Deputy (AI assistant)

What it does: the Deputy is SubnetSlinger's own AI assistant. It uses the AI provider you choose — Anthropic Claude (the default), OpenAI-compatible, Google Gemini, or local Ollama — with your own key where one is needed. It is NOT Microsoft Copilot or GitHub Copilot, and has no connection to them. Send the whole Posse instead when you want a full multi-agent sweep (see the Posse article).

How it helps: it doesn't just chat — it runs the diagnostic tools to investigate a problem, then explains what the results mean. Those tools are ping, traceroute, DNS, port scan, HTTP, TLS audit, IP info, public IP, WHOIS, NTP, SNMP, subnet calc, MAC lookup, ARP table, and your machine's own interfaces / sockets / routes. It can also work with your SubnetSlinger records — read your inventory and incidents, check drift, run a runbook, pull up reference docs, and keep its own per-project memory and tasks. Ask in plain English ("why can't this host reach the gateway?") and it decides which checks to run, reads the output, and answers with the evidence.

Setup: live answers need Pro or the 30-day trial, with any provider, Ollama included — on the free tier the Deputy plays the built-in sample investigation. (1) pick a provider in the "AI" dropdown — Anthropic (the default), Ollama (local), OpenAI-compatible or Gemini; (2) paste its API key into the Key box (Ollama needs none); (3) decide whether keys are stored (see Storing your keys). The in-app first-time AI setup panel walks the same three steps, and each provider's help panel links to where you get a key. For Anthropic you can also pick a key you saved yourself in the Vault, and choose a model: Haiku 4.5 (fastest/cheapest, the default), Sonnet 4.6 (balanced), or Opus 4.8 (most capable) — bump it up only when a problem needs deeper reasoning. For OpenAI-compatible, set the Base URL + model + key: one adapter covers ChatGPT (api.openai.com/v1) plus anything that speaks the same API — Groq, OpenRouter, Azure OpenAI, a local LM Studio or vLLM. For Gemini, set the model (e.g. gemini-2.0-flash) + key from Google AI Studio.

Where your data goes: your conversation and tool results are sent to whichever CLOUD provider you pick (Anthropic, OpenAI-compatible, or Gemini) to generate answers; on Ollama running on this machine nothing leaves it. An Ollama host on ANOTHER machine is treated like a cloud provider: the badge names that host and a WARNING asks first.

Storing your keys: the "Store AI cloud keys on this device" switch controls whether your cloud keys survive a restart. ON (the default) saves each key into SubnetSlinger's encrypted Vault and loads it automatically next launch, so you never re-type it — unlock the Vault (rail) so it can be saved. OFF keeps keys in memory only: you re-enter them every session, and turning the switch off also removes any key this app had saved. Turn it OFF when company policy forbids storing secrets on the machine; leave it ON for convenience on your own box. The switch and its live status line sit right below the key fields. See "AI models & token usage" for costs and the token readout.

Before anything is sent to a model — a cloud provider (Anthropic, OpenAI-compatible, Gemini) or Ollama, local or remote — SubnetSlinger scans your message and every tool result for secret-shaped text — private key blocks, password= fields, Bearer/Basic auth headers, API keys, JWTs — and strips them, replacing each with a labeled [redacted: ...] placeholder. You'll see a 🔒 notice in the chat whenever this happens; what's shown in your own chat window is always the full, unredacted original — only the copy sent to the model is scrubbed. This is a pattern match, not a guarantee: it catches well-known secret shapes, not everything a person could type. Don't paste a real password or key into the Deputy expecting it to always be caught — when in doubt, switch to Ollama (local) for that conversation instead.

Prefer local + private? Switch the "AI" dropdown to Ollama (local) to run an on-machine model instead — no key, no cost, nothing leaves the box when Ollama runs on this machine (an Ollama host elsewhere gets the off-machine WARNING above). See "Ollama — run the AI locally". Tools, MCP, and the read-only safety all work the same either way.

Safe to run: yes — the Deputy's own tools are READ-ONLY. The one exception is a connected MCP server whose "writes" box you tick (off by default); the Posse forces every MCP tool read-only regardless. It can't run commands on a device itself: the one way it touches a device is a runbook's read-only show steps (same gate as Multi-host; with a cloud AI it asks you first). No file transfer, and it never sees your stored credentials. For anything that changes a device — a config edit, shutting a port, containing a rogue host, rotating a key — it tells you what to do and why; it cannot and will not do it for you. Treat its tool runs like clicking the tools yourself: only point port scans and SNMP at gear you're authorized to test.

Reading results: tool runs show up inline as 🔧 lines so you can see exactly what it checked. If it ran a check, the conclusion is grounded in that result — verify the 🔧 output if a recommendation looks surprising. While the Deputy is working a banner shows it's running and the chat auto-scrolls to the latest line.

Keeping a result: click Save to Incidents to store the whole investigation as a durable, timestamped Incident (then export it to Markdown or Print/PDF from Workspace ▸ Incidents — handy as release or ticket evidence), or Copy to grab the transcript. The tool-call AUDIT trail is written to the Activity log automatically either way; the chat text itself is kept only if you Save or Copy it.

Try the demo scenarios: in demo mode (View ▸ Demo mode (sample data)) a Scenario picker appears above the input box. Pick one and press Send — the Deputy replays that scripted investigation (the 🔧 tool calls, then its answer) on the demo network. No AI provider is called and no live tool runs. Scenarios: ap_latency — "2nd-floor Wi-Fi feels slow"; dns_slow — "Everything is slow after the ISP maintenance"; rogue_mac — "Unknown device on the access switch"; vpn_path_loss — "VPN users dropping"; all_clear — "Morning check — anything wrong?"; cert_expiring — "A site cert is about to expire"; internet_down — "Internet is down"; dhcp_exhausted — "New laptops can't get an IP"; duplicate_ip — "The lobby printer keeps dropping off"; wrong_vlan_jack — "This desk's jack is dead"; ntp_drift — "Users get random auth failures"; mtu_blackhole — "Big uploads over VPN hang"; port_errors — "Printer drops every afternoon"; captive_guest — "Guest Wi-Fi has no internet"; cert_expired_internal — "Browser warns on the switch's web UI".