Netcode Automation + Rez Diagnostics

Closed-loop network automation, with the engineer still in command.

Run serious NetDevOps workflows without building the framework yourself. Netcode discovers live state, plans the change, validates safety, stages canary execution, verifies the result, and hands failures to Rez Diagnostics.

The machine closes the loop of work. The human closes the loop of decision. Production writes require approval; reads, verification, drift checks, and RCA can run automatically because they are read-only.

Run Free Upgrade Campaign Watch 90-sec Demo Book pilot

Workflow packs OS upgrade campaigns Git-backed rollback Readiness / canary gates Full live Netcode Shell Multi-vendor read adapters Drift detection Read-only diagnostics

Netcode Automation Console Next safe step

OS Upgrade Campaign UPG-2048

EOS 4.31.2F -> 4.32.1F across Region 3

No reload before approval

184 selected12 sitesCanary size: 1

Select target Readiness Cohorts Plan Stage image Canary Verify Batch Close

Git branch: upgrade/eos-region3-2048 Stop rule: pause on critical failure Batch size: 10 devices Rollback: previous image captured

184devices selected

142ready to stage

31need review

11blocked

Canary command preview

copy scp://images/EOS-4.32.1F.swi flash:
verify /sha512 flash:EOS-4.32.1F.swi
copy running-config startup-config
boot system flash:EOS-4.32.1F.swi
reload at 01:30

Rollback preview

boot system flash:EOS-4.31.2F.swi
copy running-config startup-config
reload at 02:10
verify version == 4.31.2F
verify neighbors restored

Next safe action Stage image on the canary only. No device reloads and no batch promotion happen until readiness, checksum, approval, and post-check gates pass.

Start Here

Choose your first workflow pack.

Start in sample mode with no credentials. See the plan, exact commands, canary, verification, stop rules, rollback, and Rez Diagnostics handoff before touching real devices.

Flagship

OS Upgrade Campaign

Check readiness, stage images, upgrade a canary, verify, then promote batches safely.

Try Sample Pack

Golden Baseline

Standardize NTP, DNS, SNMP, logging, AAA, banners, and config hygiene.

Try Sample Pack

VLAN Rollout

Plan VLAN and trunk changes across sites with canary and rollback.

Try Sample Pack

Drift Check

Compare intended state to live state and open remediation safely.

Try Sample Pack

You are not launching a blind script. Start read-only -> Plan -> Canary -> Verify -> Promote batch -> Pause on risk.

Netcode Automation

From network intent to controlled execution.

Netcode is the automation workspace for network engineers. Start with live discovery and source-of-truth alignment. Define the intended outcome. Preview the exact network change. Validate safety. Dry-run or canary. Apply in controlled batches. Verify live state. Track drift over time.

Discover and model

Read live network state, normalize device facts, and align inventory with your source of truth before automation begins.

Device discovery
Source-of-truth sync
Vendor read adapters
Site and device grouping

Plan and validate

Turn intended outcomes into exact configuration changes, policy checks, risk summaries, and rollback plans.

Bulk change plans
Exact command preview
Policy gates
Blast-radius view

Apply and operate

Use canary, batch controls, approval gates, verification checks, drift watch, and Git-backed rollback.

Canary execution
Batch apply
Live verification
Git rollback

Workflow Packs

Start with OS upgrades.

Workflow Packs are playbooks without the coding. Pick a pack, fill in the variables, review the plan, run a canary, and promote batches only when verification proves the next step is safe.

Flagship paid workflowGuided campaign

Network OS Upgrade Pack

Upgrade campaigns are high-risk because they combine inventory drift, image staging, maintenance windows, reboot risk, post-checks, and rollback pressure. Netcode turns that into a guided operator workflow.

Select target Readiness scan Build cohorts Review exact plan Stage image Upgrade canary Verify canary Promote batch Verify fleet

Run Free Upgrade Campaign Check My Fleet Readiness

Golden Baseline Pack

Free entry workflow for NTP, DNS, syslog, SNMP, AAA, banners, logging, and config standards readiness.

