Reference design: NetBox, rConfig and monitoring behind one AI agent
The smallest AI operations setup that answers real questions: a source of truth for intent, rConfig for configuration, and monitoring for health, all reachable by one agent over MCP. Most teams already run all three tools. This design adds the agent and the glue that makes their answers line up.
What it looks like
flowchart LR
NB["NetBox<br/>intent"] -- "Device Sync" --> RC["rConfig<br/>configuration"]
A["AI agent<br/>Claude Code, Cursor, Codex, n8n"] -- "MCP, read-only" --> NB
A -- "MCP, read-only" --> RC
A -- "MCP, read-only" --> MON["Monitoring<br/>Zabbix, LibreNMS, Grafana"]
| Component | Answers | MCP server |
|---|---|---|
| NetBox (or Nautobot, Infrahub) | What should exist | NetBox Labs’ read-only server, or the equivalent |
| rConfig | What is configured, what changed, is it compliant | rConfig’s built-in server |
| Monitoring | What is happening now | Grafana’s official server; community servers for Zabbix and LibreNMS |
The glue is Device Sync. rConfig imports its inventory from NetBox (or Zabbix, Nautobot, Infrahub and others) through Device Sync, so hostnames match across all three tools and the agent can join records exactly.
Questions this design answers
| Question | Playbook |
|---|---|
| “This alert fired; did a config change cause it?” | Alert to root cause |
| “Where do NetBox and the network disagree?” | NetBox intent vs config |
| “Which devices are exposed to this advisory?” | Security advisory exposure |
| “How is this site built?” | Engineer onboarding |
Identities and access
- Read-only everywhere. A NetBox token without write permissions, a monitoring user with view rights, an rConfig MCP token.
- People use their own tokens. An engineer’s rConfig token follows their role, so the agent sees what they see.
- Automation uses service users. n8n workflows and scheduled jobs get dedicated, narrowly scoped accounts in each tool.
Growth path
- Add an ITSM server for change and incident context: ITSM-integrated design.
- Add event-driven workflows with n8n and rConfig webhooks: Event-driven narration.
Related reference
Frequently asked questions
Why combine NetBox, rConfig and monitoring in one agent?
Each answers a different question: what should exist, what is configured, and what is happening now. Most real network questions need at least two of them, and an agent connected to all three can combine the answers.
How do device names line up across the three tools?
Use rConfig's Device Sync to import the device inventory from NetBox (or Nautobot, Infrahub, Zabbix and others). The same hostnames then appear in every tool, and the agent can match devices exactly.
Which agent should we use?
Any client that can connect to several MCP servers: Claude Code, Cursor, VS Code with Copilot or Codex CLI for engineers, n8n for automated workflows.