NetPilot

Connect Your Network Source of Truth to AI

The agent reads your NetBox, Nautobot, and live CLIs — read-only — and builds runnable labs from real data.

Watch Demo

See It in Action

Describe a network — or point the agent at your NetBox — and get a running multi-vendor lab you can SSH into.

Trusted by network engineers worldwide

15,000+
users
25,000+
labs built
470K+
AI commands run

Which lab platforms integrate with NetBox and Nautobot?

Several do, by different routes. The open-source path exports your source of truth into a topology file you deploy yourself; NetPilot connects to your MCP server and lets the agent build the lab. Here is the honest comparison.

PlatformHow it reads NetBox / NautobotReal NOS imagesAssembly required
NetPilotBuilt-in read-only MCP connectors — point one at your NetBox or Nautobot MCP server and the agent queries it directly✅An MCP server you host; no exporter pipeline
ContainerlabNetBox only — via netreplica/nrx, which exports a NetBox site to Containerlab topology files✅You run the exporter and maintain the pipeline
Cisco Modeling LabsNetBox only — nrx exports to CML format; Cisco also publishes tooling to sync CML topologies back into NetBox✅Export step, plus CML licensing
NVIDIA AirNetBox only — nrx exports to NVIDIA Air format✅Export step; Cumulus and data-center fabrics
EVE-NGNo widely used first-party path — teams write their own API glue✅Custom scripting end to end
GNS3No widely used first-party path — teams write their own API glue✅Custom scripting end to end

Credit where it is due: the source-of-truth-to-lab pattern was proved in the open-source community by netreplica/nrx and Containerlab. If you want maximum control and are happy to maintain the pipeline, that stack is a genuinely good answer. NetPilot removes the assembly, not the credit.

Integrations that respect your source of truth

Three MCP connectors ship in the product — read-only by design, wired for the change-rehearsal loop.

Read-only by construction

The agent is granted an allow-list of read tools — exact names, never a wildcard. Write and delete tools are never attached.

The alternative

DIY agent wiring hands the model a full API token and hopes the system prompt says “don't write.”

Source of truth → running lab

NetBox/Nautobot records become a deployed multi-vendor lab you can SSH into — rehearse the change before production.

The alternative

Topology exporters hand you YAML to maintain; model-based twins can't run a single show command.

Live network, still read-only

show-command access via Nornir with credentials brokered from your Nautobot at call time — NetPilot never stores them.

The alternative

Homegrown scripts with device passwords in env vars and nothing between the model and enable mode.

Three built in, then anything

NetBox, Nautobot, and Nornir ship in-product on every plan. Any MCP-enabled tool connects on Signature & Enterprise.

The alternative

Point integrations cover one inventory tool; every new system in your stack means more glue code for your team.

What does each NetBox, Nautobot, and Nornir connector do?

Every connector exposes a curated, read-only tool surface to the agent — nothing more.

NetBox

Speaks to the official read-only NetBox MCP server you host: devices, sites, prefixes, object search, and changelogs. Ask “what changed this week?” or “build a lab from site DC-East” — the agent reads the records and does the rest.

Nautobot

The full read surface of your Nautobot MCP server: devices, interfaces, racks, IPAM, circuits, tenants, GraphQL queries, and job logs. The mutating tools — create, update, delete, run-job — are never attached.

Nornir

Live read-only CLI access to your real network: show commands only, enforced server-side. Inventory and credentials are brokered from your Nautobot at call time and executed in your environment — NetPilot never stores them.

These three are the starting point, not the list. With Signature & Enterprise, NetPilot connects to anything MCP-enabled — and every integration is custom-built to fit your workflow: if it has an API, NetPilot connects to it. Talk to us about your stack →

From records to a running network

The agent turns source-of-truth data into a deployed, verifiable lab — and checks it against reality.

The agent reads your source of truth

Devices, interfaces, prefixes, free IPs, changelogs — the agent queries your NetBox or Nautobot directly in chat and designs the matching topology from what's really there.

app.netpilot.io

From records to a lab you can SSH into

The agent deploys the twin on real network OSes (12+ and growing) and runs the verification itself — and every device stays a normal SSH target, so you can check the routing table by hand.

app.netpilot.io

Validate — source of truth vs lab vs live

Snapshot and diff lab state, spot-check the live network with read-only show commands, and catch drift between intended and actual before it bites a change window.

app.netpilot.io

What you can do with a connector enabled

Ask in plain English — the agent picks the right read-only tools, and everything it builds is verifiable on real CLIs.

Twin lab from a NetBox site

“Build a lab from my NetBox site DC-East” — the agent pulls devices, interfaces, and prefixes, then deploys a matching multi-vendor lab on real NOSes.

IPAM answers in seconds

Free /28s, available IPs, VLAN and VRF lookups straight from Nautobot — asked and answered in the same chat that builds the lab.

Change rehearsal

Pull the affected segment from your source of truth, deploy the twin, apply the candidate change, and diff pre/post state — before production.

Drift detection

Compare intended state (NetBox/Nautobot records) against live state (show-command output) in one conversation and get the delta.

Read-only live checks

“Run show ip bgp summary on core-rtr-01” — Nornir executes read-only show commands with credentials brokered from your Nautobot, never stored.

Changelog forensics

“What changed in NetBox this week?” — the agent reads changelogs and job logs, without the ability to run or modify anything.

NetPilot connectors vs the DIY pipeline

The honest comparison: exporter scripts and hand-wired MCP servers work — they just cost engineering time NetPilot spends for you.

