Limitations & deliberate non-goals — what probectl does not do, on purpose

What it is

This page is the honest list of things probectl deliberately does not do, and things that are built but not yet wired into the running server. It exists because the fastest way to lose a careful reader's trust is to imply a capability you don't ship. The headline non-goal documented here is the plugin / detection marketplace (F49): a hosted catalog where third parties publish and sell detections and plugins.

Treat this page as the counterpart to every feature page: those tell you what works; this one draws the edges so you always know which side of the line you're on.

Why it exists

A monitoring tool is only as useful as it is trustworthy, and trust is asymmetric — one overstatement that a reader tests and disproves taints the pages that were accurate. Regulated buyers in particular read the limitations page first. Stating non-goals plainly also prevents wasted effort: you won't architect around a feature that was never coming, and you won't file a bug for behavior that is working as designed.

How it works

probectl sorts every capability into one of three honest states, and this page is where the third state lives:

Served live — wired into the running control plane and agents today. Documented on its feature page.
Built, not yet served — present as library code but not exposed in the running server. Its feature page says so explicitly and links here.
Deliberate non-goal — intentionally out of scope. Listed below with the reason.

The plugin/detection marketplace (F49) is firmly in state 3 for general availability. probectl supports detections and integrations as first-class, in-tree capabilities; what it does not offer is a hosted, third-party marketplace for buying and distributing them. That is a deliberate future bet, not a shipped feature, and the product's surface map declares it "none-by-design" so the gap is explicit rather than accidental.

Other standing non-goals (probectl is a network-observability platform, not these):

An inline IPS or firewall. Detections are signals you tune and export; probectl never sits in the traffic path or blocks packets (see ndr.md, bgp.md).
A SIEM or log-analytics platform. It exports to your SIEM rather than replacing it (see siem.md).
Autonomous remediation. Any action layer is observe-only and human-gated by default (see remediation.md).
A vendor-hosted public SaaS. probectl is self-hosted; the multi-tenant capability exists for partners/MSPs to run themselves (see provider-plane.md).

Use it

Before you rely on a capability, confirm which state it's in — the editions surface reports what your license enables:

curl --cacert ./ca.crt -H "Authorization: Bearer $TOKEN" \
  https://probectl.example.com/v1/editions

The Admin → Editions view shows the same thing in the UI; the surface map declares each capability's state. For the marketplace specifically, there is no marketplace command and no registry endpoint to point at — a community detection bundle is simply not loadable. Detections are authored in-tree instead; see the NDR-lite page ("Detection-as-code") for how. That absence is by design, not a misconfiguration.

Pitfalls & limits

"Non-goal" does not mean "coming soon." Don't plan a rollout around a marketplace or an IPS mode; if priorities change, the feature page will say so.
"Built, not yet served" is not "served." If a feature page flags library-only status, test before you depend on it in production.
This page can lag reality. If a feature page and this page disagree, the feature page (and the running server) win — please report the drift.

Reference

Deliberate GA non-goals: plugin/detection marketplace (F49); inline IPS/firewall; SIEM/log-analytics platform; autonomous remediation; vendor-hosted public SaaS.
Authoring detections without a marketplace: ndr.md ("Detection-as-code").
Capability states and licensing: Admin → Editions.