Continuum Local
Continuum Local security and architecture
Continuum Local is an agent you install inside your own network. It lets Continuum Link read monitoring, IPAM and backup systems that are not exposed to the internet, and it can sweep your network for SNMP devices. It opens every connection itself, checks every request against its own configuration, and keeps credentials on your side unless you choose to send them from Blueprintr.
Enterprise plan · checked against agent 0.2.0 on 25 September 2026
Architecture
Every connection starts inside your network
The agent connects out to Blueprintr over HTTPS on port 443 and accepts no connections itself. It needs no inbound firewall rule or open port, and the Helm chart creates no Service or Ingress.
Your network
- Monitoring, IPAM and backup systemsReads only, to the hosts you list
- Switches, routers and other SNMP devicesSNMP, inside the ranges you list
Blueprintr
agents.blueprintr.ioblueprintr.ioEditors and readers see the panels and sweep results in their browser.
How a request travels
- An editor links or refreshes a Continuum Link tab, or starts a network sweep. Blueprintr queues a job for the agent that serves that connection.
- The agent collects the job over its own outbound connection, checks it against its local configuration, and runs it on your network.
- The agent posts the result back. Blueprintr builds the panel or the sweep results from it.
When Blueprintr offers it, the agent works through agents.blueprintr.io: it keeps a connection open there to hear about work at once, and sends its polls and results there, at least once a minute. If that host stops answering, the agent polls blueprintr.io directly until it answers again.
Enforcement
The agent enforces your rules, even against Blueprintr
The agent treats every instruction from Blueprintr as untrusted. Its configuration file is your policy: someone in control of Blueprintr could ask it only for reads, against the hosts you listed, with the accounts you gave it.
Only the hosts you list
Each connection in the agent's configuration names the exact hosts it may reach in
allowedHosts, with no wildcards. The agent refuses a job for a connection it does not have, and checks the host again after the credential is filled in and on every redirect.Only reads
The agent relays only requests that read, checked for each product by method and path, and refuses anything else. For NetBox, Infoblox, Veeam Backup & Replication and PRTG it accepts only the exact endpoints Blueprintr's connector uses. For the other six it accepts any read that product's API offers. Give the agent an account that can read only what Blueprintr should see. Allowing more for one connection takes
allowWriteOperationsin the agent's own configuration, which Blueprintr cannot set.No credentials in Blueprintr's requests
Blueprintr builds each request with unguessable placeholders where a credential belongs. The agent puts your value in on your network, and refuses to send any request in which a placeholder is left.
Tokens stay on the agent
WhatsUp Gold and Veeam Backup & Replication exchange a password for an access token. The agent keeps that token in memory and gives Blueprintr a stand-in. Session cookies a system sets are dropped before anything is sent back.
SNMP inside your ranges
A sweep reaches only the address ranges in the agent's own
discoveryblock. Blueprintr can narrow a sweep to part of them and cannot widen it. The agent sends SNMP GET, GETNEXT and GETBULK over UDP at the rate you set, and uses no ICMP, port scanning or raw sockets.Secrets masked in logs
Credentials and tokens the agent handles are masked in its logs and in the job results it sends back. The logs stay on the agent's host.
Least privilege on the host
The Linux packages run as an unprivileged
continuum-localuser under a hardened systemd unit, with no capabilities and a read-only filesystem apart from the state directory. The Windows service runs as LocalService, and the container and Helm chart run as a non-root user. In the packages the service can read its configuration but cannot change it.
With credential push turned on, Blueprintr can also set up connections on the agent. They follow the same rules, stay within the hosts in remoteCredentialScope when you set one, and are refused for the agent's own machine and for link-local addresses such as the cloud metadata service unless that scope names them.
Credentials
Blueprintr never stores a credential for your on-premise systems
By default, credentials go in the agent's configuration file on your machine and never leave your network. Any value can be a reference, env:NAME or file:/path, so it can come from the secret manager you already use.
When Blueprintr offers agents.blueprintr.io, a credential can also be pushed to an agent from Blueprintr. Credential push is optional and off by default. With allowRemoteCredentials: true in the agent's configuration, someone with permission to manage Continuum integrations can send a credential from Blueprintr's settings instead. It passes through Blueprintr over an encrypted connection to the agent, which keeps it in its own state directory. Blueprintr writes it to no database and no queue, so the agent has to be connected to agents.blueprintr.io to receive it.
A connection defined in the agent's own configuration always wins. Blueprintr can neither replace nor remove it.
On the agent's host, credentials are protected by file permissions and are not encrypted by the agent. Use disk encryption on the host if your policy requires encryption at rest.
Revoking or deleting an agent in Blueprintr leaves its machine untouched. To retire one, delete its configuration and state directory, as Upgrading and removing describes.
