OKOpsKit
NY --:-- --LON --:-- --
Safe · Evidence-driven · GitOps-native
v1.0.0 · Kubernetes 1.34–1.36

Give your AI agent
real eyes on
your cluster.

Get OpsKit — $49See what's inside
279/279 tests pass · open source safety layer
zsh — opskit init
$ npx github:runopskit/opskit init --license XXXX-XXXX

  ✓ Node.js v20.11.1
  ✓ context: production-eks
  ✓ Kubernetes 1.36 (v1.36.0)
  ✓ 33 skills, 42 agents, 46 commands
  ✓ safety layer installed (opskit-guard, MIT)
  ✓ 13 read-only tools ready

Active on this cluster:
  ✓ Sidecar-aware pod triage
  ✓ GitOps ownership resolution

Ready. Try: /k8s-triage <pod> is failing
42
Specialist Agents
33
Investigation Skills
46
Slash Commands
13
Read-only MCP Tools
The problem

Generic AI guesses.
OpsKit reads.

Without a live cluster connection, your AI agent answers from training data. That's fine for code. It's not fine for a production outage that started 11 minutes ago.

Your AI agent guesses

Without a live connection, Claude answers from training data. That's fine for writing code. It's not fine for diagnosing a production outage that started 11 minutes ago.

OpsKit gives Claude a real-time, read-only window into your cluster — actual pod events, actual logs, actual resource states. Every conclusion cites the specific evidence it came from.

You can't trust it near production

A confident wrong answer that runs kubectl apply is worse than no answer at all. Most agent tools have no enforcement — they rely on the model choosing not to mutate.

OpsKit's safety layer blocks mutations at the OS level before they reach your cluster. It's an allowlist, not a denylist. It's MIT-licensed. You can read every line before you trust it.

Sidecar failures are invisible

Since Kubernetes 1.36, sidecars are mainstream. They report status in initContainerStatuses. A pod can show phase: Running while a sidecar CrashLoops — and anything reading only containerStatuses calls it healthy.

OpsKit's k8s_get_pod_health normalises both arrays and tags each container as app, sidecar, or init. We proved the trap on a live cluster before shipping the fix.

How it works

Three steps,
under 15 minutes.

01

Install in one command

Run npx github:runopskit/opskit init in your project. OpsKit asks which cluster context to use, fetches the safety hooks, builds the MCP server, and verifies connectivity. Under 15 minutes from purchase to first investigation.

Requires Node.js 18+, python3, kubectl. Works with Claude Code and Kiro.

02

Connect your cluster

Fill in CLAUDE.md with your cluster names, key services, runbook locations, and escalation paths. Claude reads this before every investigation — it's the context that turns a generic agent into one that knows your platform.

Supports EKS, GKE, AKS, k3s, minikube, kind. Kubernetes 1.34–1.36.

03

Investigate and fix

Type /k8s-triage payment-service pod is failing. OpsKit reads your cluster, correlates events and logs, forms a hypothesis with cited evidence, and either proposes a GitOps PR or tells you exactly what's missing.

46 slash commands. 42 specialist agents. All read-only.

Capabilities

The investigation your senior
SRE runs at 3am.

Six domains. Forty-two specialist agents. Every skill defines exactly what evidence it needs before drawing a conclusion — and says so explicitly when that evidence is missing.

01MCP

Live cluster connection

OpsKit connects to your cluster via a 13-tool read-only MCP server. Claude reads real pod events, logs, and resource states — not documentation. No guessing.

02Diagnosis

Evidence-contract diagnosis

Each of the 33 skills defines the exact evidence required before a conclusion. If it's missing, OpsKit says so. No confident wrong answers from incomplete data.

03K8s 1.36

Sidecar trap (Kubernetes 1.36)

A sidecar CrashLooping inside a Running pod is invisible to anything reading only containerStatuses. OpsKit checks initContainerStatuses. We proved this on a live cluster.

04Safety

Enforced safety layer

An allowlist hook blocks every mutation verb — kubectl apply, helm upgrade, terraform apply, and 120+ bypass patterns. It's open source. Read every line before you trust it.

05GitOps

GitOps-native fixes

OpsKit resolves repo ownership from ArgoCD or Flux annotations, generates a minimal patch, and opens a PR with the evidence summary and rollback plan. Never a direct apply.

06Multi-cloud

AWS, Terraform, and beyond

42 agents cover Lambda errors, IAM wildcards, SQS dead-letter queues, terraform plan blast radius, CloudWatch alarms, and security findings. All read-only.

What's included

42 agents.
Not a list of names.

