---
title: "Command Access"
slug: "ai-assisted-netops-command-access"
description: "Streamline device diagnostics with Command Access, enabling read-only show commands for quick insights without CLI syntax knowledge."
updated: 2026-04-06T15:59:31Z
published: 2026-04-06T15:59:31Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.kentik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Command Access

When investigating device performance issues, logging in and running CLI commands to understand what’s happening is cumbersome, error-prone, and hindered by knowledge gaps.

The **Command Access** feature empowers Kentik’s [**AI Advisor**](/v1/docs/ai-advisor) to identify, execute, and analyze the results of read-only `show` commands in response to user prompts. This provides immediate, pre-analyzed diagnostic context, often without needing to know CLI syntax.

> [!WARNING]
> **IMPORTANT:** Ensure your environment meets the [Prerequisites](/v1/docs/ai-assisted-netops#prerequisites) (including Universal Agent deployment and TCP/22 reachability) before attempting to configure device synchronization.

### Setup: Device Diagnostics Commands

To establish the secure tunnel required for Kentik to interact with the device CLI, navigate to the **SSH** tab in [**Device Settings**](/v1/docs/device-settings) in the Kentik portal.

![Configuration settings for SSH access and device diagnostics.](https://cdn.us.document360.io/082e25b5-afce-42d4-8f47-70bd3f1d02b7/Images/Documentation/ANMS-edit-device-ssh-tab.png)

1. **Enable SSH command access**: Toggle this **On** to establish the main connection.
2. **Credential**: Select your pre-configured [**SSH key or password**](/v1/docs/credentials-vault).
3. **Collection Agent**: Select the [**agent**](/v1/docs/universal-agents#deploy-a-universal-agent) with network reachability to the device.
4. **Device Platform**: Recommended setting is **Autodetect** to ensure correct syntax usage.
5. **SSH Hostname (or IP):** The Fully Qualified Domain Name (FQDN) or IP address the agent will use to connect.
6. **Enable Read-Only Diagnostic Commands**: Toggle this **On** to empower AI Advisor to securely run `show` commands (e.g., `show ip bgp summary`) for immediate context.

> [!NOTE]
> **Note**: Results are not shared between users.

> [!TIP]
> **TIP**: If the connection fails initially, verify that the Universal Agent has accepted the device's SSH host key or that your firewall isn't blocking the initial handshake on TCP/22.

### Example Prompts for AI Advisor

- **Routing:** "Check the BGP summary on [Device Name] and tell me if any peers are currently down."
- **Interfaces:** "Show me the interface counters for `eth0` on [Device Name] and highlight any recent input errors."
- **Troubleshooting:** "Run a routing table check for [IP Address] on [Device Name] and explain the next hop."
- **Security:** "Review the current active SSH sessions on [Device Name] and list the connected IP addresses."