Your data
What reaches Blueprintr, and for how long
The agent never sends Blueprintr your credentials, SNMP communities or passphrases, the tokens WhatsUp Gold and Veeam issue, or its logs. A credential you choose to push from Blueprintr passes through it on the way to the agent and is not stored. Blueprintr keeps the data below in AWS eu-west-1 (Ireland).
| What | Why | Who sees it | How long |
|---|---|---|---|
| The answer to each read the agent relays, such as a device's identity, its alerts and the state of its interfaces | To build the panel an editor asked for by linking or refreshing a tab | Blueprintr's servers, to build the panel | The request expires two minutes after it is made, and its answer is deleted after that. |
| The saved panel: the fields a connector shows, taken from that answer | So people reading the blueprint see a dated snapshot without anyone contacting your systems | For most connectors, everyone who can read the blueprint, which on a public blueprint means anyone. NetBox panels are for the blueprint's editors unless you choose otherwise, and Infoblox and Veeam Backup & Replication panels are for editors only. | Until an editor refreshes or removes the tab. Blueprint versions and exports made in the meantime keep their copy. |
| Network sweep results: the devices, ports and links a sweep finds, and the MAC and IP addresses those devices have learned. A device's contact details are not kept. | To show your estate in Blueprintr | People who can manage Continuum integrations for the organisation or team | 90 days from when the sweep started. Each agent's latest complete sweep is kept until a newer one completes, and deleting the agent deletes its sweeps. |
| The agent's record: its name, version, platform and capabilities, when it last checked in, the connections it serves and its discovery ranges | To send each job to an agent that can run it, and to show whether it is online | People who can manage Continuum integrations for the organisation or team, and Blueprintr staff who run the service | Until you delete the agent. A revoked agent's record is kept for the audit trail. |
| Audit entries for registering, revoking and deleting agents, sending or removing credentials, starting sweeps and downloading the agent. A credential's value is never recorded. | So your administrators can see who did what | People with permission to read the organisation's audit log | As the privacy policy sets out for audit records. |
If you list NetBox custom fields or Infoblox extensible attributes to show, those products send all of an object's values. Panels keep only the ones you listed, and the rest are deleted with the request.
Blueprintr's database backups keep deleted data until those backups expire.
ARP and forwarding tables record which address each laptop and phone holds and which switch port it is behind, so they can identify people. If your data-protection review rules them out, deny the arp or fdb collectors in the agent's configuration, or set collectContact: false.
Network
Network requirements
| From | To | Port | For |
|---|---|---|---|
| The agent's host | blueprintr.io | TCP 443, HTTPS | Enrolment, and polls, results and sweep uploads whenever agents.blueprintr.io is not in use |
| The agent's host | agents.blueprintr.io | TCP 443, HTTPS and WebSocket | Polls, results and sweep uploads once Blueprintr offers it, a connection that tells the agent about work at once, and pushed credentials when that is on |
| The agent's host | Your monitoring, IPAM and backup systems | Each product's API port (below) | The reads Continuum Link panels need |
| The agent's host | Devices in your discovery ranges | UDP 161, SNMP | Network sweeps, when you configure discovery |
| The agent's host | Your DNS resolvers | 53, DNS | Resolving the hosts above, unless a proxy resolves the Blueprintr hosts |
| Anywhere | The agent's host | None | The agent accepts no inbound connections |
Allow the two Blueprintr hosts by name: their addresses can change.
Traffic to Blueprintr can go through a proxy, set with proxy and noProxy in the configuration or with HTTPS_PROXY and NO_PROXY. For a proxy that inspects TLS, give the agent its root certificate as extraCaFile, which the agent trusts for Blueprintr only. Connections to your own systems never go through the proxy.
The agent needs an outbound path to Blueprintr, so it cannot run on an air-gapped network. Blueprintr marks an agent offline after 90 seconds without contact.
continuum-local check tests the configuration, the state directory, the proxy, and a TLS handshake to Blueprintr and to every configured host, and says what to change.
Default ports of the ten products
- SolarWinds Orion
17774 - Zabbix
443 - PRTG Network Monitor
443 - Checkmk
443 - Icinga 2
5665 - ManageEngine OpManager
8060 - WhatsUp Gold
9644 - NetBox
443 - Infoblox
443 - Veeam Backup & Replication
9419
A port written in the connection’s URL replaces the default. OpManager’s connector does not assume 8060, so write that port in its URL. Each product also needs a dedicated account that can only read; the network requirements guide lists the account and the certificate each one needs.
Install formats
Where it runs
| Format | For | Runs as |
|---|---|---|
.deb, x86-64 and Arm64 | Debian 10, Ubuntu 20.04 or later | An unprivileged continuum-local user under a hardened systemd unit |
.rpm, x86-64 and Arm64 | RHEL, Rocky or Alma 8 or later | An unprivileged continuum-local user under a hardened systemd unit |
.msi, x64 | Windows Server | LocalService, which can read its configuration but not change it |
| Container image, x86-64 and Arm64 | Docker, Podman | A non-root user |
| Helm chart | Kubernetes | One non-root replica with a read-only root filesystem |
.mjs bundle | Any host with Node.js 24 or later | The account you run it as |
The packages include their own Node.js runtime and declare no dependencies. None of them ships a configuration, and the agent does not start until you have written one. The agent never updates itself and starts no other program: you install each upgrade.
