Netdata Access Control and Feature Availability

This document explains the access control policies that govern feature availability in Netdata, and how these change based on your authentication and subscription status.

Overview

Netdata implements a layered access control system to protect sensitive information while keeping core monitoring capabilities freely available. The system distinguishes between three access levels:

Access Level	Description
Anonymous	Using the Netdata dashboard without signing in
Netdata Cloud Community	Signed in to Netdata Cloud (free tier)
Netdata Cloud paid plan	Signed in with a paid plan (Homelab, Business, or Enterprise On-Premise)

Why Access Controls Exist

Netdata functions can expose sensitive system information:

• Process details reveal running applications, command-line arguments (which may contain passwords or tokens), and resource consumption patterns
• Network connections expose active services, connected clients, and internal network topology
• System logs may contain application errors, security events, and debugging information with sensitive context
• Database queries can reveal query patterns, table structures, and potentially sensitive data in error messages

Without authentication, anyone who can reach the Netdata dashboard could access this information. The access control system ensures that sensitive data is only available to authenticated users who belong to the same Netdata Cloud Space as the monitored infrastructure.

Feature Availability by Access Level

Metrics and Visualization

Feature	Anonymous	Community	Paid
Real-time metrics (all collectors)	✓	✓	✓
Historical data and retention	✓	✓	✓
Charts and dashboards	✓	✓	✓
Anomaly detection (ML)	✓	✓	✓
Alert notifications	✓	✓	✓
Node dashboard access	5 nodes	5 nodes	Unlimited
Custom dashboards	1 per agent	1 per room	Unlimited

Functions (Live Tab)

Functions provide on-demand, detailed information beyond standard metrics.

Function	Description	Anonymous	Community	Paid
Block Devices	Disk I/O activity	✓	✓	✓
Containers/VMs	Container and VM resource usage	✓	✓	✓
IPMI Sensors	Hardware sensor readings	✓	✓	✓
Mount Points	Disk usage per mount	✓	✓	✓
Network Interfaces	Interface traffic and status	✓	✓	✓
Systemd Services	Service resource usage	✓	✓	✓
Processes	Running processes, command lines, resources	✗	✓	✓
Network Connections	Active TCP/UDP connections	✗	✓	✓
Systemd Journal	System and application logs	✗	✓	✓
Windows Events	Windows event logs	✗	✓	✓
Systemd Units	Unit status and configuration	✗	✓	✓
Database Queries	Top queries, deadlocks, errors	✗	✓	✓
Streaming Status	Netdata streaming topology	✗	✓	✓
API Call Tracing	Netdata API request tracing	✗	✓	✓

Configuration and Management

Feature	Anonymous	Community	Paid
View agent configuration	✗	✗	✓
Dynamic Configuration (collectors)	✗	✗	✓
Dynamic Configuration (alerts)	✗	✗	✓
Alert silencing rules	✗	✓	✓
Notification configuration	✗	✗	✓

AI-Powered Features

Feature	Anonymous	Community	Paid
Alert explanations	✗	✗	✓
Alert configuration suggestions	✗	✗	✓
AI-powered insights	✗	✗	✓

Organization Features

Feature	Anonymous	Community	Paid
Role-based access control (RBAC)	N/A	✗	✓
Single Sign-On (SSO)	N/A	✗	✓
Team management	N/A	Limited	Full

MCP (Model Context Protocol)

Netdata provides MCP in two ways:

• Netdata Cloud MCP at app.netdata.cloud/api/v1/mcp — infrastructure-wide access to all your nodes (requires a Paid plan)
• Agent/Parent MCP — available directly at Netdata Agents and Parents, free and open-source

When accessing Netdata via Agent/Parent MCP:

• Without Cloud connection: MCP can access public functions and metrics, but sensitive functions follow the same restrictions as the dashboard
• With Cloud connection: MCP inherits the user's Cloud permissions, enabling access to sensitive functions for authenticated users
• With [web].bearer token protection = yes: local MCP requires the local MCP API key on all transports (HTTP, SSE, WebSocket); anonymous MCP requests are rejected
• Network ACL: local MCP exposure is controlled by [web].allow mcp from (in addition to the global [web].allow connections from)

For MCP setup and configuration, see the MCP documentation.

How to Enable Features

Enable Sensitive Functions

1. Sign in to Netdata Cloud at app.netdata.cloud
2. Connect your nodes to your Netdata Cloud Space
3. Access the dashboard through Netdata Cloud

Once signed in, you'll have access to all sensitive functions (processes, logs, network connections, etc.) on nodes within your Space.

Enable Dynamic Configuration

Dynamic Configuration requires a paid plan:

1. Sign in to Netdata Cloud
2. Upgrade to a paid plan from the billing settings
3. Access Dynamic Configuration from the settings menu on any connected node

Increase Node Limits

The 5-node limit applies to both Anonymous and Community users, on Netdata Cloud dashboards and on the local dashboard of Agents and Parents. You can:

1. Upgrade to a paid plan for unlimited nodes
2. Select preferred nodes to choose which 5 nodes stay accessible

This limit is a plan entitlement, not a streaming or connection limit. You can stream any number of nodes to a parent and chain parents across multiple levels — both are fully supported, and every node continues collecting and storing its data regardless of this limit. On a dashboard that shows more nodes than your limit, a node outside your preferred nodes shows as Locked: every per-node feature — its single-node dashboard, Functions, Configuration, silencing rules, Anomaly Advisor, and alert details — becomes inaccessible, and it is excluded from the combined Metrics tab, until you either select it as one of your preferred nodes or upgrade to a paid plan.

The local dashboard of an Agent or Parent gets the limit of your plan from Netdata Cloud. When the Agent is not connected to Netdata Cloud, or Netdata Cloud cannot be reached, the local dashboard applies the 5-node limit.

note

Netdata Cloud and each Agent keep separate preferred-node lists. Netdata Cloud stores one per Space (Space Settings > Nodes). An Agent or Parent stores its own in its settings, and you select it on that Agent's local dashboard (http://<agent-ip>:19999). Which nodes appear in the local dashboard's multi-node views is still determined by the Agent's streaming configuration.

Summary

What You Get	Anonymous	Community	Paid
Metrics & Charts	Full access	Full access	Full access
Anomaly Detection	Full access	Full access	Full access
Alert Notifications	Full access	Full access	Full access
Public Functions	Full access	Full access	Full access
Sensitive Functions	Blocked	Full access	Full access
AI Features	Blocked	Not available	Full access
Dynamic Configuration	Blocked	Blocked	Full access
Node Dashboard Access	5 nodes	5 nodes	Unlimited
Custom Dashboards	1 per agent	1 per room	Unlimited
RBAC & SSO	N/A	Not available	Full access

Netdata's access control model ensures that sensitive system information is protected while keeping powerful monitoring capabilities freely available. Sign in to Netdata Cloud to unlock sensitive functions, or upgrade to a paid plan for full configuration control and unlimited scale.