LoginSign Up
← Back to all sparks
N

NetBird

INFRA · APIS
Velocity6.3

Open-source overlay network platform for secure remote access and VPN

netbird.io ↗

NetBird's v0.83 candidate turns its management API into an MCP server for AI tools.

zero-trustmcpai-agentsself-hostednetwork-management
◆Current state
NetBird v0.82 candidates removed MySQL in favor of PostgreSQL and deprecated Rosenpass. The first v0.83 candidate, on November 9, serves the management REST API as an MCP server behind an OAuth 2.1 broker, with a consent page that leaves write access unticked by default and MCP sign-ins recorded in the activity log. It also reports LLM token usage from the proxy, renews cached ACME certificates and adds profile ownership checks to the client.
◆Where it's heading
After a storage and hardening cycle, NetBird is opening its control plane to AI agents, with guardrails visible in the same release: OAuth, read-only defaults and audit logging. The proxy reporting LLM token usage points to NetBird also positioning itself in front of AI traffic.
◆Prediction
Expect v0.83 release candidates to refine MCP permissions and catalog coverage, with LLM gateway metrics expanding in the proxy.

◆Recent moves

  1. 4d ago

    v0.83.0-rc.1: management API served as an MCP server

    ⚡ SPARK

    v0.83 moves from v0.82's storage changes to AI access: the management API is exposed over MCP with an OAuth 2.1 broker, read-only consent by default and audit logging. The proxy also starts reporting LLM token usage.

    View source ↗
  2. 16d ago

    v0.82.0-rc.2: Rosenpass deprecated, SSH root-login and env hardening

    rc.2 keeps rc.1's breaking storage changes and adds a Rosenpass deprecation plus two SSH hardening fixes. The release now carries a migration burden and a security cleanup, and the deprecation hints at a new post-quantum approach.

    View source ↗
  3. 18d ago

    v0.82.0-rc.1: MySQL removed, access logs get their own database

    The first v0.82 candidate shifts from v0.81's device trust to management scale: MySQL support is removed in favor of PostgreSQL, access logs get a dedicated store, and peer listing is paginated with reads moved to a replica. Self-hosters on MySQL face a required migration.

    View source ↗
  4. 23d ago

    NetBird canary rebuild: group-restricted daemon socket

    A rebuild of the group-restricted daemon socket canary with no new notes. The feature is still in testing.

    View source ↗
  5. 1mo ago

    v0.81.0-rc.3: management and Traefik backports

    The third v0.81 candidate backports a management account-hierarchy change and a Traefik and CrowdSec version fix for the self-hosted stack. Nothing user-facing was added, which signals the release line is frozen ahead of final.

    View source ↗
  6. 1mo ago

    v0.81 canary: route hysteresis stops HA peer flapping

    This canary adds time hysteresis to route selection, so clients stop switching between HA group routing peers that advertise the same metric. It is a reliability fix for exactly the failover setups NetBird's enterprise push depends on.

    View source ↗