VLAN Rollout Pack

VLAN creation, trunk updates, SVI/gateway checks, canary verification, and drift watch.

Interface Standards Pack

Access, trunk, routed port, and description standards with exact command preview and rollback.

BGP Neighbor Pack

Neighbor config, route-policy checks, pre/post routing validation, and safe rollback.

ACL Cleanup Pack

Rule analysis, proposed changes, blast-radius review, staged apply, and verification.

Drift Check Pack

Compare intended state to live state and open a remediation workflow only for affected devices.

Python-grade NetDevOps. No Python required. Inventory becomes device groups. Variables become workflow settings. Tasks become guided steps. Check mode becomes plan and dry-run proof. Play recap becomes verification. Rollback stays tied to Git.

Guided NetDevOps

The control of Ansible or Python automation, packaged as a guided workflow.

Netcode workflow packs use proven NetDevOps patterns: inventory, variables, tasks, checks, gates, rollback, and verification. Automation engineers can inspect and extend the workflow. Network engineers can run it safely without starting from a blank Python script or YAML playbook.

Try a workflow pack

Python script / Ansible playbookGuided workflow

Inventory fileDevice group selector

VariablesEditable workflow settings

TasksStep-by-step operator flow

Check modePlan and dry-run

Error handlingStop rules

Rollback scriptRollback plan

Post-check scriptsExpected vs actual checks

90-sec Demo

See the workflow before connecting devices.

The demo walks through a sample OS upgrade campaign: readiness scan, blockers, canary plan, exact commands, verification, and what happens when a post-check fails.

Request demo video

Demo sequence

Run sample upgrade campaign
Review readiness blockers
Approve canary plan
Inspect exact commands and rollback
Verify expected vs actual state
Open Rez Diagnostics when verification fails

Bulk Network Automation

Plan one change. Apply safely across many devices.

Netcode is built for repeatable network changes across sites, regions, and device groups. Engineers define the outcome once, review the generated plan, canary the first batch, then promote safely.

1Select targetsRegion 3, Sites 101-112, 96 devices

2Define intentAdd app segment, trunk scope, route policy, firewall object

3Create Git branchchange/region3-app-segmentation-2048

4Generate plan384 commands, 384 rollback commands

5Validate safety7 checks passed, 4 policy warnings held

6CanaryApply to 6 mixed-role devices first

7Batch applyPromote batch 2 of 6, pause on failure

8Verify and driftVerify actual state, enable drift watch

Device	Site	Vendor	Planned Change	Validation	Canary/Batch	Verify
Access-SW-01	Site 101	EOS	VLAN 210 + uplink trunk	Passed	Canary	Verified
Access-SW-02	Site 101	IOS-XE	Access VLAN + trunk scope	Passed	Batch 2	Pending
Edge-FW-01	Site 104	FortiOS	Firewall object + policy reference	Warning	Held	Not applied
Core-RTR-02	Site 108	Junos	Prefix export policy	Passed	Batch 3	Pending

Run Sample Bulk Plan

Under the Hood / How Network Automation Works

The automation logic is simple: compare intended state to live state, then apply only what is proven safe.

Netcode does not blindly push templates. It follows a deterministic automation loop: read live state, model intended state, calculate the delta, validate policy, dry-run or canary, apply through gates, verify actual state, and keep rollback tied to Git.

Netcode automation is not template push. It is intent - plan - validation - controlled execution - verification - drift control.

Live State

Interfaces, VLANs, BGP neighbors, routes, ACLs, NTP, SNMP, firmware, interface state.

Intended State

Approved NTP servers, VLAN standards, interface roles, routing peers, ACL rules.

Delta Plan

Devices affected, commands to add, commands to remove, rollback commands, risk summary.

Git Branch + Policy Gate

Each change is isolated, reviewed, checked, and blocked before execution if unsafe.

Dry-run / Canary

Candidate config, device syntax check, first-batch canary, and no-commit validation where supported.

Verify Actual State

NTP peers active, VLAN present, BGP session established, route installed, ACL ordered correctly.

