Skip to content
Get packs

Guide · Agent skill

How to use the Configuring Duo MFA agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the configuring-multi-factor-authentication-with-duo agent skill, a set of instructions and helper scripts that lets an AI agent walk you through adding Cisco Duo multi-factor authentication to VPN, Windows remote desktop, SSH and web applications. It is written for people who have never installed an agent skill. By the end you will know how to install the skill, ask for the help you need, and understand what the optional Admin API scripts do and what they require.

Configuring Duo MFAmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
  2. 2Confirm your prerequisites. Check that you have Python 3.8+, a Duo administrator account and a test environment. Only install requests and collect Admin API credentials if you plan to run the scripts.
  3. 3Describe your goal in plain language. Ask for the access point you want to protect, such as VPN, Windows RDP or SSH, and mention your existing setup, like RADIUS or Active Directory.
  4. 4Follow the proxy and integration steps. Have the agent guide you through Duo Authentication Proxy setup, including the integration key, secret key, API hostname and failmode choice, then test connectivity.
  5. 5Set group policies. Create Standard, Privileged and Contractors groups and set each group's allowed methods, remembered device duration and device health rules.
  6. 6Run the audit if needed. Use the Admin API scripts only on an authorized test tenant to list users and check for weak settings such as SMS fallback or unsafe failmode.
  7. 7Verify and monitor. Work through the verification checklist and confirm authentication logs are forwarded to your SIEM and that MFA fatigue alerts are configured.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions, reference files and sometimes scripts that an AI agent loads when your request matches the skill's description. This skill's main file, SKILL.md, describes how to deploy Cisco Duo multi-factor authentication across enterprise access points, covering the Duo Authentication Proxy, adaptive authentication policies, device trust assessment and phishing-resistant WebAuthn/FIDO2 deployment aligned with NIST 800-63B AAL2/AAL3.

Duo MFA adds a second check, such as a phone prompt or a security key, on top of a password. The skill's workflow covers six areas: proxy setup, VPN integration, RDP/Windows logon, adaptive per-group policies, phishing-resistant methods, and monitoring with logs sent to a SIEM. It also includes a deployment checklist, a NIST 800-53 control table, and Python scripts that can call the Duo Admin API to list users and audit a configuration for weak settings such as SMS fallback or an unsafe failmode.

  • Plan and configure Duo for VPN, RDP, SSH and web apps
  • Map controls to NIST SP 800-63B and NIST SP 800-53 IA controls
  • Check a Duo configuration for weak settings using the Admin API scripts

How do you install the skill?

Download the skill's ZIP file from this page. Then choose one of two options depending on how you work with your agent.

For a personal setup, unzip the file into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into .claude/skills/ inside your project folder
  • Claude apps: upload the ZIP under Settings → Capabilities → Skills
~/.claude/skills/configuring-multi-factor-authentication-with-duo/

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language that matches the skill's purpose: adding or hardening MFA for remote access, VPN or privileged logins with Duo. The agent should load the skill when your request fits its description.

Good requests name the system and the goal. Include what you already have, such as an existing RADIUS-based VPN or Active Directory, so the agent can tailor the steps. Ask for review steps too, because the skill includes a verification checklist.

  • "Help me add Duo MFA to our Cisco ASA VPN using the Authentication Proxy."
  • "Set up Duo for Windows RDP logons, with offline access and a bypass for service accounts."
  • "Review our Duo policy so that privileged users require Verified Push and no remembered device."
  • "Audit our Duo configuration for SMS fallback and unsafe failmode settings."

What do the scripts need and do?

Most of the skill is guidance the agent follows. The Admin API scripts are optional and are the part that needs care. The skill's requirements are Python 3.8 or newer, the requests library (installed with pip install requests), a Duo Admin API integration key, secret key and API hostname, and access to a Duo administrator account and a test environment.

The scripts are scripts/agent.py and scripts/process.py. The API reference also mentions the duo_client library, which the skill documents with pip install duo_client. Run the scripts against a test environment first. They read user and authentication data, so only use them with authorization.

  • Python 3.8+
  • requests library (pip install requests)
  • Duo Admin API integration key, secret key and API hostname
  • Access to a Duo administrator account and a test environment
pip install requests

What safety points should you know before running anything?

This skill runs scripts and uses the network. The Admin API scripts can list users and read authentication logs, which may expose sensitive information if misused. Do not run them against production tenants without written authorization, and store the secret key securely rather than in shared files.

Read the scripts before running them, and check any command the agent proposes. Also check the failmode setting: the skill warns against safe mode in production, where access is allowed when Duo is unreachable.

  • Use a test or lab environment first
  • Only run the Admin API scripts with authorization
  • Keep the Admin API secret key out of shared files
  • Review the agent's commands before approving them

What tips help you get the most from it?

Start with a single access point such as VPN, then extend to RDP and SSH. Use the skill's group model (Standard, Privileged, Contractors) and set the policy for each group before rollout. Keep the SMS and phone call options off for high-risk groups, and have a tested bypass and emergency access procedure before enforcing MFA.

Ask the agent to check your work against the skill's verification list, which covers VPN, RDP and SSH MFA, Verified Push for privileged users, device health blocking, SIEM log forwarding and MFA fatigue alerts.

  • Pilot on one access point, then expand
  • Use the Standard, Privileged and Contractors groups as a starting point
  • Test bypass and emergency access before enforcement
  • Ask the agent to verify against the checklist

What people use it for

  • Adding Duo MFA to a VPN that authenticates through RADIUS, using the Duo Authentication Proxy
  • Requiring Verified Push or WebAuthn security keys for privileged administrator accounts
  • Enabling Duo for Windows RDP logons with offline access for laptops and a bypass for service accounts
  • Auditing an existing Duo tenant for SMS fallback or unsafe failmode, on an authorized test environment
  • Mapping Duo controls to NIST SP 800-63B and NIST SP 800-53 IA controls for a compliance review

Frequently asked questions

How do I install the configuring Duo MFA agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.

What do I need to use this skill?

The guidance needs a real or lab Duo environment to be useful. The optional Admin API scripts need Python 3.8+, the requests library, and a Duo Admin API integration key, secret key and API hostname, plus a Duo administrator account.

Is this skill free to use?

The skill is released under the Apache-2.0 licence, as listed on this page. Duo itself is a Cisco commercial product, and this skill does not say anything about Duo licensing or pricing, so check that with Cisco.

Does this skill work with products other than Cisco Duo?

No. The steps are specific to Duo products such as the Duo Authentication Proxy, Duo for Windows Logon and Duo Unix. The skill's VPN examples mention Cisco ASA and Palo Alto, but the integration is through Duo's RADIUS proxy.

Can the scripts change my Duo settings?

The described scripts list users, read authentication logs and audit configuration for weak settings. Read the scripts before running them, and only run them against an authorized test environment, since they read sensitive user and authentication data.

Why does the skill recommend against failmode safe?

The skill's common pitfalls list says setting failmode to safe, which allows access when Duo is unreachable, should be avoided in production. Its safer option is secure, which denies access when Duo cannot be reached.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits IT and security staff rolling out Duo MFA for remote access, and administrators auditing an existing Duo deployment against NIST-aligned controls. It is not useful without access to a Duo account or a real IT environment, and it should not be used for organisations that do not run Cisco Duo. For a product other than Duo, pick a skill or guide written for that product.

Download the skill