Clusters keep multiplying. Platform teams don't. Agents take on the ongoing work of security, compliance, cost and troubleshooting, so your team reviews results instead of chasing them.
Launch any agent from Control Hub, now or on a schedule. They run in Nirmata's cloud, so there's nothing to install.
Runs 24/7 inside your cluster, watches for Kyverno policy violations and opens a pull request with the fix. It never pushes directly.
nctl ai
Writes, tests and debugs Kyverno policies from your terminal, or inside Cursor and Claude Desktop as an MCP server.
Every agent is read-only and ends in a report. Two of them also write the Kyverno policies that keep the problem from coming back.
Access, policy and compliance posture.
Maps what every ServiceAccount can actually reach: cluster-admin grants, wildcard permissions, secret access and privilege-escalation paths. Rates each finding by risk, maps it to MITRE ATT&CK for Containers, and gives least-privilege fixes.
Looks at the workloads actually running in your cluster and generates the Kyverno policies they need for security hardening, resource governance and best practices.
Scans your cluster against the standard you choose, maps violations to its controls, and gives a pass/fail summary with remediation guidance.
Spend and cluster hygiene.
Finds over-provisioned resources, idle workloads and orphaned volumes using live metrics and historical Prometheus data, then estimates monthly savings at your cloud prices.
Finds unused and stale resources across 14 categories, from orphaned PVCs to empty namespaces, ranks cleanup by how safe it is, and suggests Kyverno policies that stop them piling up again.
Diagnose failures and draft fixes.
Diagnoses CrashLoopBackOff, OOMKilled, Pending pods, unavailable deployments and unbound PVCs using read-only queries. No exec, no changes. Returns the root cause and safe next steps.
Generates YAML fixes for Kyverno violations in a namespace, with a before-and-after view, confidence scores and severity. Nothing is applied until you decide.
analytics: 11 idle deploymentsstaging: CPU requests 4× actual usageml-batch: 6 orphaned PVCsEvery Agent Hub agent is an OttoFlow workflow: a graph of steps that runs the same way every time, like the one above.
First, read-only steps collect data from your cluster: pods, events, metrics, RBAC bindings. Then AI analyzes only what was collected, to find issues, size resources and write recommendations. It never queries or changes your cluster itself.
Every run keeps its execution graph and full report, so you can audit how each conclusion was reached.
What the agent found, at a glance.
Every step it ran, in order, with its status.
Findings, recommendations and fixes, ready to share.
Yes. Start a free Control Hub trial, connect a cluster and run any agent.
In Nirmata's cloud, as short-lived jobs. They reach your cluster through the Control Hub connection with scoped, read-only permissions.
No. Agents only need read-only access. The one exception is Remediator (in-cluster), and it only opens pull requests for you to review.
No. Customer and cluster data is never used for model training.
Read-only workflow steps collect data from your cluster. AI then analyzes that data and writes findings, recommendations and the report. AI never queries or changes your cluster directly.
Copilot lives in Control Hub and answers questions about your clusters and reports. Nirmata Assistant runs on your desktop, in your terminal or IDE, and helps you write and test policies.
Nirmata AI by default. You can also bring your own model: Anthropic Claude, OpenAI, Google Vertex AI and Gemini, AWS Bedrock or Azure OpenAI.
Nirmata Control Hub Advanced and Enterprise, and every free trial.
Connect a cluster, run Workload Troubleshooter or RBAC Analyzer, and read your first report.
