NetBox Agents
NetBox Agents brings AI agents to the NetBox Labs Platform. Agents work alongside your team, grounded in your infrastructure data, and take on the everyday work of operations so you can focus on running the network. An agent can generate a report every Monday morning, react to a NetBox change the moment it happens according to your policies, and answer your followup questions in a chat session. What an agent may do is policy you set: permissions, human approvals, and NetBox's own change governance.
Public Preview - NetBox Agents is available now for NetBox Cloud customers. Contact your account team to enable it for your organization. During the preview, we strongly recommend connecting non-production NetBox instances only.
Key concepts
| Concept | What it is |
|---|---|
| Agent | A configured persona: instructions in natural language, the toolkits it can use, and the permissions it runs under. |
| Prebuilt agent | A shipped starting point for an agent. Prebuilt agents carry instructions, suggested workflows, and setup guidance. |
| Toolkit | A connection that gives agents capabilities, for example the NetBox toolkit that lets agents read and update your NetBox. |
| Event source | Where events come from. The NetBox event source receives webhooks from your NetBox so agents can react to changes. |
| Workflow | A unit of automation attached to an agent: one or more triggers, plus instructions for what to do when they fire. |
| Trigger | The firing rule for a workflow: a schedule, an event pattern, or a semantic condition ("fire when an allocation looks significant") evaluated against incoming events. |
| Session | One end-to-end conversation with an agent - a chat you start, or a workflow run a trigger starts. |
| Approval | A pending decision. When an agent wants to do something your policy gates, the request waits for a human to approve it, ask for changes, or reject it. |
The prebuilt agents
Creating an agent starts from a prebuilt agent, or from scratch. The catalog grows over time; during the preview it includes:
| Prebuilt agent | What it does |
|---|---|
| IPAM Agent | Watches IPAM events and keeps addressing consistent: carves subnets, fills descriptions, flags conflicts. Stages its changes as reviewable NetBox branch changes. |
| Reporting Agent | Runs on a schedule and posts digests: capacity, drift, hygiene, change activity. Read-only. |
| Troubleshooting Agent | Interactive diagnostic assistant for connectivity and path analysis: traces documented cable paths, correlates recent changes, maps blast radius, and locates gear. Read-only. |
The read-only agents are the recommended starting point: they let your team experience what agents can do with no risk to your data. Introduce write-capable agents once you have seen the approval flow work end to end.
How changes are governed
Agents do not decide what needs review - policy does. Everything an agent does passes through tool permissions you set, which allow the action, require approval, or block it. When approval is required, the request waits for a human decision, with the proposed change shown for review. You can approve it, ask a question, or request changes.
Write-capable agents can also work within NetBox's own governance: changes are staged in a NetBox branch and promoted through change management, where a reviewer approves the change request in NetBox itself. This is why we recommend enabling both plugins on any connected instance.
Get started
The quickstart walks through connecting a NetBox instance and creating your first prebuilt agent.