Credentials never touch your laptops
The NetStacks Controller owns all credentials, proxies every SSH connection, and keeps the audit trail. Your engineers connect to devices without ever seeing a password. That's not a feature — it's the architecture.
How it works: Controller-Proxied SSH
- Auth & RBAC
- Credential Vault
- SSH Proxy
- Audit Log
- Session Recording
Teams & Enterprise run on the Controller
The free standalone app is full-featured for one engineer. The Controller is the shared server where the team capabilities live — shared memory, knowledge, automation, and resilient sessions for everyone.
Shared AI Knowledge Base (RAG)
An org-wide knowledge base of runbooks, notes, crawled web pages and session recordings. Every engineer's AI searches the same institutional knowledge, with embeddings generated locally on the Controller.
Shared Device Memory
Device roles, criticality, standing instructions and memories from past troubleshooting live on the Controller, are shared across the team, and are fed into that device's AI context.
Config Templates & Service Stacks
Versioned Jinja templates with automatic variable extraction, plus multi-device service stacks pushed over gNMI or NETCONF that you can deploy, track, and roll back.
Alerts & Incidents Plugins
Optional plugins: ingest alerts by webhook or Kafka, deduplicate and route them with rules, escalate to email, Slack, PagerDuty or a webhook, and sync incidents with ServiceNow or Jira.
Per-User Isolated Containers
Each engineer gets their own jumpbox container on the Controller — a clean, tool-equipped Linux shell for reaching devices, with no shared shell state.
Resilient & Shared Sessions
The Controller holds SSH sessions open through short client disconnects so engineers resume where they left off. Share a live session read-only or read-write with a link.
The architectural advantage — credentials never leave the server
All SSH connections route through the Controller. Credentials are fetched from the encrypted vault at connection time and stay in server memory — they never reach the engineer's laptop or browser. This means a compromised endpoint cannot leak your network passwords.
The browser-based terminal is the same NetStacks interface as the desktop app: AI assistant, device inventory, topology views and SFTP. No install required — just a browser and your Controller account.
- Credentials never on endpoints — zero exposure surface
- Browser terminal — no install required
- Session recordings stored centrally on the Controller
- Short-lived SSH certificates from the built-in CA
# 1. Engineer signs in from the desktop app or browser
POST /api/auth/login → access token
# 2. Engineer opens core-rtr-01 from the Devices panel
# → Controller decrypts the profile secret from the org vault
# → Controller opens the SSH session to the device itself
router-01# show ip bgp summary
Neighbor AS MsgRcvd MsgSent State
10.0.0.1 65001 12045 11982 Established
10.0.0.2 65002 8891 8820 Established
# 3. Output streams back over a WebSocket
# → the password never reaches the engineer's machineDefense in Depth
Five layers of security from transport to audit — each reinforcing the next
Audit & Monitoring
Audit log of logins, secret reveals and admin changes. Central session recordings. An activity monitor for MOPs, deployments and AI agent runs.
Access Control
Role-based access with built-in and custom roles. Organizations keep teams' devices, profiles and secrets apart.
Authentication
Controller accounts with Argon2-hashed passwords and login rate limiting. Short-lived SSH certificates from a built-in Ed25519 CA.
Credential Management
AES-256-GCM vault with Argon2id-derived per-organization keys. Personal, shared and service profiles. Revealing a secret requires a reason and is audited.
Transport Security
The Controller opens every device SSH session itself. HTTPS for the API, admin console and browser terminal. Credentials stay on the server.
Role-based access with custom roles matching your org
Built-in Admin, Operator, and Viewer roles are the starting point. Create custom roles from the permission catalog to match your org, and keep administration — users, credentials and system settings — with the people who need it.
Organizations separate teams or customers on one Controller: each has its own devices, connection profiles, secrets and roles, and platform administrators can switch between them.
- Built-in and custom roles
- Separate administration of users, credentials and settings
- Multiple organizations on one Controller
- Per-profile grants to use or reveal shared credentials
| Permission | Admin | Operator | Viewer |
|---|---|---|---|
| Device Inventory | ✓ | ✓ | ✓ |
| Topologies | ✓ | ✓ | ✓ |
| Knowledge Search | ✓ | ✓ | ✓ |
| SSH/Telnet Sessions | ✓ | ✓ | — |
| AI Agents | ✓ | ✓ | — |
| MOPs | ✓ | ✓ | — |
| Credentials Vault | ✓ | — | — |
| Users & Roles | ✓ | — | — |
| System Settings | ✓ | — | — |
An audit trail you can actually use.
Audit log, central session recordings, and versioned device configurations
Audit Logging
Logins and failed logins, user and role changes, secret reveals and rotations, session takeovers and shares, SSH certificate issuance, and device commands run by users or the AI are written to the audit log. Filter by event type, user, resource or date range.
Activity Monitor
One timeline of MOP executions, config deployments, snapshots, task runs, SSH sessions and AI agent runs, filterable by category, status and time range, with links to per-device logs and transcripts.
Session Recording
Terminal session recordings are stored centrally on the Controller in asciinema format, ready to play back or download from the admin console. Administrators decide whether recording is allowed.
Config Snapshots
Capture device configurations on demand for a site or device type, and automatically before and after every stack deployment. Every version is kept, so you can diff any two to track drift.
Your team's tribal knowledge, attached to the device
NetStacks is not a terminal with AI bolted on. The device session is the context — and in Enterprise mode, every device's memory is shared across your organization. Incidents, root causes, standing instructions, and ticket references live with the device, not in one engineer's head.
When anyone on the team works on a device that had an issue two weeks ago, the history is there: what happened, how it was resolved and the ticket number. The same history is fed into that device's AI context (run through mandatory credential sanitization), so the assistant reasons with the full backstory. New team members walk into context instead of starting blind.
- Org-wide device memory on the Controller
- Role, criticality and standing instructions per device
- Memories saved from troubleshooting sessions
- Sanitized before it ever reaches the AI provider
Device Memory · core-rtr-01 shared across org
Role: Core router
Criticality: High
Standing instructions:
Verify MTU on Te0/1/0 before touching the AS 65002 peer
Memories (2)
Troubleshoot 14 days ago BGP flap to AS 65002
root cause: MTU mismatch on Te0/1/0 (carrier change)
resolved: mtu 9192 + clear bgp neighbor 10.0.0.2
ticket: INC-4821
Manual 6 weeks ago IOS-XR upgrade to 7.10.2 (CHG-2290)
→ included in this device's AI context (credentials sanitized)Self-hosted, on infrastructure you control
The Controller ships as a set of containers — API, admin console, discovery crawler, PostgreSQL and Valkey — installed with one script on top of Docker Compose. Upgrades are a pull and a restart, with a database backup taken first.
Run a single instance, or HA mode with several API instances behind the bundled load balancer. Use the bundled PostgreSQL or point the Controller at your own, and take database backups from the admin console.
- One install script, Docker Compose underneath
- Bundled or external PostgreSQL
- HA mode with multiple API instances
- In-product database backup and restore
On-Premises
Full control. Deploy within your network perimeter on a Linux server or VM with Docker. Devices, credentials and configs stay in your environment.
Cloud / Hybrid
Run the Controller in your cloud VPC. Engineers connect via browser or desktop app. Same security model, flexible deployment.
Built for regulated environments
The controls auditors ask about, running on infrastructure you operate yourself
Frequently asked questions
Ready to evaluate NetStacks for your organization?
See the Controller architecture in action. Schedule a demo with our team.