The Netpicker Alternative for Network Configuration Management
rConfig and Netpicker both offer self-hosted network configuration management with a free edition. Both cover multi-vendor backups and change tracking, with compliance and automation capabilities available across their paid plans.
The difference becomes clearer when your team needs access controls. Netpicker lists SSO, LDAP and multi-role RBAC in Enterprise, starting at $33,500 per year. rConfig includes SSO in free, open-source Core, with LDAP and RBAC available from Starter.
For larger networks, rConfig also publishes its 50,000-device backup benchmark and the open-source simulator used for scale testing. You can inspect the approach and test it against your own requirements.

Why teams choose rConfig over Netpicker
Both products cover multi-vendor configuration backup, compliance and automation. The choice often comes down to access controls, scale and the equipment you need to protect.
Access controls in earlier editions
Netpicker lists SSO, LDAP and multi-role RBAC in Enterprise, starting at $33,500 per year. rConfig includes SSO in free Core, with LDAP and RBAC from Starter.
Scale you can test
rConfig has published a backup test covering more than 50,000 devices in under 21 minutes. Its open-source simulator lets you run your own large-scale tests instead of relying on a device count alone.
Coverage beyond conventional network devices
rConfig can also collect configurations from specialist industrial and OT equipment, including SCADA systems and PLCs, where they can be retrieved through SSH, Telnet, an API or a custom script.
rConfig vs Netpicker, feature by feature
Netpicker information is based on its public pages, Flock9’s site and GitHub, checked on 26 September 2026. These sources may change. “Not publicly documented” means we could not find a clear statement about the capability; it does not mean Netpicker cannot provide it.
rConfig is independent of Flock9 and is not affiliated with Netpicker. Product names belong to their respective owners.
- FeatureProduct and editionsNetpicker (Flock9)Foundation (free), Professional, Enterprise. Sister product Slurp'it handles discovery.rConfigCore (free), Starter, Standard, Enterprise/MSP; Vector for distributed and MSP estates.
- FeatureLicence and sourceNetpicker (Flock9)Commercial, under an end user licence agreement. Built on open source libraries (Netmiko, pytest, TextFSM); the public GitHub repo holds deployment files (Docker Compose, a Helm chart, scripts) that pull prebuilt netpicker/api and netpicker/agent images, with no application source licence found.rConfigCore is free and open source, no device limit. Commercial editions are licensed by device band.
- FeatureFree editionNetpicker (Flock9)Foundation: unlimited device backups, single user, plus all Professional features for up to 10 devices.rConfigCore: no device limit, multi-user with local accounts, single sign-on included.
- FeaturePublished pricingNetpicker (Flock9)Yes. Professional from $7,500 per year (under 250 devices); Enterprise from $33,500 per year (under 1,000 devices).rConfigYes, shown on this page and on the pricing page below, rendered in your own currency.
- FeatureSingle sign-onNetpicker (Flock9)Enterprise only: “Single Sign On (Ldap, SAML, OAuth)”, from $33,500 per year.rConfigEvery edition, including the free Core, SAML and OIDC.
- FeatureRoles and RBACNetpicker (Flock9)Professional: “Multi-user, single role (admin)”. Full RBAC is Enterprise only.rConfigRole-based access control from Starter; hierarchical RBAC in Vector.
- FeatureAudit logNetpicker (Flock9)“Extensive audit logs”, Enterprise only.rConfigUser audit log from Starter.
- FeatureDeploymentNetpicker (Flock9)Docker, Podman, OVA or Helm chart. Kubernetes, OpenShift and air-gapped support are listed under Enterprise; an offline installation guide is published.rConfigLinux, containers or air-gapped, available in every edition including Core.
- FeatureDistributed collectionNetpicker (Flock9)Remote agents open an outbound WebSocket to the main API. Per-agent device scale not published.rConfigVector Agent: a single Go binary, outbound-only TLS, no inbound firewall rules and no site-to-site VPN, up to roughly 1,000 devices per agent.
- FeatureHigh availabilityNetpicker (Flock9)Not publicly documented.rConfigHA and regional failover patterns, Enterprise and Vector.
- FeatureMSP and multi-tenancyNetpicker (Flock9)“Multi-tenancy (for MSPs)”, an Enterprise add-on.rConfigVector's hierarchical RBAC plus Vector Prism, a branded customer portal with mandatory multi-factor authentication.
- FeatureVendor coverageNetpicker (Flock9)150+ vendors, per Netpicker's own supported-vendors page.rConfigCisco, Juniper, Arista, Fortinet, Palo Alto, Huawei, Nokia, MikroTik, HPE, Aruba and 200 more.
- FeatureOT, ICS and IoTNetpicker (Flock9)Not listed on Netpicker's supported-vendors page, which is built around IT and security vendors.rConfigSCADA, PLCs, roadside signage, legacy voice systems and other specialised OT equipment, including air-gapped networks.