Git Rollback + Drift Watch

Rollback to previous approved intent, validate reverse plan, apply through the same gates, and monitor drift.

Product Modules

Everything needed to move from scripts to governed NetDevOps.

Change Workspace

One guided workspace for intent, plan, validation, dry-run, apply, verify, rollback, and drift.

Bulk Change Planner

Select device groups by site, role, vendor, tag, or source-of-truth query. Plan one change across many devices.

Command Preview

Show exact generated commands and rollback commands before anything touches a device.

Git Workflow

Create review branches, commit generated artifacts, review diffs, merge approved intent, and roll back by reverting Git state.

Policy Gates

Block unsafe changes before apply using device groups, command patterns, maintenance windows, approvals, and rollback requirements.

Canary and Batch Apply

Apply to a small canary first, verify, then promote in controlled batches with automatic stop conditions.

Drift Watch

Continuously compare intended state to live state and create remediation plans when drift appears.

Netcode Shell

Open full live SSH sessions through the local runner with transcripts, before/after evidence, optional ticket attachment, and runner-side credentials.

Workflow Packs

Start with guided OS upgrade campaigns, then add golden baseline, VLAN rollout, interface standards, BGP neighbor updates, ACL cleanup, and drift checks.

Netcode Shell

A real network CLI, connected to the automation loop.

Network engineers still need a full shell. Netcode Shell gives them one: live SSH through the customer-side runner, credentials kept local, every command recorded, and a clean path from an ad-hoc fix into governed automation when the work should be repeated.

Credentials stay local

Device credentials resolve on the customer-side runner, not in the browser and not in the control plane.

Full live CLI

Engineers can troubleshoot and configure from the shell. The human at the keyboard is the approval for this interactive path.

Every session is useful later

Transcripts and before/after diffs can attach to a ticket, change, RCA, drift investigation, rollback, or approval record.

Netcode Shell Live SSH

Session recording · optional ticket CHG-2048

Core-RTR-02 · Region 3

Runner customer-side Mode full live SSH Transcript recording Evidence before/after diff

Core-RTR-02# show bgp ipv4 unicast 10.204.210.0/24
BGP routing table entry for 10.204.210.0/24
  Paths: 2 available, best #1
  Community: region3-app-segment

Core-RTR-02# configure terminal
[live] config mode entered · transcript recording
Core-RTR-02(config)# route-map REGION3-EDGE permit 20
Core-RTR-02(config-route-map)# set local-preference 180
Core-RTR-02(config-route-map)# end
Core-RTR-02# show archive config differences
[diff] route-map REGION3-EDGE permit 20 added

Automation handoff If this fix should repeat, turn the transcript into a Netcode plan with rollback, validation, canary, and human-approved apply.

NetDevOps Governance

Every change has a branch. Every rollback has a known previous state.

Netcode uses Git as the system of record for network intent and generated artifacts. Engineers can review plans before apply, promote approved changes, and roll back by reverting to the last known good intent.

A change branch isolates every network change.
The plan shows exact intended delta.
Policy checks run before apply.
Canary result is committed back to the branch.
Merge means approved intent.
Drift watch compares live state to approved intent.

main change/region3-app-segmentation-2048 intent.yaml plan.md commands.txt rollback.txt validation.md canary-result.md verify.md

Git Rollback Panel

Rollback CHG-2048

Previous approved state: main@8f31a2
Current branch: change/region3-app-segmentation-2048
Rollback action: revert app segment, route policy, and firewall object references
Rollback commands: 384 generated
Validation: Passed
Status: ready for rollback canary

Rez Diagnostics

Troubleshooting that starts with live evidence, not guesses.

Rez is the read-only RCA layer for network operations. It collects live SSH/API evidence, compares expected vs actual state, identifies failed conditions, and gives engineers the next safe action.

Ask an operational question

Investigate reachability, VLANs, BGP, routes, ACLs, firewall policy, interface health, and drift.

Collect live evidence

Rez gathers read-only facts from routers, switches, firewalls, wireless controllers, and network APIs.

Find the failed condition

Rez shows the likely cause, failed checks, supporting evidence, confidence, and recommended next action.

