KOPILOT OPEN SOURCE · MIT SELF-HOSTED

An AI operator for your cluster — with signing limits.

Kopilot investigates Kubernetes the way an SRE does: reads pods, events, metrics, and logs, then explains what it found. It holds no power of deletion. Every destructive command is drawn up as an approval request and waits for your counter-signature — single-use, ten-minute expiry, written to the audit log.

Get started View source

Four entries in the ledger

The sequence is the safety model. Autonomy for reading, dual control for destruction, and a record of everything in between.

1

You ask

In plain language — over the CLI, REST API, Slack, an AITask resource, or MCP. “Review the staging namespace for cost savings.”

2

It investigates

A supervisor routes the request to specialist sub-agents that run real kubectl and helm through one audited executor — rate-limited, time-boxed, output-capped. Read-only commands run freely.

3

You countersign

Destructive commands — delete, drain, patch, scale, helm uninstall — are held as approval requests. Review the queue, approve or deny. Protected namespaces such as kube-system are refused outright, never approvable.

4

It goes on the record

Every command, delegation, decision, and result is written to a structured audit log, and each task reports the highest risk it touched.

The working papers

What an investigation actually looks like. The recommendation is free; the delete is not — that boundary is enforced in the executor, not in the prompt.

ILLUSTRATIVE SESSION — OUTPUT SHORTENED

kopilot askstaging · cost review
$ kopilot ask "Review the staging namespace for cost savings"

[cost_optimization] kubectl top pods -n staging
NAME                        CPU(cores)   MEMORY(bytes)
api-7d9c6bf4b6-l2xkw        19m          212Mi
api-7d9c6bf4b6-tr8fz        23m          198Mi
reports-64d5c9b87-x8mzn     1m           38Mi

Findings
- api requests 500m CPU per replica but sustains ~20m (<5% of the
  request). Memory holds near 210Mi against a 1Gi request.
- reports has had 0 ready replicas for weeks; its Service receives
  no endpoints.

Recommendations
1. Lower the api CPU request toward 100m and memory toward 384Mi,
   then watch for throttling before making it permanent.
2. reports looks abandoned. Removing it is destructive, so I did
   not do it:

   kubectl delete deployment reports -n staging
   → APPROVAL REQUIRED (high). Request № e3a1f0b2c4d5 is
     pending your counter-signature.

Where the signature sits

One executor, one gate. Every command a sub-agent proposes is classified before it runs; only the safe path is automatic.

YOUR PROMPT SUPERVISOR ROUTES IT SKILL AGENT PLANS CMDS READ-ONLY DESTRUCTIVE SAFETY GATE EXECUTED APPROVAL QUEUE AWAITS SIGNATURE KUBE-SYSTEM: REFUSED AUDIT LOG EVERY ENTRY
Read the fine print. The approval queue is in-memory — single replica, not persisted across restarts. The pattern gate is defense in depth; the service account's RBAC remains the real boundary. Both are stated plainly in the safety model, because a trust instrument that hides its limits isn't one.

Schedule of powers

What the instrument grants, in full.

A supervisor and six skills

A LangGraph supervisor routes each request to YAML-defined sub-agents: security, administration, networking, monitoring, troubleshooting, and cost optimization. Add your own skills as YAML files — no Python required.

Four audited tools

Every skill works through the same executor — run_kubectl, run_helm, run_shell, read_resource — with per-task rate limits, 90-second timeouts, and output caps.

A REST API and CLI

Submit tasks over HTTP or with kopilot ask. Bearer-token auth, HMAC-verified webhooks, task history, and Prometheus metrics.

A Kubernetes operator

A Kopf-based operator with AITask, AISkill, and AIPolicy resources, plus a watcher that opens investigations when Warning events repeat.

Any of five model providers

Ollama by default — fully self-hosted — or OpenAI, Azure OpenAI, Anthropic, and Gemini, switched with one environment variable.

An MCP surface for other agents

kopilot mcp exposes tasks and portable skills over the Model Context Protocol — stdio, SSE, or streamable-HTTP — so other agents inherit the same signing limits.

DEFAULT Ollama · self-hosted OpenAI Azure OpenAI Anthropic Gemini

Issue your own instance

From source, today. Python 3.11+. The product is named Kopilot; the Python package is kubedevaiops.

On a cluster. A Helm chart ships in the repository (helm/kubedevaiops), and CI publishes images to ghcr.io/kopilot-ai/kopilot.

Then read the quickstart and the configuration reference.

# investigate from your laptop
git clone https://github.com/kopilot-ai/kopilot
cd kopilot && pip install -e .
kopilot ask "Which pods are failing, and why?"

# or install on a cluster
helm install kopilot ./helm/kubedevaiops \
  --set api.authToken=$(openssl rand -hex 24)

Give the agent a pen, keep the seal.

Point Kopilot at a cluster and ask it something you'd rather not spend the afternoon on.

Get started Read the docs