- FeatureBackup, diff, rollbackNetpicker (Flock9)Git-backed backups, version control, rollback and drift detection against a golden configuration.rConfigScheduled backups, line-level diffs, one-click restore and real-time change alerts.
- FeatureComplianceNetpicker (Flock9)Professional and above; CIS hardening libraries and custom rules.rConfigFrom Starter; NIS2, DORA, PCI-DSS and CIS policy checks across every device.
- FeatureVulnerability scanningNetpicker (Flock9)CVEasy, Professional and above.rConfigNot a vulnerability scanner. Pair rConfig with the scanner you already run.
- FeatureTest frameworkNetpicker (Flock9)Pytest-based network tests, run pre and post change.rConfigCompliance policies and change alerts, not a pytest test suite.
- FeatureOS and firmwareNetpicker (Flock9)“OS Upgrades” listed as a feature.rConfigScheduled firmware push over SCP, TFTP or API, in a defined change window.
- FeatureAINetpicker (Flock9)AI assistant in every edition, generating tests and fixes from plain English with engineer review before anything runs.rConfigBuilt-in AI from Standard; bring your own keys, runs inside your environment; MCP in Enterprise.
- FeatureIntegrationsNetpicker (Flock9)NetBox and Nautobot plugins, Infoblox, ServiceNow, Remedy, REST API.rConfig17 connectors in production including NetBox, Nautobot, Infrahub, HashiCorp Vault, Zabbix, Checkmk, PRTG, AKIPS and Statseeker, plus a REST API.
- FeatureSupportNetpicker (Flock9)Foundation: best effort and Discord. Professional: ticket support, 24 hour response. Enterprise: premium SLA.rConfigCommunity; 5 business days; 8x5 next business day; 24x7 four hour response.
- FeaturePublic scale evidenceNetpicker (Flock9)Not publicly documented.rConfig50,000 devices backed up in 21 minutes on a single host, method published, with a reference architecture documented past 100,000 nodes.
- FeatureFootprintNetpicker (Flock9)Customer logos published (Lazada, Intuit, Cisco, Splunk and others). No customer or country count published.rConfig10,000+ engineers, 60+ countries, 80M+ devices managed globally (an estimate, since rConfig does not phone home).
| Feature | Netpicker (Flock9) | rConfig |
|---|---|---|
| Product and editions | Foundation (free), Professional, Enterprise. Sister product Slurp'it handles discovery. | Core (free), Starter, Standard, Enterprise/MSP; Vector for distributed and MSP estates. |
| Licence and source | Commercial, under an end user licence agreement. Built on open source libraries (Netmiko, pytest, TextFSM); the public GitHub repo holds deployment files (Docker Compose, a Helm chart, scripts) that pull prebuilt netpicker/api and netpicker/agent images, with no application source licence found. | Core is free and open source, no device limit. Commercial editions are licensed by device band. |
| Free edition | Foundation: unlimited device backups, single user, plus all Professional features for up to 10 devices. | Core: no device limit, multi-user with local accounts, single sign-on included. |
| Published pricing | Yes. Professional from $7,500 per year (under 250 devices); Enterprise from $33,500 per year (under 1,000 devices). | Yes, shown on this page and on the pricing page below, rendered in your own currency. |
| Single sign-on | Enterprise only: “Single Sign On (Ldap, SAML, OAuth)”, from $33,500 per year. | Every edition, including the free Core, SAML and OIDC. |
| Roles and RBAC | Professional: “Multi-user, single role (admin)”. Full RBAC is Enterprise only. | Role-based access control from Starter; hierarchical RBAC in Vector. |
| Audit log | “Extensive audit logs”, Enterprise only. | User audit log from Starter. |
| Deployment | Docker, Podman, OVA or Helm chart. Kubernetes, OpenShift and air-gapped support are listed under Enterprise; an offline installation guide is published. | Linux, containers or air-gapped, available in every edition including Core. |
| Distributed collection | Remote agents open an outbound WebSocket to the main API. Per-agent device scale not published. | Vector Agent: a single Go binary, outbound-only TLS, no inbound firewall rules and no site-to-site VPN, up to roughly 1,000 devices per agent. |
| High availability | Not publicly documented. | HA and regional failover patterns, Enterprise and Vector. |
| MSP and multi-tenancy | “Multi-tenancy (for MSPs)”, an Enterprise add-on. | Vector's hierarchical RBAC plus Vector Prism, a branded customer portal with mandatory multi-factor authentication. |
| Vendor coverage | 150+ vendors, per Netpicker's own supported-vendors page. | Cisco, Juniper, Arista, Fortinet, Palo Alto, Huawei, Nokia, MikroTik, HPE, Aruba and 200 more. |
| OT, ICS and IoT | Not listed on Netpicker's supported-vendors page, which is built around IT and security vendors. | SCADA, PLCs, roadside signage, legacy voice systems and other specialised OT equipment, including air-gapped networks. |
| Backup, diff, rollback | Git-backed backups, version control, rollback and drift detection against a golden configuration. | Scheduled backups, line-level diffs, one-click restore and real-time change alerts. |
