Connect Your Network Source of Truth to AI

Your agents drive NetPilot's MCP server, and NetPilot's agent reads your NetBox and builds runnable labs for your stack.

Watch Demo

See It in Action

Describe a network — or point the agent at your NetBox — and get a running multi-vendor lab you can SSH into.

Trusted by network engineers worldwide

15,000+
users
25,000+
labs built
470K+
AI commands run

Which lab platforms integrate with NetBox and Nautobot?

Several do, by different routes. The open-source path exports your source of truth into a topology file you deploy yourself; NetPilot connects to your MCP server and lets the agent build the lab. Here is the honest comparison.

PlatformHow it reads NetBox / NautobotReal NOS imagesAssembly required
NetPilotA custom-built read-only integration with the NetBox or Nautobot MCP server you host; the agent queries it directly✅An MCP server you host. The integration is built for you, with no exporter pipeline
ContainerlabNetBox only — via netreplica/nrx, which exports a NetBox site to Containerlab topology files✅You run the exporter and maintain the pipeline
Cisco Modeling LabsNetBox only — nrx exports to CML format; Cisco also publishes tooling to sync CML topologies back into NetBox✅Export step, plus CML licensing
NVIDIA AirNetBox only — nrx exports to NVIDIA Air format✅Export step; Cumulus and data-center fabrics
EVE-NGNo widely used first-party path — teams write their own API glue✅Custom scripting end to end
GNS3No widely used first-party path — teams write their own API glue✅Custom scripting end to end

Credit where it is due: the source-of-truth-to-lab pattern was proved in the open-source community by netreplica/nrx and Containerlab. If you want maximum control and are happy to maintain the pipeline, that stack is a genuinely good answer. NetPilot removes the assembly, not the credit.

Integrations that respect your source of truth

Custom-built for your workflow, read-only by design, wired for the change-rehearsal loop.

Read-only by construction

The agent is granted an allow-list of read tools — exact names, never a wildcard. Write and delete tools are never attached.

The alternative

DIY agent wiring hands the model a full API token and hopes the system prompt says “don't write.”

Source of truth → running lab

NetBox/Nautobot records become a deployed multi-vendor lab you can SSH into — rehearse the change before production.

The alternative

Topology exporters hand you YAML to maintain; model-based twins can't run a single show command.

Live network, still read-only

show-command access via Nornir with credentials brokered from your Nautobot at call time — NetPilot never stores them.

The alternative

Homegrown scripts with device passwords in env vars and nothing between the model and enable mode.

A few examples, then anything

NetBox, Nautobot and Nornir are a few examples. Anything with an API or an MCP server connects, built for your workflow.

The alternative

Point integrations cover one inventory tool; every new system in your stack means more glue code for your team.

AI agent integration with your network stack

Agentic AI built for network engineering. Bring your own agent to NetPilot's MCP server, or let NetPilot's agent connect to your systems over API or MCP. Every integration is a custom build for your workflow. NetBox, Nautobot and Nornir are just a few examples. On the outbound side, every integration exposes a curated, read-only tool surface to NetPilot's agent, nothing more. On the inbound side, your own agent builds and validates labs through NetPilot's MCP server.

NetBox

Speaks to the official read-only NetBox MCP server you host: devices, sites, prefixes, object search, and changelogs. Ask “what changed this week?” or “build a lab from site DC-East” and the agent reads the records and does the rest.

Nautobot

The full read surface of your Nautobot MCP server: devices, interfaces, racks, IPAM, circuits, tenants, GraphQL queries, and job logs. The mutating tools (create, update, delete, run-job) are never attached.

Nornir

Live read-only CLI access to your real network: show commands only, enforced server-side. Inventory and credentials are brokered from your Nautobot at call time and executed in your environment. NetPilot never stores them.