Every agent has a specific job. These are the actual investigation protocols, not a count.

Kubernetes investigation

  • CrashLoop — exit codes, previous logs, config changes
  • OOMKill — limit vs. leak discrimination
  • Pending pods — resource quotas, taints, DRA claims
  • Network/DNS — NetworkPolicy, service endpoints, CoreDNS
  • Rollout regression — pre/post deploy comparison
  • Sidecar failures — initContainerStatuses (GA in K8s 1.36)
  • GitOps drift — ArgoCD/Flux ownership resolution
  • Runbook validator — checks commands against live cluster

AWS investigation

  • Lambda errors — timeout, OOM, throttles, DLQ analysis
  • ALB 5xx — target health, access logs, WAF rules
  • RDS — connection exhaustion, slow queries, failover events
  • IAM — wildcard permissions, cross-account trust, least privilege
  • CloudWatch alarms — correlation, threshold, dimension linkage
  • SQS dead-letter queues — message inspection, error attribution

Terraform / IaC

  • Plan review — blast radius, destroys, replacements
  • Security scanner — public S3, open security groups, unencrypted RDS
  • Secret detection — hardcoded credentials in source and plan output
  • Cost estimation — expensive instance types, storage anomalies
  • State drift — orphaned resources, import candidates

Platform and SRE

  • Incident commander — structured response, timeline, stakeholder updates
  • SLO designer — multi-window burn-rate alerts, error budget policy
  • Postmortem analyst — concrete prevention tasks with acceptance criteria
  • Capacity planner — usage trends, growth assumptions, headroom
  • Deployment guard — pre-merge risk: missing probes, :latest tags, limits
279/279
Tests passing

129 safety bypass cases · 64 K8s live cluster · 45 AWS · 40 Terraform

100%
Mutation block rate

0 bypasses across 129 adversarial cases including flag injection, aliases, pipe chains, decode-and-execute

MIT
Safety layer licence

Every line of the hook engine is public at github.com/runopskit/opskit-guard — audit it yourself

< 15 min
Time to first investigation

One command from purchase to working cluster connection

Pricing

One-time purchase,
not a subscription.

Launch pricing · limited time
Launch price

Launch Offer

$129$49one-time · lifetime license

For Staff SREs and Platform Engineers who want their AI to actually read the cluster.

  • 42 specialist agents (Kubernetes, AWS, Terraform, SRE)
  • 33 investigation skills with evidence contracts
  • 46 slash commands
  • 13-tool read-only MCP server
  • Supports Claude Code and Kiro
  • 12 months of updates included
  • opskit-guard safety layer (MIT, open source)
  • Instant digital delivery · all sales final
⚡Instant access after checkout
🔒Secure checkout via Polar
📜All sales final · no refunds
📦Delivered via GitHub repo
Get OpsKit — $49

For teams or enterprise pricing — email support@runopskit.com

FAQ

Questions before
pointing it at prod.

Still have questions?

Tell us about your cluster and workflow. We’ll help you decide whether OpsKit fits your setup.

support@runopskit.com
What exactly gets installed?+

OpsKit drops files into your project's .claude/ directory: 42 agent files, 33 skill files, 46 command files, a configured MCP server, and the safety hooks. The MCP server connects to your cluster using your existing kubectl credentials. Nothing is installed globally.

Which AI tools are supported?+

Claude Code and Kiro both work fully — that includes safety hook enforcement. Cursor and Codex CLI work for investigation (the MCP tools connect) but their hook layer is different so mutation blocking is not OS-enforced there. For production use, Claude Code or Kiro is recommended.

What are the requirements?+

Node.js 18+, python3, and kubectl. That's it. OpsKit uses your existing kubeconfig — it never asks for credentials beyond what kubectl already has. Kubernetes 1.34, 1.35, and 1.36 are tested across EKS, GKE, AKS, k3s, minikube, and kind.

How is it delivered after purchase?+

Purchase via Polar. You get instant access to the private GitHub repository (runopskit/opskit). Run the one-line install command from the README and it's working in minutes. No zip files, no manual copying.

What stops it from breaking things?+

A pre-tool hook intercepts every bash command before it executes and checks it against an allowlist. kubectl apply, helm upgrade, terraform apply, kubectl exec, and 120+ bypass patterns are blocked at the OS level before reaching your cluster. The safety layer is open source — you can read exactly what it allows and blocks before trusting it with production.

What's the refund policy?+

OpsKit is a digital product delivered in full at checkout — instant access to the private repo and installer. All sales are final and purchases are non-refundable. Have questions before buying? Email support@runopskit.com and we'll help you decide.