Security

Nothing is opened inbound. The agent runs inside your network and dials out to the service.

Your credentials stay on the agent. A kubeconfig stays in your own file; the agent writes down only the context's name and the file's path. The service holds names, versions, tiers and your policy, never a credential, and refuses a request that could carry one.

Results are never kept by the service. With the agent's MCP server, a tool's result goes from the agent to the AI client on the same machine and nowhere else; the service receives the licence check and the policy pull. Through the workspace's gateway (/mcp), the result is masked and fenced on the agent first, then passes through the service to your AI client, and is not stored: the workspace's audit keeps who asked, what, and how it was decided, with the arguments masked. Secrets in a result (a Secret's values, a token in a log line) are masked on the agent before your AI client sees them.

Every call is your role's decision, made on the agent with a policy the service signs and the agent verifies, and a row in the agent's own audit. A call through the gateway is decided at the gateway first and again on the agent, with your role bounded by the role of the member who paired the agent.

The agent is open to inspection. It is a compiled program that unpacks; nothing in it pretends to be a secret. It checks its licence once a day and holds the last good answer for seven days offline; after that it runs no tools and says why.