| 1 | # Netdata Access Control and Feature Availability |
| 2 | |
| 3 | This document explains the access control policies that govern feature availability in Netdata, and how these change based on your authentication and subscription status. |
| 4 | |
| 5 | ## Overview |
| 6 | |
| 7 | Netdata implements a layered access control system to protect sensitive information while keeping core monitoring capabilities freely available. The system distinguishes between three access levels: |
| 8 | |
| 9 | | Access Level | Description | |
| 10 | |-------------------------------|--------------------------------------------------------------------------| |
| 11 | | **Anonymous** | Using the Netdata dashboard without signing in | |
| 12 | | **Netdata Cloud Community** | Signed in to Netdata Cloud (free tier) | |
| 13 | | **Netdata Cloud paid plan** | Signed in with a paid plan (Homelab, Business, or Enterprise On-Premise) | |
| 14 | |
| 15 | ## Why Access Controls Exist |
| 16 | |
| 17 | Netdata functions can expose sensitive system information: |
| 18 | |
| 19 | - **Process details** reveal running applications, command-line arguments (which may contain passwords or tokens), and resource consumption patterns |
| 20 | - **Network connections** expose active services, connected clients, and internal network topology |
| 21 | - **System logs** may contain application errors, security events, and debugging information with sensitive context |
| 22 | - **Database queries** can reveal query patterns, table structures, and potentially sensitive data in error messages |
| 23 | |
| 24 | Without authentication, anyone who can reach the Netdata dashboard could access this information. The access control system ensures that sensitive data is only available to authenticated users who belong to the same Netdata Cloud Space as the monitored infrastructure. |
| 25 | |
| 26 | ## Feature Availability by Access Level |
| 27 | |
| 28 | ### Metrics and Visualization |
| 29 | |
| 30 | | Feature | Anonymous | Community | Paid | |
| 31 | |------------------------------------|:-----------:|:----------:|:---------:| |
| 32 | | Real-time metrics (all collectors) | ✓ | ✓ | ✓ | |
| 33 | | Historical data and retention | ✓ | ✓ | ✓ | |
| 34 | | Charts and dashboards | ✓ | ✓ | ✓ | |
| 35 | | Anomaly detection (ML) | ✓ | ✓ | ✓ | |
| 36 | | Alert notifications | ✓ | ✓ | ✓ | |
| 37 | | Multi-node views | 5 nodes | 5 nodes | Unlimited | |
| 38 | | Custom dashboards | 1 per agent | 1 per room | Unlimited | |
| 39 | |
| 40 | ### Functions (Live Tab) |
| 41 | |
| 42 | Functions provide on-demand, detailed information beyond standard metrics. |
| 43 | |
| 44 | | Function | Description | Anonymous | Community | Paid | |
| 45 | |-------------------------|---------------------------------------------|:---------:|:---------:|:----:| |
| 46 | | **Block Devices** | Disk I/O activity | ✓ | ✓ | ✓ | |
| 47 | | **Containers/VMs** | Container and VM resource usage | ✓ | ✓ | ✓ | |
| 48 | | **IPMI Sensors** | Hardware sensor readings | ✓ | ✓ | ✓ | |
| 49 | | **Mount Points** | Disk usage per mount | ✓ | ✓ | ✓ | |
| 50 | | **Network Interfaces** | Interface traffic and status | ✓ | ✓ | ✓ | |
| 51 | | **Systemd Services** | Service resource usage | ✓ | ✓ | ✓ | |
| 52 | | **Processes** | Running processes, command lines, resources | ✗ | ✓ | ✓ | |
| 53 | | **Network Connections** | Active TCP/UDP connections | ✗ | ✓ | ✓ | |
| 54 | | **Systemd Journal** | System and application logs | ✗ | ✓ | ✓ | |
| 55 | | **Windows Events** | Windows event logs | ✗ | ✓ | ✓ | |
| 56 | | **Systemd Units** | Unit status and configuration | ✗ | ✓ | ✓ | |
| 57 | | **Database Queries** | Top queries, deadlocks, errors | ✗ | ✓ | ✓ | |
| 58 | | **Streaming Status** | Netdata streaming topology | ✗ | ✓ | ✓ | |
| 59 | | **API Call Tracing** | Netdata API request tracing | ✗ | ✓ | ✓ | |
| 60 | |
| 61 | ### Configuration and Management |
| 62 | |
| 63 | | Feature | Anonymous | Community | Paid | |
| 64 | |------------------------------------|:---------:|:---------:|:----:| |
| 65 | | View agent configuration | ✗ | ✗ | ✓ | |
| 66 | | Dynamic Configuration (collectors) | ✗ | ✗ | ✓ | |
| 67 | | Dynamic Configuration (alerts) | ✗ | ✗ | ✓ | |
| 68 | | Alert silencing rules | ✗ | ✓ | ✓ | |
| 69 | | Notification configuration | ✗ | ✗ | ✓ | |
