Disclosure: I’m the developer of DeviceShelf, a local-first network scanner. This isn’t a sales pitch. The Server edition is a paid product, but I want to talk through how one feature is built, because I think the design is the interesting part.
The headless Server edition now speaks MCP (Model Context Protocol), so an assistant like Claude Desktop can answer questions straight from your live network data: what’s online right now, anything new or offline since yesterday, which certificates are expiring, how tonight differs from last week’s snapshot.
The part I actually care about is keeping it fenced in, because giving a language model a read of your network inventory deserves some paranoia.
Everything stays on your LAN. The MCP endpoint runs inside the Server, on the same port as the API, behind a bearer token, reachable only on your LAN. No cloud connector, no remote OAuth. The only thing that ever leaves is whatever the AI client you connected decides to send.
Reads are the default, writes are opt-in twice. There are 14 read-only tools: inventory, recent changes, alarms, per-device history and uptime, a one-call security overview for expiring certs and CVEs, and snapshot diffs. The 8 action tools (rename a device, ack an alarm, create a check in plain language, trigger a scan) stay off until you flip a separate env switch, and a second switch makes the impactful ones ask for a yes first via MCP elicitation.
Device strings are treated as hostile input. Hostnames, banners and cert subjects are untrusted: bidi and zero-width spoofing characters are stripped, values are truncated, and the model is told to treat them as data. Prompt injection through a hostname a rogue device set to something clever is a real risk, and stripping the spoofing chars plus flagging the strings as data is the boring, correct answer. On top of that: auth required, a scoped token that can’t touch the admin API, rate-limiting, audit logging by tool name, and an Origin allowlist against DNS rebinding.
Off by default, fully additive, available from server 1.5.3. Full write-up with client configs (Claude Desktop, Cursor, VS Code, Windsurf, Cline, Gemini CLI) is on the blog: https://deviceshelf.app/blog/2026-07-01-ask-your-ai-about-your-network/
Curious where other self-hosters draw the line here — would you give an LLM read access to your inventory at all, and would you ever turn the write side on?