Read-only against the live routing table on either site: BGP sessions, route lookups, route forensics, and bounded IPv6 ping, traceroute and mtr. It's birdc behind a small JSON API, so there's no shell to reach.