Releases
Verifying a release
Releases are signed with Sigstore keyless signing by the agent's release workflow, run for the release's version tag. No long-lived signing key exists to be stolen: each signature names the workflow and the tag, and is recorded in Sigstore's public transparency log.
SHA256SUMSand its cosign bundle cover every download: the packages, the installer, the bundle and the Helm chart archive.- The container image and the Helm chart are signed by digest with the same identity.
- A CycloneDX software bill of materials is bound to the bundle by a signed attestation.
- The agent has no runtime dependencies, and the bundle is one unminified JavaScript file your team can read. The Node.js runtime inside the packages is pinned by checksum.
- The container image is published with its package inventory and a vulnerability scan. A release is not published while that scan finds a critical vulnerability with a fix available.
Accept only this identity, with the version you downloaded, issued by https://token.actions.githubusercontent.com:
https://github.com/blueprintr-io/continuum-local/.github/workflows/release.yml@refs/tags/v<version>The download page prints the exact cosign command for the release in front of you, and offers the current release and a few earlier ones with their release notes. Continuum Local is before version 1.0, so only the latest release receives fixes.
The Windows installer is not Authenticode-signed, so Windows may warn that its publisher is unknown. Check it against the signed SHA256SUMS before you run it.
Plan
Who can use it
Continuum Local is part of the Enterprise plan, like Continuum Link. The organisation that owns an agent needs an active Enterprise plan, and a team's agent uses its parent organisation's plan. Registering an agent takes permission to manage Continuum integrations in that organisation or team.
The download is offered to signed-in users on an Enterprise plan.
If the plan lapses, the agents pause. They stay listed in settings so they can be revoked or deleted, and they reconnect on their own once the plan is renewed.
When an agent has not been heard from for 15 minutes, the owning organisation's owners and admins get an email, at most one an hour each. Blueprintr can also turn Continuum Local off for every customer at once, for example during an incident; agents keep their configuration and reconnect when it is turned back on.
Reporting
Reporting a vulnerability
Email [email protected] with "Security: Continuum Local" in the subject line, with the agent version and how it is installed. Never send a config.json or a state file: both contain credentials. We aim to acknowledge a report within 3 working days and to give our assessment within 10.
Documentation
The Continuum Local guide
Setting up, running and reviewing the agent, in the Blueprintr user guide. Start at the overview.
Installing Continuum Local
Prerequisites and sizing, each install format, and enrolling the agent.
Network requirements
Hosts, ports, proxies and TLS-inspecting firewalls.
Configuration reference
Every setting in
config.json, secret references and the check command.Security model
What the agent enforces, what Blueprintr stores and where credentials are kept.
Network discovery
What an SNMP sweep reads and the policy that limits it.
Troubleshooting
An agent that is offline, or a request through it that failed.
Releases and verification
Versions, signatures and verifying a download or image.
Upgrading and removing
Upgrading, rolling back, revoking and uninstalling.
Questions and limitations
Air-gapped networks, several sites, redundancy and support.
FAQ
Questions about Continuum Local
Does Blueprintr store the credentials for our monitoring systems?
No. Credentials in the agent's configuration file never leave your network. If you turn on credential push, which needs the agent connected to agents.blueprintr.io, a credential you send from Blueprintr passes through Blueprintr to the agent and is not stored on the way.
Do we need to open a port or add an inbound firewall rule?
No. The agent connects out to blueprintr.io and agents.blueprintr.io on port 443 and accepts no inbound connections.
Can Blueprintr change anything in our systems through the agent?
No. The agent relays only requests that read: for NetBox, Infoblox, Veeam Backup & Replication and PRTG, only the exact endpoints the connector uses, and for the other six, any read that product's API offers. Anything else takes allowWriteOperations on one connection in the agent's own configuration file, which Blueprintr cannot set.
Does it work on an air-gapped network?
No. The agent needs outbound HTTPS to Blueprintr, directly or through a proxy.
Which systems can it read?
SolarWinds Orion, Zabbix, PRTG Network Monitor, Checkmk, Icinga 2, ManageEngine OpManager, WhatsUp Gold, NetBox, Infoblox and Veeam Backup & Replication, and SNMP devices in the address ranges you allow.
What personal data can a network sweep collect?
ARP and forwarding tables record which MAC and IP address each device holds and which switch port it is behind, which can identify people's laptops and phones. Blueprintr keeps sweep results for 90 days and does not keep device contact details. To leave those tables out, deny the arp or fdb collectors in the agent's configuration.
How do we get it?
Sign in to an account on an Enterprise plan and open the download page. It offers the current release and a few earlier ones, each with the command that verifies its signature.