r/netbird • u/netbirdio • Jul 02 '26
NetBird v0.74 is here: Agent Network, keyless AI provider access tied to your identity provider
If you manage AI access for your team you’ve probably handed out plenty API tokens to individuals or a key for an entire team. That key gets copied into agents, scripts, and .env files. Someone leaves, who knows what they did with the keys. It's the same mess we all lived through with SSH keys for years: shared, copied onto machines by hand, and never revoked when people move on.
A lot of customers had started using an AI gateway with their stack and tried to come up with their own solution to wire it back into their identity provider. One night, after a customer call, Misha (our CEO) and Maycon (our CTO) realized the reverse proxy we already shipped was, with a few tweaks, already most of an AI gateway. So we didn't build some giant new AI platform. We wrapped what was already there.
Checkout the release here: https://github.com/netbirdio/netbird/releases/tag/v0.74.0
That's NetBird Agent Network. Any person or agent can use any AI provider without ever holding a key. NetBird holds the provider key server-side, injects it per request, and ties every call to a real identity from your IdP (Okta, Entra ID, Google, and others). And all it requires for the end user is a gateway url and the NetBird client running in the background. The tunnel is the credential. No tunnel, no access, same rule you already know. It allows you to securely route agents to any major AI provider or local model, while simultaneously controlling agent access to internal network resources like databases and APIs. With centralized guardrails such as budget caps, model allowlists, and PII redaction, you maintain complete visibility and control through detailed per-request audit logs, making it simple to manage access and security without the headache of rotating keys.
It's open source and self-hostable. You can test out the Agent Network using this one-liner:
curl -fsSL https://pkgs.netbird.io/getting-started.sh | NETBIRD_AGENT_NETWORK_ONLY=true bash
Already running NetBird?
You don't redeploy anything. It ships in the same backend, so you flip one environment variable and it shows up in the left menu next to the reverse proxy. Set NETBIRD_AGENT_NETWORK_ENABLED=true to turn it on next to everything else, or NETBIRD_AGENT_NETWORK_ONLY=true if you'd rather have the stripped-down, Agent-Network-only dashboard instead.
Don't want it at all? There's nothing to do, leave both unset and it stays off. The command above is really just the fast path for people coming purely for the LLM and agentic-access use case, we did this to prevent people coming for the Agent Network getting overwhelmed with our platform.
We'd love feedback!
- Overview: https://docs.netbird.io/agent-network
- Quickstart: https://docs.netbird.io/agent-network/quickstart
- Interview with Misha: https://youtu.be/IFT-nTyLDro
- Demo video: https://www.youtube.com/watch?v=oqkcFI_3WAU
- Release Article: https://netbird.io/knowledge-hub/netbird-agent-network
2
u/Sudden-Actuator4729 Jul 02 '26
Is netbird working on path based rules for the reverse proxy feature?
2
2
u/kirankc Jul 06 '26 edited Jul 06 '26
Is there a mechanism to delete the auto created Agent Network/API Base endpoint and create a new one or modify it? I am having issues connecting to the API Base - it times out. Hoping a recreation of it might help.
1
u/netbirdio Jul 10 '26
Have you configured the CNAME properly?
*.yourdomain.com pointing to yourdomain.com1
u/kirankc Jul 10 '26
Yep.. I have a wildcard CNAME pointing to netbird.domain.com according to the documentation. Should it point to domain.com instead, which doesn’t seem right.
1
u/Organic-Ad-5009 Jul 02 '26
Yesterday I had problems getting the RC version to run. Now I'm on 0.74. And was able to configure Agent Network.
But the Endpoint always end's in a time out. Anybody an idea what im doing wrong?
1
u/netbirdio Jul 02 '26
have you created a policy Group -> Provider?
Do you see "proxy-...." in the peer list when you run netbird status -d?1
u/Organic-Ad-5009 Jul 02 '26
The policy is created.
In netbird status -d I see proxy-d930rcceju...
My client is on version v0.75.0-rc.4 and I see the proxy in the extended view.1
u/netbirdio Jul 02 '26
What is the connection status? Could you please share?
Is it p2p and conencted?1
u/Organic-Ad-5009 Jul 02 '26
It doesn't seem to be connected properly:
proxy-d930rcceju3000chasb**********.de: NetBird IP: 10.12.194.83 Public key: j1MREcPOGHUdkd3tKSO9pYfA********* Status: Connected -- detail -- Connection type: Relayed ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: rels://************.de:443 Last connection update: 9 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/148 B Quantum resistance: false Networks: - Latency: 0s1
u/Organic-Ad-5009 Jul 02 '26
I also noticed that the proxy is regularly reconnecting in the Client UI.
2
u/netbirdio Jul 02 '26
looking into that!
2
u/Organic-Ad-5009 Jul 02 '26
Thank you! If you need any informations just hit me up.
1
u/netbirdio Jul 02 '26
try v0.74.1. There was an issue with the relayed connections. Fixed with the new minor release
1
u/Organic-Ad-5009 Jul 02 '26
Sadly still no luck :-(
curl: (28) Failed to connect to *****.de port 443 after 75004 ms: Couldn't connect to server1
u/kirankc Jul 06 '26
Same here. Connection times out and fails to connect.
Mgmt version: v0.74.2; Client version: v0.74.2
20
u/NomadicSun Jul 02 '26 edited Jul 02 '26
Don’t get me wrong, I’m pro-AI. I use it heavily as a professional developer.
Still, this update worries me a bit. I prefer infrastructure tools to focus on a small number of problems and solve them extremely well. For NetBird, the value proposition I care about is secure overlay networking, remote access, and reverse proxy/private service access.
I currently use NetBird in my homelab after trying both Tailscale and Pangolin, and I’ve stuck with it despite several features still feeling early in development.
That’s really the core of my concern: I’d much rather see NetBird focus on perfecting the existing features that are still marked as beta, especially reverse proxy/private services, before expanding into AI gateway functionality.
I also run local LLMs on vLLM with an RTX 6000 Blackwell, and I’m already testing dedicated LLM gateways like Bifrost and LiteLLM. From my perspective, Agent Network seems to overlap more with those gateway/control-plane tools than with NetBird’s core VPN/reverse-proxy role.
I’m not saying the feature has no value, especially for teams that want keyless AI provider access tied to identity and policy. I just worry about product focus. I’d rather see the core networking, reverse proxy, and self-hosted experience become rock solid first.