| 70 | |
| 71 | ### AI-Powered Features |
| 72 | |
| 73 | | Feature | Anonymous | Community | Paid | |
| 74 | |---------------------------------|:---------:|:---------:|:----:| |
| 75 | | Alert explanations | ✗ | ✓ | ✓ | |
| 76 | | Alert configuration suggestions | ✗ | ✓ | ✓ | |
| 77 | | AI-powered insights | ✗ | ✓ | ✓ | |
| 78 | |
| 79 | ### Organization Features |
| 80 | |
| 81 | | Feature | Anonymous | Community | Paid | |
| 82 | |----------------------------------|:---------:|:---------:|:----:| |
| 83 | | Role-based access control (RBAC) | N/A | ✗ | ✓ | |
| 84 | | Single Sign-On (SSO) | N/A | ✗ | ✓ | |
| 85 | | Team management | N/A | Limited | Full | |
| 86 | |
| 87 | ## MCP (Model Context Protocol) |
| 88 | |
| 89 | Netdata provides MCP in two ways: |
| 90 | |
| 91 | - **Netdata Cloud MCP** at `app.netdata.cloud/api/v1/mcp` — infrastructure-wide access to all your nodes (requires a Paid plan) |
| 92 | - **Agent/Parent MCP** — available directly at Netdata Agents and Parents, free and open-source |
| 93 | |
| 94 | When accessing Netdata via Agent/Parent MCP: |
| 95 | |
| 96 | - **Without Cloud connection**: MCP can access public functions and metrics, but sensitive functions follow the same restrictions as the dashboard |
| 97 | - **With Cloud connection**: MCP inherits the user's Cloud permissions, enabling access to sensitive functions for authenticated users |
| 98 | |
| 99 | For MCP setup and configuration, see the [MCP documentation](/docs/netdata-ai/mcp/README.md). |
| 100 | |
| 101 | ## How to Enable Features |
| 102 | |
| 103 | ### Enable Sensitive Functions |
| 104 | |
| 105 | 1. **Sign in to Netdata Cloud** at [app.netdata.cloud](https://app.netdata.cloud) |
| 106 | 2. **Connect your nodes** to your Netdata Cloud Space |
| 107 | 3. **Access the dashboard** through Netdata Cloud |
| 108 | |
| 109 | Once signed in, you'll have access to all sensitive functions (processes, logs, network connections, etc.) on nodes within your Space. |
| 110 | |
| 111 | ### Enable Dynamic Configuration |
| 112 | |
| 113 | Dynamic Configuration requires a paid plan: |
| 114 | |
| 115 | 1. **Sign in to Netdata Cloud** |
| 116 | 2. **Upgrade to a paid plan** from the billing settings |
| 117 | 3. **Access Dynamic Configuration** from the settings menu on any connected node |
| 118 | |
| 119 | ### Increase Node Limits |
| 120 | |
| 121 | The 5-node limit on multi-node dashboards applies to both **Anonymous** and **Community** users. You can: |
| 122 | |
| 123 | 1. **Upgrade to a paid plan** for unlimited nodes in multi-node dashboards |
| 124 | 2. **Select preferred nodes** in **Space Settings > Nodes** to choose which 5 nodes appear in multi-node dashboards |
| 125 | |
| 126 | :::note |
| 127 | |
| 128 | Preferred node selection only affects Netdata Cloud dashboards. On the local Agent dashboard (accessed directly at `http://<agent-ip>:19999`), the nodes shown in multi-node views are determined by the Agent's streaming configuration and cannot be changed via preferred node settings. |
| 129 | |
| 130 | ::: |
| 131 | |
| 132 | |
| 133 | ## Summary |
| 134 | |
| 135 | | What You Get | Anonymous | Community | Paid | |
| 136 | |---------------------------|-------------|---------------|-------------| |
| 137 | | **Metrics & Charts** | Full access | Full access | Full access | |
| 138 | | **Anomaly Detection** | Full access | Full access | Full access | |
| 139 | | **Alert Notifications** | Full access | Full access | Full access | |
| 140 | | **Public Functions** | Full access | Full access | Full access | |
| 141 | | **Sensitive Functions** | Blocked | Full access | Full access | |
| 142 | | **AI Features** | Blocked | Full access | Full access | |
| 143 | | **Dynamic Configuration** | Blocked | Blocked | Full access | |
| 144 | | **Multi-node Limit** | 5 nodes | 5 nodes | Unlimited | |
| 145 | | **Custom Dashboards** | 1 per agent | 1 per room | Unlimited | |
| 146 | | **RBAC & SSO** | N/A | Not available | Full access | |
| 147 | |
| 148 | Netdata's access control model ensures that sensitive system information is protected while keeping powerful monitoring capabilities freely available. Sign in to Netdata Cloud to unlock sensitive functions, or upgrade to a paid plan for full configuration control and unlimited scale. |