| Compliance | Professional and above; CIS hardening libraries and custom rules. | From Starter; NIS2, DORA, PCI-DSS and CIS policy checks across every device. |
| Vulnerability scanning | CVEasy, Professional and above. | Not a vulnerability scanner. Pair rConfig with the scanner you already run. |
| Test framework | Pytest-based network tests, run pre and post change. | Compliance policies and change alerts, not a pytest test suite. |
| OS and firmware | “OS Upgrades” listed as a feature. | Scheduled firmware push over SCP, TFTP or API, in a defined change window. |
| AI | AI assistant in every edition, generating tests and fixes from plain English with engineer review before anything runs. | Built-in AI from Standard; bring your own keys, runs inside your environment; MCP in Enterprise. |
| Integrations | NetBox and Nautobot plugins, Infoblox, ServiceNow, Remedy, REST API. | 17 connectors in production including NetBox, Nautobot, Infrahub, HashiCorp Vault, Zabbix, Checkmk, PRTG, AKIPS and Statseeker, plus a REST API. |
| Support | Foundation: best effort and Discord. Professional: ticket support, 24 hour response. Enterprise: premium SLA. | Community; 5 business days; 8x5 next business day; 24x7 four hour response. |
| Public scale evidence | Not publicly documented. | 50,000 devices backed up in 21 minutes on a single host, method published, with a reference architecture documented past 100,000 nodes. |
| Footprint | Customer logos published (Lazada, Intuit, Cisco, Splunk and others). No customer or country count published. | 10,000+ engineers, 60+ countries, 80M+ devices managed globally (an estimate, since rConfig does not phone home). |
Where Netpicker is stronger, plainly stated:
- Testing as code. Netpicker's pytest framework for pre and post change validation is a real strength for teams that already write Python. rConfig covers compliance policy and change detection, not a pytest test suite.
- Vulnerability scanning in the box. CVEasy is included from Netpicker Professional upward. rConfig is not a CVE scanner.
- NetBox and Nautobot plugins, plus Slurp'it. Netpicker ships native plugins and a sister discovery product. rConfig integrates with NetBox and Nautobot as a source of truth rather than as a plugin inside them.
Why teams move from Netpicker to rConfig
Look at the evidence behind each difference. The points below link to rConfig's edition comparison, technical documentation and scale testing so you can check what matters for your network.
A public benchmark, not a pricing-page claim
rConfig's latest benchmark backs up over 50,000 devices in under 21 minutes, with realistic fault conditions such as unreachable hosts and failed logins included. Netpicker publishes no equivalent figure.
A reference architecture past 100,000 nodes
Vector Server, Vector Agents and Vector Prism, documented as a full reference architecture for an AI-native, multi-tenant NCM stack.
No inbound firewall rules, no site-to-site VPN
Vector Agent is a single Go binary that polls local devices and syncs back over outbound-only TLS. Netpicker's own remote agents open an outbound WebSocket on the same principle, but publish no per-agent device limit.
Stateless engines per customer, region or zone
Vector scales horizontally rather than around one collector host, with hierarchical RBAC for MSPs and Vector Prism as the branded portal customers sign into.
OT and IoT, not just IT and security vendors
SCADA, PLCs, roadside signage and legacy voice systems, backed up over SSH, Telnet, API or the SIE, air gap included. Netpicker's own vendor list does not name an OT category.
Proven on a converged IT/OT floor
A manufacturing customer runs 24/7 change monitoring across PLC and aggregation networks under IEC 62443, the kind of estate Netpicker's own vendor list does not claim.
Netpicker and rConfig pricing, edition by edition
What Netpicker publishes
Foundation is free for life, with unlimited devices and one user. It also includes Professional features for up to 10 devices.
Professional starts at $7,500 per year and adds compliance testing, remediation and multiple users with a single admin role.
Enterprise starts at $33,500 per year and adds SSO, multi-role RBAC, extensive audit logs and additional deployment options. Netpicker lists MSP multi-tenancy separately as an add-on.
Where the editions differ
If your team needs SSO, directory sign-in, distinct roles and a user audit log, check which edition provides each one. Netpicker lists those controls in Enterprise. rConfig includes SSO in free Core, with LDAP, RBAC and the user audit log from Starter. Compare rConfig editions.
What rConfig publishes
- Core: Free, with no device limit
- Starter: Published price for up to 300 devices
- Standard: Published price for up to 1,000 devices
- Enterprise / MSP: Custom pricing beyond 1,000 devices
See the current amounts in your selected currency on the rConfig pricing page.
