One vantage point
for the entire network.
From BGP routes crossing the open internet down to packets inside your kernel, probectl maps five planes of signal onto a single live view — synthetic, routing, flow, device, and eBPF. Self-hosted, so the map is yours alone.
Two ways to run the same observatory.
Same five-plane core, same self-hosted promise — pointed at one network, or at many.
Five signals. One map.
Each one is gathered by your own agents — no external collectors, no third-party cloud — and plotted onto the same correlated view.
Synthetic & path
ICMP, TCP, UDP, DNS, HTTP, agent-to-agent, voice quality and last-mile WiFi — plus ECMP/MPLS-aware hop-by-hop traces.
BGP intelligence
Live RIS / RouteViews monitoring for hijacks, leaks, and origin changes — RPKI-aware, with ASN and geo context.
Flow analytics
Passive NetFlow, IPFIX and sFlow — top-talkers, link capacity and egress anomalies, with sampling corrected.
Device telemetry
SNMP plus streaming gNMI / OpenConfig — interface health, errors and capacity for every box in the fabric.
eBPF · L3–L7
A kernel sensor that sees L3 through L7 and maps service dependencies — with zero changes to your applications.
All on one
OpenTelemetry-based
control plane.
Built for the questions you ask at 2 a.m.
From signal to cause.
A flare on the map isn't an answer. probectl folds every plane's signal into one tenant-scoped incident, then walks the live topology to find the cause — and cites the evidence behind each step.
Traced across planes
A route change, a path shift, and an egress spike become one story — not three pages.
Cited, never guessed
Every claim links to the exact signal that supports it. A reading you can audit.
Observe-only by default
It reads the network and explains it. It never acts without an explicit, audited go-ahead.
Ask it in plain language
The built-in assistant answers with cited, tenant-scoped evidence. Its default engine is deterministic and local — no LLM is contacted unless you connect one (Ollama/vLLM for full air-gap) — and an MCP server hands the same map to your own AI tools.
Ask your network.
It answers with evidence.
Most "AI-powered" observability sends your telemetry to someone else's model and returns prose. probectl's assistant is built the other way around: it answers only with citations to signals you're allowed to see, says "insufficient evidence" instead of inventing a story, and runs air-gapped by default.
Cited, or silent
Every claim links to a real incident or change event. Ungrounded model claims are rejected before you see them — "I don't know" is a first-class answer.
The sovereignty ladder
Deterministic built-in engine (zero config, no LLM) → a model on your hardware (Ollama / vLLM, loopback, no consent needed) → a cloud model only behind an explicit operator acknowledgment and per-tenant consent, every call audited.
Your AI, your map — MCP
An MCP server hands the live network map to Claude or any MCP client as eight tenant-scoped tools: read-only queries, one gated analysis, one proposal-only remediation. The AI sees exactly what its token's user may see.
The map never leaves the room.
probectl is self-hosted by design. Your telemetry stays inside your perimeter — no phone-home, ever, right down to license checks, which are offline math. Point the AI at a local model and the whole observatory runs air-gapped.
If you already watch your network.
probectl is not another SaaS agent fleet. The difference is where the data lives — and how many planes it correlates for you.
Command the observatory.
Source-available and self-hosted. The evaluation stack on the left is real — sample data, loopback-only, one command to a live service map (a few minutes on the first from-source build, seconds after). Production is the same idea grown up: one static Go binary per agent, Docker or Helm, HTTPS by default — single-tenant for one team, or multi-tenant and white-labeled for MSPs.
The five-plane core is free. Enterprise adds the FIPS build, BYOK, and multi-region HA; Provider/MSP adds the management plane, metering, and white-label — see editions.
Built like infrastructure, not a demo.
Claim your vantage point.
It's source-available and self-hosted — clone it, run the eval stack, and you're on a live service map in minutes. No waitlist, no sales call.