These three are a few examples, not the list. NetPilot connects to anything with an API or an MCP server, and our team builds each integration for your workflow. When a whole workflow needs an agent, NetPilot builds and delivers a custom AI agent that uses these integrations as its tools. Talk to us about your stack → Comparing tools first? See seven network automation tools compared on how they work with your own agent.

From records to a running network

The agent turns source-of-truth data into a deployed, verifiable lab — and checks it against reality.

The agent reads your source of truth

Devices, interfaces, prefixes, free IPs, changelogs — the agent queries your NetBox or Nautobot directly in chat and designs the matching topology from what's really there.

app.netpilot.io

From records to a lab you can SSH into

The agent deploys the twin on real network OSes (15+ and growing) and runs the verification itself, and every device stays a normal SSH target, so you can check the routing table by hand.

app.netpilot.io

Validate — source of truth vs lab vs live

Snapshot and diff lab state, spot-check the live network with read-only show commands, and catch drift between intended and actual before it bites a change window.

app.netpilot.io

What you can do once your stack is connected

Ask in plain English: the agent picks the right read-only tools, and everything it builds is verifiable on real CLIs.

Twin lab from a NetBox site

“Build a lab from my NetBox site DC-East” — the agent pulls devices, interfaces, and prefixes, then deploys a matching multi-vendor lab on real NOSes.

IPAM answers in seconds

Free /28s, available IPs, VLAN and VRF lookups straight from Nautobot — asked and answered in the same chat that builds the lab.

Change rehearsal

Pull the affected segment from your source of truth, deploy the twin, apply the candidate change, and diff pre/post state — before production.

Drift detection

Compare intended state (NetBox/Nautobot records) against live state (show-command output) in one conversation and get the delta.

Read-only live checks

“Run show ip bgp summary on core-rtr-01” — Nornir executes read-only show commands with credentials brokered from your Nautobot, never stored.

Changelog forensics

“What changed in NetBox this week?” — the agent reads changelogs and job logs, without the ability to run or modify anything.

NetPilot integrations vs the DIY pipeline

The honest comparison: exporter scripts and hand-wired MCP servers work. They just cost engineering time NetPilot spends for you.

Setup
NetPilot
Built for you as a custom integration: URL + token on your side, tested live
DIY (exporters + hand-wired MCP)
Install an exporter, map device types, maintain topology YAML
AI agent
NetPilot
Agent queries the source of truth and builds the lab in one conversation
DIY (exporters + hand-wired MCP)
None: you re-run the export each time records change
Read-only safety
NetPilot
Allow-list-enforced read-only; tokens encrypted and write-only
DIY (exporters + hand-wired MCP)
Your scripts, your guardrails to write and audit
Live-CLI verification
NetPilot
Read-only show access through Nornir, credentials brokered, never stored
DIY (exporters + hand-wired MCP)
Separate Nornir/Netmiko tooling you maintain
Cost & control
NetPilot
Productized; custom integrations built to fit your workflow
DIY (exporters + hand-wired MCP)
Free, open source, full control of every file
Multi-vendor images
NetPilot
15+ NOSes and growing: built-in plus bring-your-own-image
DIY (exporters + hand-wired MCP)
You hunt, license, and manage images yourself

Bottom line

Pick the DIY pipeline when you need:

  • •Free and open source, with full control of every YAML file and image
  • •Runs fully offline on your own hardware

Pick NetPilot when you need:

  • •Integration built for you, read-only by construction, with no glue code to write or maintain
  • •The agent turns source-of-truth records into a running, SSH-able lab and validates the change

Verdict:DIY wins for hands-on control and zero budget; NetPilot wins when the goal is rehearsing real changes from real data: connected, deployed, and validated in one conversation.