Rez Diagnostics Investigation Read-only

Incident

Site 204 application segment unreachable

Finding

VLAN 210 exists on Access-SW-01, but the uplink toward Core-RTR-02 does not allow VLAN 210.

Commandshow interfaces trunk

ExpectedVLAN 210 allowed on uplink

ActualVLAN 210 missing

Next safe action Create Netcode remediation plan to add VLAN 210 to affected uplink trunks.

Closed Loop Operations

Automate, verify, investigate, remediate.

Bulk VLAN rollout across Sites 201-212. Verification fails on 4 devices. Rez identifies uplink trunk inconsistency. Netcode creates a remediation plan for affected devices only. Rollback remains available from Git.

Netcode automates

Define intent, plan changes, validate, canary, apply, and verify.

Drift is detected

Live state no longer matches approved intent.

Rez investigates

Read-only diagnostics identifies the failed condition and supporting evidence.

Netcode remediates

Rez finding becomes a safe Netcode remediation plan.

Rollback remains available

If remediation fails, rollback is generated from the previous approved intent.

Use Cases

Built for teams moving from manual changes to controlled automation.

Multi-site enterprise networks

Run OS upgrade campaigns, baseline checks, VLAN rollouts, interface standards, routing updates, and ACL cleanup without pushing blind templates.

MSP and NOC teams

Run repeatable changes across customer environments, verify live state, and investigate failures without escalating every issue.

NetDevOps teams

Bring Git, review branches, policy gates, canary apply, and rollback workflows to network engineers without forcing them to become software developers.

Compliance-sensitive networks

Use approval gates, controlled execution, live verification, and change history for regulated environments.

Security

Built for skeptical network teams.

Netcode and Rez are designed for controlled enterprise adoption. Start with read-only discovery and RCA. Add automation gates when your team is ready. Keep credentials inside your environment with a customer-side runner.

Netcode Automation Safety

Production writes can be locked by policy
Exact command preview before apply
Git-backed rollback
Canary and batch controls
Approval gates
Governed secure shell with recorded sessions
Full change history
Emergency override controls

Rez Diagnostics Safety

Read-only SSH/API checks
Command allowlist
No config writes
Fail-closed behavior
Evidence-backed findings
No model training on customer network data

Local / Community

For testing workflows and learning automation concepts.

Starter

For one team, one workspace, and starter automation packs.

Customer-side runner

For live device access while credentials remain inside the customer network.

Enterprise / MSP

For SSO, RBAC, private deployment, multi-workspace operations, and integration support.

Pricing

Start small. Automate one workflow. Expand when it works.

Community

Free

Run Netcode locally with sample inventory, workflow packs, command preview, validation, rollback preview, drift checks, and Rez Diagnostics examples.

Sample OS upgrade campaign
Workflow pack previews
Command preview
Rollback preview
No real device connection

Start Free Community

Popular

Starter

$99/month

Automate one real workflow with your team.

One workspace
Up to 25 devices
One workflow pack
Readiness scan
Plan and command preview
Validation gates
Git workflow
Limited Rez Diagnostics

Start $99 Starter

Automation Pilot

Scoped

For teams validating Netcode against a real workflow.

Source-of-truth alignment
OS upgrade campaign design
Readiness and blocker report
Canary execution plan
Drift and RCA handoff
Pilot success report

Book automation pilot

Team / MSP

$499/month

Run multiple workflow packs across teams or customer environments.

Up to 5 users
Up to 100 devices
3 workflow packs
Customer-side runner
Shared change history
Rez Diagnostics
Git integration

Start Team Trial

Build The Framework

Set up Git-backed network automation without building the framework from scratch.

Start with a serious workflow pack: OS upgrade campaigns, golden baseline enforcement, VLAN rollout, interface standards, BGP neighbor updates, ACL cleanup, or drift remediation. Netcode gives you source-of-truth alignment, exact command preview, policy gates, canary and batch execution, verification, Git rollback, and Rez Diagnostics when checks fail.

Set Up Git-Based Automation Run Free Upgrade Campaign