Agent-friendly object management for Palo Alto Panorama. Find where an IP
lives, hunt down duplicate address/service objects, merge them safely (rewriting
every group and rule that referenced them), enforce naming conventions, and
audit object hygiene — all dry-run by default, with PAN-OS set and
JSON output for humans and agents alike.
$ psc --config panorama.xml find ip 10.0.0.10
$ psc --config panorama.xml dedup addresses
$ psc --config panorama.xml dedup merge --keep h-web1 --remove web-primary --apply --out fixed.xmlv1.0.0. From this release
pscfollows SemVer: the CLI surface, JSON contracts, and exit codes are stable public API. Writes are dry-run by default; nothing touches Panorama without--apply.
Panorama configs rot: the same 10.0.0.10 ends up as h-web1, web-primary,
and WEB_PRD_01; services duplicate well-known ports; objects outlive the rules
that used them. psc gives you a fast, scriptable, safe way to see and fix
that — offline against an exported config, or live against Panorama.
uv tool install panorama-super-cli # recommended
# or
pipx install panorama-super-cli
# or
pip install panorama-super-cli- Offline (no credentials, totally safe):
psc --config exported.xml <cmd>. Export from Panorama (scp export configuration ...or the GUI) and audit it on your laptop. - Live: configure a profile (
psc init,psc login) andpsctalks the PAN-OS XML API viapan-os-python. Reads are free; writes still require--apply.
| Area | Commands |
|---|---|
| Find / resolve | psc find ip <ip>, find ip -e <ip> (exact only), find ip --resolve-fqdn (opt-in DNS), find ip -f ips.txt, find object <name> — listings carry a tags column |
| Duplicates | psc dedup addresses, dedup services, dedup groups, dedup tags, dedup merge (pairwise or --group <value>), dedup merge-group, dedup promote (cross-DG duplicate → shared, incl. tags) |
| Audit | psc audit overlaps (overlapping/contained CIDR ranges), audit services-vs-wellknown |
| Diff | psc diff a.xml b.xml, diff --device-group A --against B |
| Object CRUD | psc set address|address-group|service|service-group|tag ... (create/update with PAN-OS validation) |
| Import / export | psc export <kind> (NDJSON), psc set <kind> -f objs.ndjson (bulk import) |
| Rule edits | psc rule edit-member --rule R --field F --add/--remove M (idempotent) |
| Decommission / move | psc decommission <ip|cidr>... (reference-safe teardown), psc move <kind> <name> --from --to [--cascade] |
| Naming | psc name lint, name apply --object / --all (opt-in templates) |
| References | psc refs used <object>, refs unused [--ignore-disabled], refs dangling |
| Workbench | psc workbench (psc w) — interactive TUI, full CLI parity |
| Output | `--output json |
See the docs for the full surface, the safety model, and the agent guide.
Prefer a cockpit to one-shot commands? psc workbench (alias psc w) is a
keyboard-driven Textual TUI at full CLI parity.
Search objects, multi-select them into a persistent buffer, route the selection
into a spoke (dedup, move, rename, decommission, rule edits, audits, naming,
create, group the selection with N, …), and stage plans into a git-like
changelist that applies as one batch
— as a set script, an offline config write, or a live candidate push (never a
commit). Same safety model as the CLI throughout.
psc --config panorama.xml workbench
psc -p prod w --output-mode live-applySee the Workbench guide.
- Dry-run is the default. Every mutating command prints a plan and exits
without touching anything unless you add
--apply. - Side-effect aware. Merging or renaming an object rewrites every address
group, security rule, and NAT rule that referenced it — across
sharedand device-groups — or refuses and tells you why. --debugstreams structured logs to stderr; stdout stays clean for pipes.
psc ships a bundled Agent Skill and
emits a stable JSON envelope + exit-code contract. Pass --output json and
parse away. Drop the Skill where your harness loads it with psc skill install:
psc skill install --target claude-code --apply # or codex | gemini | copilotSee Using with AI agents.