Ready to move from Netpicker? Pick your pace
You can run rConfig alongside Netpicker while you check backups, diffs and scheduled jobs on your own devices. Retire the old schedules only when the new ones are working as expected.
A practical migration path
- Export your device inventory from Netpicker, or use your existing NetBox or Nautobot inventory
- Install the rConfig edition that covers the workflows you need
- Import your devices and set up credentials. Device sync and HashiCorp Vault integration are available in Standard and Enterprise
- Run a backup and compare it with the latest configuration held in Netpicker
- Run both systems through a change cycle, then retire Netpicker's schedules once you have checked the results
Talk to us about your Netpicker migration
Already using pytest with Netpicker? Keep your tests in the pipeline. You can adapt how they obtain configuration data from rConfig and validate them during the parallel run.
Compare rConfig with other tools
Evaluating a different platform, or comparing more than one at once? Follow the guide that matches your current tool.
Netpicker alternative: common questions
Evaluation questions teams ask before they switch, including the ones a fair comparison has to answer honestly.
Is rConfig a good Netpicker alternative?
Yes. rConfig does the same multi-vendor configuration backup, compliance and automation job as Netpicker. Both are self-hosted and both ship a free edition, but rConfig ships single sign-on in every edition, LDAP and RBAC from Starter, and a public benchmark past 50,000 devices.
What is Netpicker, and who makes it?
Netpicker is made by Flock9, an independent software company focused on practical network automation. Flock9 also makes Slurp'it, a sister discovery and inventory product. Both companies describe themselves as bootstrapped and independently owned, funded by customers rather than investors.
How much does Netpicker cost?
Netpicker publishes three tiers on netpicker.io, checked 26 September 2026. Foundation is free for life for unlimited devices on a single user licence. Professional starts at $7,500 per year for under 250 devices. Enterprise starts at $33,500 per year for under 1,000 devices. Netpicker does not publish a price above these device bands.
Is there a free Netpicker alternative?
Yes. rConfig Core is free and open source, with no device limit, multi-user local accounts and single sign-on included, so you can run the everyday backup job without a licence.
Is Netpicker open source?
Partly. Netpicker is built on open source libraries, including Netmiko, pytest and TextFSM, and Flock9 calls this an “open source foundation”. The platform itself ships as prebuilt container images under an end user licence agreement: its public GitHub repository holds deployment files, Docker Compose, a Helm chart and scripts, rather than the application's own source code, and carries no application source licence.
Which edition of Netpicker includes SSO and RBAC?
Enterprise, Netpicker's top tier, from $33,500 per year for under 1,000 devices, per Netpicker's own pricing page. rConfig ships single sign-on in every edition including the free Core, and LDAP and RBAC from Starter. See the full breakdown on the rConfig pricing comparison.
Can rConfig back up OT and IoT devices?
Yes. rConfig backs up SCADA, PLCs, roadside signage, legacy voice systems and other specialised OT equipment over SSH, Telnet, API or the SIE, including in air-gapped networks. Netpicker's own supported-vendors page does not list OT, ICS or industrial vendors.
How does rConfig scale compared with Netpicker?
rConfig's latest benchmark backs up over 50,000 devices in under 21 minutes on a single host, with the method published, and a reference architecture documented past 100,000 nodes. Netpicker does not publish a per-server or per-agent device figure.
Does rConfig support MSPs and multi-tenancy?
Yes. Vector provides hierarchical role-based access control for MSPs, and Vector Prism is a branded customer portal with mandatory multi-factor authentication. Netpicker lists multi-tenancy for MSPs as an Enterprise add-on.
Where is Netpicker a better fit than rConfig?
Three places, stated plainly. Netpicker's pytest framework for pre and post change validation suits teams that already write Python; rConfig covers compliance policy and change detection, not a pytest test suite. CVEasy gives Netpicker vulnerability scanning from Professional upward; rConfig is not a CVE scanner. And Netpicker ships native NetBox and Nautobot plugins plus a sister discovery product, Slurp'it; rConfig integrates with NetBox and Nautobot as a source of truth rather than as a plugin inside them.
How do we migrate from Netpicker to rConfig?
Export your device inventory, or sync it from NetBox or Nautobot, which both products support. Install rConfig, import devices and map credentials, or point rConfig at your existing HashiCorp Vault. Run a first backup and diff it against your latest Netpicker backup, then run both tools in parallel for one change cycle before retiring Netpicker's schedules. If you already have a pytest suite against Netpicker, keep it, and run it from your pipeline against rConfig-managed configurations instead.
Get enterprise NCM without the enterprise tier
V8 Core is open source and free to run, with single sign-on included from day one. See the backups and diffs on your own devices before you decide anything else. Prefer to talk it through first? Book a demo.