Agent Hub · Part of Nirmata Control Hub

Kubernetes governance with AI agents on your team.

Clusters keep multiplying. Platform teams don't. Agents take on the ongoing work of security, compliance, cost and troubleshooting, so your team reviews results instead of chasing them.

• Read-only access
• Your data is never used for training
• Included with Control Hub Advanced & Enterprise

Where agents run

Run them from Control Hub, in your cluster, or on your desktop.

• Nirmata cloud · on demand or scheduled

Managed agents

Launch any agent from Control Hub, now or on a schedule. They run in Nirmata's cloud, so there's nothing to install.

Remediator (in-cluster)

Runs 24/7 inside your cluster, watches for Kyverno policy violations and opens a pull request with the fix. It never pushes directly.

Nirmata Assistant

Writes, tests and debugs Kyverno policies from your terminal, or inside Cursor and Claude Desktop as an MCP server.

Agent catalog

An agent for each ongoing job.

Every agent is read-only and ends in a report. Two of them also write the Kyverno policies that keep the problem from coming back.

Secure

Access, policy and compliance posture.

• RBAC Analyzer
  Maps what every ServiceAccount can actually reach: cluster-admin grants, wildcard permissions, secret access and privilege-escalation paths. Rates each finding by risk, maps it to MITRE ATT&CK for Containers, and gives least-privilege fixes.

Optimize

Spend and cluster hygiene.

• Cost Analyzer
  Finds over-provisioned resources, idle workloads and orphaned volumes using live metrics and historical Prometheus data, then estimates monthly savings at your cloud prices.

Fix

Diagnose failures and draft fixes.

• Workload Troubleshooter
  Diagnoses CrashLoopBackOff, OOMKilled, Pending pods, unavailable deployments and unbound PVCs using read-only queries. Returns the root cause and safe next steps.

Remediator (in-cluster)

From policy violation to pull request, without anyone paging through reports.

1. Step 1: Kyverno flags a violation
   Remediator reads your cluster's policy reports continuously.

2. Step 2: Remediator drafts a fix
   A compliant change, with a confidence score.

3. Step 3: A pull request opens
   In your Git repo. Branch protection is respected.

4. Step 4: You review and merge
   Your normal GitOps flow ships the change.

Reports

Every run ends in a report your team can act on.

One place for every result Every agent run lands in Control Hub Reports, searchable and labeled.

Copilot in Control Hub

• Which namespaces drive most of the waste this month?

How agents work

Every Agent Hub agent is an OttoFlow workflow: a graph of steps that runs the same way every time. First, read-only steps collect data from your cluster: pods, events, metrics, RBAC bindings. Then AI analyzes only what was collected, to find issues, size resources and write recommendations.

FAQ

Can I try the agents before buying?

Yes. Start a free Control Hub trial, connect a cluster and run any agent.

Where do managed agents run?

In Nirmata's cloud, as short-lived jobs. They reach your cluster through the Control Hub connection with scoped, read-only permissions.

Is my data used to train AI models?

No. Customer and cluster data is never used for model training.

What does the AI do, and what doesn't it do?

Read-only workflow steps collect data from your cluster. AI analyzes that data and writes findings, recommendations and the report. AI never queries or changes your cluster directly.