Run it. Read a finding. Approve a fix.
Agentantibody maps how your Kubernetes and AWS workloads really talk, investigates what changes with evidence, and proposes fixes you approve. These pages cover running it, how it reasons, and how to extend it.
What it is
Agentantibody is open source defense against lateral movement across Kubernetes and AWS. It builds a graph of what exists and what is allowed, watches telemetry for what actually happens, and investigates what is new. A finding cites the facts and evidence behind it. A fix is applied only after you approve it.
What is in the box
| Piece | What it does |
|---|---|
| Plugins | Each reads one system: Kubernetes, Istio, Cilium, agentgateway, and AWS. |
| Graph | Versioned in PostgreSQL. Every assertion keeps its plugin, rule, and evidence. |
| Telemetry | OTLP logs over POST /v1/logs and AWS VPC Flow Logs from Amazon Data Firehose, stored raw in JSONL or ClickHouse and rolled up into the graph. |
| Reasoning | Detects changes that are new and investigates them through six read-only tools. Optional, and needs a model endpoint. |
| Explorer | A web UI embedded in the binary: an overview, ranked findings, the environment graph, and a catalog of resources and relationships. You approve remediations there. |
| Remediation | The Kubernetes, Cilium, and Istio plugins can apply fixes you approve. |
| HTTP API | JSON endpoints behind the explorer, plus a graph change stream. |
Status
This is v0. Plugins read Kubernetes and AWS today. The graph and the plugin contract are provider-neutral, so other environments arrive as plugins. The AWS plugin is early and read-only: it observes EC2 networking and applies nothing.
The development API has no production authentication. Read the security model before exposing it.
Browse the docs
Getting started
Run agentantibody against Kubernetes or AWS, open the explorer, and turn on reasoning.
→Concepts
How plugins, the graph, telemetry, reasoning, and remediation fit together.
→Plugins
The plugins in the box, what each reads, and what is planned.
→Operations
Configure the service, understand its security model, call its API, and measure it with evals.
→Contributing
Build and test the Go service and the web UI, and find where each part lives.
→