Log inStart free
KyroMeet Kyro: Your infra agent with guardrails→

Ship fast. Recover faster.

Accelerate time to market with engineers and AI agents deploying infrastructure through guardrails, predictable execution, and rapid recovery.

Start freeBook a demo

Trusted by leading teams

RheinEnergie
LiveEO
Lufthansa
Deutsche PfandbriefbankMEWA

See it, ship it, operate it: an interactive walkthrough of StackGuardian loads here.

Core Features

Observe, orchestrate and operate your infrastructure.

StackGuardian meets you where you are. See every resource and repository, ship changes with guardrails, and keep production running, from Day 2 to recovery.

Inventories & remediation

Observe

See every cloud resource and IaC repository, then fix misconfigurations and codify what is unmanaged.

Explore Observe →Deployments & audit

Orchestrate

Instant self-service through GitOps, UI, API, MCP or your own IDP, with policy checks, approvals and a full audit trail.

Explore Orchestrate →Day 2 & recovery

Operate

Day 2 operations, from drift checks to upgrades and rollbacks, and recovery to get back to a known-good state fast when something breaks.

Explore Operate →
With agents

For developers and agents alike

Ask Kyro, or your own assistant through the StackGuardian MCP server. Agents act with your role and go through the same plan, policy check and approval as your team.

Via MCPClaude·VS Code Copilot·Cursor·Codex·Gemini CLI
Meet Kyro →
Why did the last apply on payments-prod fail?You
Kyro
KyroThe runner couldn't read the SSH key in secret git-deploy-key, so checkout failed before the plan. Re-save it in OpenSSH format and re-run.
Guardrails built in

Every change is checked against your security, compliance and cost policies, whether it was written by your team or an AI agent, and whoever runs it. Violations stop before production.

OPA, Tirith, Wiz, or bring your own
Warn, require approval or fail the run
Central and team-level enforcement
Same policies for developers and AI agents
Tirith on GitHub
protect-prod-databases.json Input: OpenTofu or Terraform plan
{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/terraform_plan",
    "name": "Production databases are never destroyed or left unprotected"
  },
  "evaluators": [
    {
      "id": "db_not_destroyed",
      "provider_args": {
        "operation_type": "action",
        "terraform_resource_type": "google_sql_database_instance"
      },
      "condition": { "type": "NotContains", "value": "delete" }
    },
    {
      "id": "deletion_protection_on",
      "provider_args": {
        "operation_type": "attribute",
        "terraform_resource_type": "google_sql_database_instance",
        "terraform_resource_attribute": "deletion_protection"
      },
      "condition": { "type": "Equals", "value": true }
    }
  ],
  "eval_expression": "db_not_destroyed && deletion_protection_on"
}
prod-workflow-guardrails.json Input: StackGuardian workflow
{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/sg_workflow",
    "name": "Production workflows need approval and drift checks"
  },
  "evaluators": [
    {
      "id": "approval_before_apply",
      "provider_args": {
        "operation_type": "attribute",
        "workflow_attribute": "approvalPreApply"
      },
      "condition": { "type": "Equals", "value": true }
    },
    {
      "id": "drift_check_on",
      "provider_args": {
        "operation_type": "attribute",
        "workflow_attribute": "driftCheck"
      },
      "condition": { "type": "Equals", "value": true }
    }
  ],
  "eval_expression": "approval_before_apply && drift_check_on"
}
k8s-probes-and-pinned-images.json Input: Kubernetes manifests
{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/kubernetes",
    "name": "Pods declare liveness probes and pinned images"
  },
  "evaluators": [
    {
      "id": "has_liveness_probe",
      "provider_args": {
        "operation_type": "attribute",
        "kubernetes_kind": "Pod",
        "attribute_path": "spec.containers.*.livenessProbe"
      },
      "condition": { "type": "NotContains", "value": null }
    },
    {
      "id": "uses_latest_tag",
      "provider_args": {
        "operation_type": "attribute",
        "kubernetes_kind": "Pod",
        "attribute_path": "spec.containers.*.image"
      },
      "condition": { "type": "Contains", "value": ":latest" }
    }
  ],
  "eval_expression": "has_liveness_probe && !uses_latest_tag"
}

Seamless integration with your workflow

StackGuardian plugs into the tools and workflows you already run, so nothing about how you work has to change.

OpenTofuTerraformHelmAnsibleAWSMicrosoft AzureGoogle Cloud PlatformGitHubGitLabBitbucketAzure DevOpsServiceNowBackstagePulumiCheckovOPAWiz
All integrations →

Latest articles

Resources and articles offering insights into Infrastructure as Code (IaC).

All articles
Terraform Import: How It Works and Where It Falls Short
October 27, 2026

Terraform Import: How It Works and Where It Falls Short

GitOps vs DevOps: Which Approach Does Your Team Actually Need?
October 15, 2026

GitOps vs DevOps: Which Approach Does Your Team Actually Need?

LiveEO: From Terraform Cloud to GitOps-Driven Infrastructure
October 1, 2026

LiveEO: From Terraform Cloud to GitOps-Driven Infrastructure

Ready to simplify your IaC?

Empower your teams with secure self-service deployments.

Free Forever ○ No Credit Card Required

Start freeBook a demo →
Iframe is blocked. Accept cookies to load it.

By clicking "Accept", you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.