Documentation

Start here

NTerm runs as a single container. Nothing is sent to a device until you confirm it.

git clone https://github.com/devnexthop/nterm.ai.git
cd nterm.ai
docker compose up -d --build

Open http://localhost:8787. First boot seeds a Lab customer with a local shell and Cisco, PAN-OS and FortiOS simulators, so you can try everything without touching production.

Full deployment reference, including upgrades, backups and reverse-proxy notes: DEPLOY.md.

Around the window

A nav rail runs down the left: Sessions, Toolkit, Bench, Monitor, Settings. The terminal area stays put. Accent colour is for the live LED, risk, and Confirm — not for every selected icon.

The session header names the device you are actually talking to, the site folder you are in, the vendor NTerm resolved, and carries Share and Subnet. If other folders still have live sessions, it says so.

Below the tab strip sits a segmented Merge / Split / Quad control that tiles the open panes. Drag the Explorer, AI, editor or command bar by its title to dock it on another edge.

There is one command bar under the terminal, with three modes: Do, Cast and Macros. Same box, same keyboard focus; the mode decides where what you type goes.

Sessions

Sessions are grouped by customer, then by the site folders you name — Plant, Datacenter, IDF-3. The folder you have selected owns the tab strip. Switch folder and those tabs hide; the SSH sessions stay connected. Right-click a folder to open all of it, rename it, or create a session inside it.

Each session stores host, port, kind (SSH, Serial, Telnet, simulator, local shell) and vendor. Credentials are remembered per customer and encrypted into the vault.

Drag a session from the explorer onto the tab strip to open it, or click it. Tabs reorder by dragging.

Import / Export

Settings → Import / Export. Download the tree as JSON — structure only, no passwords. An encrypted backup can include secrets, behind a passphrase you choose, so you can move a vault between your own machines. The same screen still imports SecureCRT, PuTTY, OpenSSH config and CSV. Those files are structure only; stored passwords in them are never read.

The Do bar

Type the change in English. NTerm resolves it against the active session and shows the exact commands, a risk rating, and the dialect it used. Nothing reaches the wire until you press Confirm.

Read-only status commands rated low risk run directly. Everything else waits for you.

Not only network gear

The Do bar is a general terminal assistant. On a local shell it detects the operating system of the session and drafts in the right userland:

Session	What you get
Linux	GNU coreutils — chmod, chown, systemctl, GNU sed and find syntax
macOS	BSD userland — BSD sed -i '', BSD stat, launchctl, not the GNU spellings
Windows	PowerShell cmdlets and PowerShell path handling, not cmd.exe or bash

So "make this script executable for everyone but me" gets chmod on Linux and macOS with the flags each one actually accepts, and an ACL cmdlet on Windows. Ask for a vendor CLI change on an SSH session to a switch and you get IOS, PAN-OS, FortiOS or Junos instead. Same bar, same Confirm.

Windows local shells run through ConPTY, so PowerShell behaves like a real console — colour, resizing, and interactive programs all work.

Cast — broadcast

One command to many sessions. Scope it to selected tabs, one customer, or everything open. Useful for a config audit across a fleet.

Macros

Saved commands, filtered to the vendor of the session you are in, reached by switching the command bar to Macros. Right-click one to edit, delete, or copy a built-in into your own set. Macros were called chips in earlier builds.

Themes

Settings → Appearance. Nine terminal themes, each previewed live with real show ip interface brief output so you can judge contrast before you commit. The default is Valeron — the ValeronLabs palette, cyan #3ec6ff on near-black.

AI provider

Bring your own key. Paste it and NTerm recognises the provider from the prefix — sk-ant-, sk-or-, gsk_ — then asks that provider which models the key can actually use. OpenAI, Anthropic, and any OpenAI-compatible endpoint including OpenRouter, Groq, Azure and Ollama.

Keys are encrypted into the vault on the machine running NTerm. There is no NTerm account and no subscription.

MCP

NTerm serves MCP at http://127.0.0.1:8787/mcp so other agents can drive it, and consumes MCP servers so its own AI can reach your CMDB, NetBox or ticketing.

Toolkit

Built-in syslog, TFTP and DHCP servers for bring-up work, plus subnet and Cisco type-7 tools. The lab profile binds privileged UDP ports:

docker compose -f docker-compose.yml -f docker-compose.lab.yml up -d --build

The container also ships the network tools you would otherwise apt install at three in the morning, so a local shell inside NTerm is a usable jump box on its own:

ip · ping · traceroute · dig · nslookup · nc · netstat · ss · curl · wget · telnet · tcpdump · mtr · socat · less · nano · vi

The vault

./data holds hosts, usernames, stored credentials and SSH host keys. Treat it like a password database. It is gitignored, and rm -rf data is unrecoverable. See Security.