Firewall Says 403. DevFeed: [Your robots.txt Says Yes. Your Firewall Says 403.]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-11T00:00:00Z Content type: article Language: en Sources: [brent.leekley.me blog]() Topics: [Cloudflare](), [AI Bots](), [AI search](), [Crawler](), [Firewall]() Tags: [403](), [aeo](), [ai-bots](), [ai-crawl-control](), [ai-crawlers](), [ai-search](), [ai-visibility](), [blocking](), [bot-management](), [chatgpt-user](), [cloudflare](), [firewall](), [gptbot](), [oai-searchbot](), [perplexity](), [robots](), [robots-txt]() ### AI overview A field note explains how a Cloudflare AI-bot blocking setting returned 403 responses to all AI agents even though the site's robots.txt allowed AI search and blocked training crawlers. It distinguishes training crawlers, search indexers, and user-triggered fetchers, and recommends auditing enforcement at the firewall layer. ### Source excerpt A client's robots.txt welcomed AI search and blocked training crawlers, but Cloudflare's blunt AI-bot toggle was returning 403 to every AI agent at the edge. How the block was found, the AI Crawl Control fix, and why you should audit enforcement, not intent. ## Using an AI Agent and MCP to Build and Verify Cisco Modeling Labs Network Labs DevFeed: [Using an AI Agent and MCP to Build and Verify Cisco Modeling Labs Network Labs]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-10T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [AI Agent](), [Model Context Protocol](), [Cisco](), [Claude](), [Network](), [API]() Tags: [agent](), [ai-agents](), [api](), [cat9000v](), [cisco-modeling-labs](), [claude](), [cml](), [cml-mcp](), [mcp](), [mcp-server](), [model-context-protocol](), [network](), [network-automation](), [pyats]() ### AI overview This article explains how to use an AI agent through the Model Context Protocol to build and verify network labs in Cisco Modeling Labs. It discusses CML 2.10's first-party MCP server, natural-language lab creation, and verification workflows that observe network state and retry until OSPF adjacency converges. ### Source excerpt CML 2.10 ships a first-party MCP server, and Claude can now build and verify network labs. Field lessons from running an AI agent against Cisco Modeling Labs: dataplane readiness gates, the cat9000v interface trap, SSH host-key rotation, and guardrails that live in docstrings. ## Prompts Are Guidelines. Code Is the Config. DevFeed: [Prompts Are Guidelines. Code Is the Config.]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-08T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [Artificial Intelligence](), [Prompt Engineering](), [Claude](), [API](), [hooks](), [JSON](), [context]() Tags: [agent-reliability](), [agents](), [ai](), [ai-agents](), [api](), [claude](), [hooks](), [schema](), [stateless](), [stop-reason](), [structured-output](), [til](), [tool-use]() ### AI overview A Today I Learned field note about building more reliable AI agents by assigning probabilistic judgment to the model and deterministic guarantees to application code. It discusses using code-enforced gates and hooks for requirements that must always hold, branching on stop_reason rather than model text, handling turns that contain both chat and tool calls, and avoiding the assumption that a valid schema guarantees a correct answer. ### Source excerpt Where the model's judgment ends and your code has to take over -- a Today I Learned field note on building AI agents that hold up in production: stop_reason, forced tool use, hooks, stateless history, and why a valid schema isn't a true answer. ## Beyond the Click: 5 Counter-Intuitive Truths About the New Era of AI Search DevFeed: [Beyond the Click: 5 Counter-Intuitive Truths About the New Era of AI Search]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-07T00:00:00Z Content type: opinion Language: en Sources: [brent.leekley.me blog]() Topics: [AI search](), [Search engine optimization (SEO)](), [Artificial Intelligence](), [Large Language Model](), [observability](), [anthropic]() Tags: [aeo](), [agentic-ai](), [ai-search](), [answer-engine-optimization](), [anthropic](), [brand-visibility](), [chatgpt](), [llm](), [observability](), [seo](), [zero-click]() ### AI overview This field note argues that AI-driven, zero-click search is shifting growth strategy from traditional SEO toward Answer Engine Optimization. It discusses the Mirror Effect, in which large language models form a brand narrative from the broader web rather than only a company website, and argues that reputation management, authentic content, and observability are increasingly important for brand visibility. ### Source excerpt The shift from SEO to AEO: the Mirror Effect, social signals, productivity arbitrage, the authenticity paradox, and agentic AI. Five counter-intuitive truths about brand visibility in a zero-click world.