Vendor coverage

Transit AI ships with a per-vendor permit list for each supported network OS. The list spells out which read-only commands the AI is allowed to suggest, which ones it isn’t, and which shell-escape verbs are never allowed. Vendor-specific shorthand like sh int (Junos) or wr mem (Cisco) is expanded to its long form before checking, so abbreviated commands can’t sneak around the list.

Vendors supported in v1

Vendor	CLI flavor	Shell escapes blocked
Juniper Junos	Junos OS	start shell
Cisco IOS	Classic IOS	tclsh, event manager run
Cisco IOS-XE	IOS-XE	tclsh, guestshell, app-hosting
Cisco NX-OS	NX-OS	run bash, python, source, tclsh
Arista EOS	Arista	bash, python, event-handler
Palo Alto PAN-OS	PAN-OS	debug software shell, debug system
Generic Linux / Unix	sh / bash	every command needs your explicit click

How the permit list decides

For each command the AI proposes:

1. Expand any shorthand. Vendor-specific abbreviations like sh int br (Junos) or wr mem (Cisco) are expanded to their long form (show interfaces brief, write memory) before anything else happens. Abbreviated commands can’t sneak around the list.
2. Check the command itself. The first word of the command is matched against the vendor’s allow list and block list. If it’s not on the allow list — or if it matches the block list — the command is rejected and the AI is told it can’t run that command. The default is “deny”: if neither list matches, the answer is no.
3. Check each pipe stage. For pipes like show route | match 10.0 or show config | save scratch, each | <stage> is checked separately. Any blocked pipe (anything that writes to a file, commits config, transitions modes) rejects the whole command.

The AI is never given the permit list in a form it can modify — it sees a static summary of what verbs are broadly allowed for the vendor, and the actual check happens on your machine, not in the AI’s head.

Don’t see your vendor?

If you operate gear we don’t yet cover, open a request with the vendor name, a representative show (or equivalent read-only) command, and any known shell-escape verbs. Each new vendor profile is a small, focused unit of work — we ship them regularly and would rather hear from you than guess at coverage.