Frequently asked questions

How teams connect their source of truth to NetPilot, safely

Containerlab, Cisco Modeling Labs, and NVIDIA Air all have a documented path via netreplica/nrx, an open-source exporter that turns a NetBox site into a topology file you then deploy yourself. Note that those nrx paths are NetBox-only. None of them documents a Nautobot equivalent. EVE-NG and GNS3 have no widely used first-party path, so teams write their own API glue. NetPilot covers both source-of-truth products: with a NetBox or Nautobot MCP server you host, NetPilot's custom-built read-only integration lets the agent query your records and build the matching lab on real network operating systems. There is still a server to host, but no exporter pipeline to write or maintain.
Yes. NetPilot connects to the network systems you already run, over API or MCP. Our team builds each integration for your workflow. NetBox, Nautobot and Nornir are a few examples. Anything with an API or an MCP server works. ServiceNow, Jira and Git connect the same way, and your own AI agents can drive NetPilot's MCP server in the other direction. Talk to us about your stack and it is scoped on the first call.
Yes, by two routes. The open-source route is netreplica/nrx: it reads a NetBox site and emits Containerlab, CML, or NVIDIA Air topology files that you deploy and configure yourself. The agent route is NetPilot's custom-built read-only integration: you host a NetBox or Nautobot MCP server, NetPilot's agent connects to it and queries devices, interfaces, cabling, and IP addressing, then designs a matching topology, generates per-vendor configuration, and deploys it on real network operating systems you can SSH into. Sites without cable or connection records need the links described in the prompt.
NetPilot's integrations are read-only by construction, not by trust: the agent is granted only a curated allow-list of read tools (exact names, never a wildcard), so write and delete operations are never attached, even if the server offers them. API tokens are encrypted at rest and write-only (never returned by any API), endpoints must be HTTPS, and an integration goes live only after a live handshake test passes. For live devices, credentials are brokered from your Nautobot at call time and never stored by NetPilot.
Yes. NetPilot's NetBox integration speaks to the read-only NetBox MCP server you host, and the agent can query devices, sites, prefixes, and changelogs. Our team builds the integration for your workflow, and your side is the server's HTTPS URL and a token. The verified path today is a NetBox MCP server you host yourself.
The NetBox REST/GraphQL API is the raw programmatic interface: you write the queries and the glue code. MCP (Model Context Protocol) is a tool layer on top of it built for AI agents: the server describes typed tools like get_objects or get_changelogs, and an agent picks and calls them from plain English. NetPilot uses MCP so the agent can read your NetBox without you writing any integration code, and so access can be constrained to an exact allow-list of read tools.
No. The integrations are read-only ingest: the agent can query devices, IPAM, racks, circuits, and changelogs, but create, update, and delete tools are excluded by the allow-list, as is running Nautobot jobs, since jobs can mutate data. There is no write-back or sync path. If you want the lab results reflected in your source of truth, that stays a human decision.
NetPilot connects to the network systems you already run, over API or MCP. Our team builds each integration for your workflow. NetBox, Nautobot and Nornir are a few examples. Anything with an API or an MCP server works. Git, ServiceNow/Jira, CI/CD, monitoring, and in-house tools connect the same way. If it has an API, NetPilot connects to it. Talk to us about your stack.
Tell us which system and where it runs. Our team builds the integration for your workflow: for NetBox or Nautobot that means a read-only path to the MCP server you host, with your token stored encrypted and never shown again, a live handshake before it goes live, and prod and staging side by side if you need both. Then you ask the agent in plain English.
Only read-only show commands, and only through the Nornir connector: the executor enforces a show-only guard server-side, inventory and credentials are brokered from your Nautobot (Secrets/Vault) at call time, and commands execute inside your environment. NetPilot stores neither credentials nor inventory. Configuration changes are rehearsed in the lab and carried into your own cutover. Work that changes the live network is a custom agent, built and delivered by NetPilot with the approval steps your team sets.

Connect your source of truth

Talk to us about wiring NetPilot into your stack. NetBox, Nautobot and Nornir are a few examples. Anything with an API or an MCP server connects.

Try It Free

Bigger stack? Talk to us about custom MCP integrations