Setup
NetPilot
Add a connector from the chat — URL + token, tested live
DIY (exporters + hand-wired MCP)
Install an exporter, map device types, maintain topology YAML
AI agent
NetPilot
Agent queries the source of truth and builds the lab in one conversation
DIY (exporters + hand-wired MCP)
None — you re-run the export each time records change
Read-only safety
NetPilot
Allow-list-enforced read-only; tokens encrypted and write-only
DIY (exporters + hand-wired MCP)
Your scripts, your guardrails to write and audit
Live-CLI verification
NetPilot
Built-in read-only show access, credentials brokered — never stored
DIY (exporters + hand-wired MCP)
Separate Nornir/Netmiko tooling you maintain
Cost & control
NetPilot
Productized; custom integrations on Signature & Enterprise
DIY (exporters + hand-wired MCP)
Free, open source, full control of every file
Multi-vendor images
NetPilot
12+ NOSes and growing — built-in plus bring-your-own-image
DIY (exporters + hand-wired MCP)
You hunt, license, and manage images yourself

Bottom line

Pick the DIY pipeline when you need:

  • •Free and open source, with full control of every YAML file and image
  • •Runs fully offline on your own hardware

Pick NetPilot when you need:

  • •Connector in minutes, read-only by construction — no glue code to write or maintain
  • •The agent turns source-of-truth records into a running, SSH-able lab and validates the change

Verdict:DIY wins for hands-on control and zero budget; NetPilot wins when the goal is rehearsing real changes from real data — connected, deployed, and validated in one conversation.

Frequently asked questions

How teams connect their source of truth to NetPilot — safely

Containerlab, Cisco Modeling Labs, and NVIDIA Air all have a documented path via netreplica/nrx, an open-source exporter that turns a NetBox site into a topology file you then deploy yourself. Note that those nrx paths are NetBox-only; none of them documents a Nautobot equivalent. EVE-NG and GNS3 have no widely used first-party path, so teams write their own API glue. NetPilot covers both source-of-truth products: you host a NetBox or Nautobot MCP server, point a read-only connector at it, and the agent queries your records and builds the matching lab on real network operating systems. There is still a server to host, but no exporter pipeline to write or maintain.
Yes, by two routes. The open-source route is netreplica/nrx: it reads a NetBox site and emits Containerlab, CML, or NVIDIA Air topology files that you deploy and configure yourself. The agent route is a read-only connector: you host a NetBox or Nautobot MCP server, NetPilot connects to it and queries devices, interfaces, cabling, and IP addressing, then designs a matching topology, generates per-vendor configuration, and deploys it on real network operating systems you can SSH into. Sites without cable or connection records need the links described in the prompt.
NetPilot's connectors are read-only by construction, not by trust: the agent is granted only a curated allow-list of read tools — exact names, never a wildcard — so write and delete operations are never attached, even if the server offers them. API tokens are encrypted at rest and write-only (never returned by any API), endpoints must be HTTPS, and a connector can only be enabled after a live handshake test passes. For live devices, credentials are brokered from your Nautobot at call time and never stored by NetPilot.
Yes. NetPilot's NetBox connector speaks to the read-only NetBox MCP server you host — point it at your server's HTTPS URL with an API token, and the agent can query devices, sites, prefixes, and changelogs. Setup takes a few minutes from the chat composer: add the connector, test it, enable it. The verified path today is a NetBox MCP server you host yourself.
The NetBox REST/GraphQL API is the raw programmatic interface — you write the queries and the glue code. MCP (Model Context Protocol) is a tool layer on top of it built for AI agents: the server describes typed tools like get_objects or get_changelogs, and an agent picks and calls them from plain English. NetPilot uses MCP so the agent can read your NetBox without you writing any integration code — and so access can be constrained to an exact allow-list of read tools.
No. The connectors are read-only ingest: the agent can query devices, IPAM, racks, circuits, and changelogs, but create, update, and delete tools are excluded by the allow-list — as is running Nautobot jobs, since jobs can mutate data. There is no write-back or sync path. If you want the lab results reflected in your source of truth, that stays a human decision.
NetBox, Nautobot, and Nornir connectors are built in — add one from the chat and the agent reads your source of truth in minutes, read-only by design. They're the starting point: with Signature & Enterprise, NetPilot connects to anything MCP-enabled — Git, ServiceNow/Jira, CI/CD, monitoring, or in-house tools. Every integration is custom-built to fit your workflow — if it has an API, NetPilot connects to it.
Open the chat composer's + menu in app.netpilot.io, choose Connectors, and pick your provider. Enter a label (like “Production”), your MCP server's HTTPS URL, and an API token — the token is stored encrypted and never shown again. Hit “Add & test connection”: a live handshake verifies the server and lists its read-only tools, and the connector enables only once the test passes. Changing the URL or token later disables it until it passes a fresh test. You can add multiple connections per provider — prod and staging side by side.
Only read-only show commands, and only through the Nornir connector: the executor enforces a show-only guard server-side, inventory and credentials are brokered from your Nautobot (Secrets/Vault) at call time, and commands execute inside your environment — NetPilot stores neither credentials nor inventory. Configuration changes are rehearsed in the lab, not pushed to production.

Where the connectors pay off

Network Change Validation

Rehearse BGP, ACL, and routing changes on a runnable mirror before production.

Network Digital Twin

A twin you can actually run — built from your source of truth, real CLIs via SSH.

NetPilot for Enterprise

Two-way MCP, custom integrations, on-prem options, and founder-led onboarding.

Connect your source of truth

Talk to us about wiring NetPilot into your stack — or add a NetBox, Nautobot, or Nornir connector yourself and ask the agent what's really in your network.

Try It Free

Bigger stack? Talk to us about custom MCP integrations