Self-Hosted Network Observability for AI Agents

The substrate

An agent can only reason about what you let it see.

Most agentic demos reason over a thin API or a screenshot of a dashboard, which is why they guess. NitroNet lands eight kinds of telemetry in one columnar store on one clock, then hands the whole thing to your agents as callable tools. The answers are queries against your data, not inferences about it.

Flow NetFlow v5/v9, IPFIX and sFlow at line rate, enriched with GeoIP, ASN and DNS. goflow2 → Kafka → ClickHouse

SNMP v1 through v3 with AES-256-GCM credential storage and vendor-aware handlers. Cisco · Arista · Juniper · Palo Alto · Fortinet · Aruba · Dell

Packets A deployable probe that turns packets into flow with TCP performance built in. RTT · retransmits · microbursts · SNI via TLS/QUIC

Logs Device syslog, filtered and charted by severity alongside everything else. syslog → dashboards

Synthetics Curl, ping and DNS checks from the core or from any remote probe. path analysis · deviation alerts

Cloud AWS VPC flow logs enriched with account metadata and drawn into the same topology. Vector → VPC flow logs

OpenTelemetry Native OTLP ingest for traces and metrics, so application spans line up beside the flow records that carried them — and the same data exports back out to whatever you already run. OTLP in & out · traces · metrics

Address space Built-in IPAM resolves every address in every flow record to a named subnet, site and owner — so a chart reads “Dallas guest wi-fi” instead of 10.14.88.0/22. prefix assignment · RFC1918 · CSV & REST import

MCP-native, not MCP-adjacent

Seventeen tools. Any agent that speaks MCP can call them.

The platform ships a Model Context Protocol server, so NitroNet is not a destination your team logs into — it is a capability your agents already have. Point Claude Desktop at it, wire it into your own orchestration, or let it back a runbook. Same tools either way.

Open standards on both ends: OTLP in, MCP out. Self-hosted should mean you own your telemetry, not that it is stuck in someone else’s box — including ours.

Query Ask for flows, counters, logs or synthetic results in natural language and get rows back, not summaries of rows. query_flows · get_counters · search_logs

Context Resolve an address to its subnet and site, walk the topology, pull the config history for any device. lookup_prefix · get_topology · diff_config

Act Push a config, acknowledge an incident, open a ticket — each one gated behind an approval step you control. apply_config · ack_incident · create_ticket

Your model Run Claude for reasoning quality, or Ollama entirely on-premises when telemetry cannot leave the building. Claude · Ollama · pluggable

What the agents do with it

Reasoning you can audit, on data you can check.

Incident correlation is the job people notice first, and it matters — but it is one agent among several, and none of them are the point on their own. The point is that every conclusion traces back to a tool call you can re-run yourself.

01

Correlation

Signals from flow, SNMP, config, topology and IPAM assemble into one incident with a stated cause and a confidence score. Duplicates collapse instead of paging you five times.

02

Prediction

Baseline deviation catches the slow ones — memory leaks trending toward an OOM, interfaces drifting toward saturation — while there is still time to schedule the fix.

03

Grounding

Findings are computed deterministically first; the model writes the explanation over the top. Every number in an answer came from a query, never from the model.

04

Human in the loop

Agents propose; you approve. Actions route through ServiceNow or Teams for sign-off, and every step stays on the audit trail.

Why self-hosted

Your telemetry is a map of your network. Stop mailing it out.

SaaS observability means every flow record, every device name and every topology edge lives in someone else's account, priced by the device, renewed on their terms. For a bank, a utility or a defence supplier, that is not a pricing objection — it is a non-starter.

Run it on your own iron

SaaS observability

NitroNet

Priced per device, per month

Free tier, then flat

Telemetry stored off-site

Never leaves your network

Retention capped by tier

Capped by your disk

Egress and ingest charges

None

Air-gapped? Not supported

Supported

Their model, their cloud

Ollama on-prem, if you like

Also in the box

The unglamorous things you would otherwise buy separately.

No add-on SKUs. These ship with the platform because an observability tool that cannot tell you what changed — or whose subnet that was — is only half a tool.

Topology

LLDP-derived maps with role-based layout, drilling straight down into the flows crossing any link.

IPAM, not a spreadsheet

Prefix assignment, RFC1918 filtering, CSV and REST import — and because it lives inside the platform, every flow, alert and topology edge is already labelled with it.

Config management

Collect and push device configs with built-in Ansible playbooks, with every change on the incident timeline.

Intelligent incident creation

Signals become incidents, not notifications. Static thresholds and baseline deviation feed the assembler, which dedupes, scores and opens one incident with its evidence attached — to Slack, Teams, ServiceNow or webhook.

Reports

Scheduled customer-ready reports with written analysis grounded in computed findings.

Multi-tenant

MSPs run every client from one control plane with isolated data and per-tenant access.

Straight answers

Questions engineers ask before they install anything.

Is NitroNet actually free, or is this a trial?

Free, with no time limit and no per-device fee. The free tier runs the full collection stack — NetFlow, IPFIX, sFlow, SNMP, OpenTelemetry, syslog and synthetics — on hardware you own. Paid tiers add multi-tenancy for MSPs, longer support commitments and scale-out beyond a single node.

What hardware do I need to run it?

One machine with 8 vCPU, 16 GB of RAM and 200 GB of disk, running Ubuntu 22.04 or later with Docker. A single node sustains roughly 100,000 flows per second and polls thousands of devices. Retention is bounded by your disk, not by a pricing tier.

Does any of my network data leave my network?

No. Flow records, device names, configs and topology all stay in your own ClickHouse and PostgreSQL instances. If you point the agents at Claude, prompt context goes to Anthropic; if that is unacceptable for your environment, run Ollama locally and nothing leaves the building at all. The installer reports its hostname and specs once for licensing, and that can be switched off.

How is this different from SolarWinds, Kentik or Zabbix?

Two structural differences. It is self-hosted, so telemetry never sits in a vendor's cloud and pricing does not scale with device count. And it is MCP-native, so the platform is a set of tools your own AI agents can call rather than a dashboard a person has to read. Zabbix gives you thresholds; NitroNet gives you an agent that queries flow, configs and topology together and tells you which change caused the outage.

Which devices and vendors are supported?

SNMP v1 through v3 with vendor-aware handlers for Cisco, Arista, Juniper, Palo Alto, Fortinet, Aruba and Dell, plus generic support for anything that speaks standard MIBs. Flow collection is vendor-neutral — any exporter emitting NetFlow v5/v9, IPFIX or sFlow works, including AWS VPC flow logs.

What does the MCP server actually let me do?

It exposes the platform as callable tools, so an agent can query flows, read interface counters, diff a device configuration, resolve an address against IPAM, walk the topology and check synthetic results — then propose an action for you to approve. Point Claude Desktop at it, or wire it into your own orchestration. See the MCP section for the tool groups.

Can I export my data back out?

Yes. OTLP works in both directions, so metrics and traces can flow out to whatever you already run. Self-hosted should mean you own your telemetry, not that it is trapped in someone else's box — including ours.

Free tier · no credit card · no sales call

One box, one command, about ten minutes.

Give it 8 vCPU, 16 GB of RAM and an Ubuntu 22.04 host with Docker. Point your exporters at it and watch the first flows land.

curl -fsSL https://nitronet.ai/download/s/<your-token>.sh | sudo bash

Tell us where to send your token and the command arrives ready to paste.

Get my install command

Rather look first? Read the quickstart or book a walkthrough.