Meet Kyro: The Infrastructure Agent with Guardrails→

Instant Self-Service Infrastructure for Developers. No Tickets. No Waiting.

Ship and manage infrastructure with guardrails, deterministic execution, recovery and Day 2 operations built in, for humans and AI.

Start free Book a demo

Interactive product walkthrough (See it, Ship it, Operate it) mounts here from the hosted v2 script.

Trusted by teams small and large at companies like

Core Features

Observe, orchestrate and operate your infrastructure.

StackGuardian meets you where you are. See every resource and repository, ship governed changes, and keep production running, from Day 2 to recovery.

Inventories & remediation

Observe

See every cloud resource and IaC repository, then fix misconfigurations and codify what is unmanaged.

Explore Observe →Deployments & audit

Orchestrate

Instant self-service through GitOps, UI, API, MCP or your own IDP, with policy checks, approvals and a full audit trail.

Explore Orchestrate →Day 2 & resiliency

Operate

Day 2 operations, from drift checks to upgrades and rollbacks, and resiliency to recover fast when something breaks.

Explore Operate →

With agents

For developers and agents alike

Ask Kyro, or your own assistant through the StackGuardian MCP server. Agents act with your role and go through the same plan, policy check and approval as your team.

Via MCPClaude·VS Code Copilot·Cursor·Codex·Gemini CLI

Meet Kyro →

Why did the last apply on payments-prod fail?You

KyroThe runner couldn't read the SSH key in secret git-deploy-key, so checkout failed before the plan. Re-save it in OpenSSH format and re-run.

Policy Engine

Enforce security, compliance, and cost policies across every infrastructure deployment. Prevent violations before they reach production with automated policy-as-code guardrails.

OPA/Rego and SG Policy (Tirith)

Warn, require approval or fail the run

Central and team-level enforcement

Same policies for developers and AI agents

Tirith on GitHub

protect-prod-databases.json Input: OpenTofu or Terraform plan

{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/terraform_plan",
    "name": "Production databases are never destroyed or left unprotected"
  },
  "evaluators": [
    {
      "id": "db_not_destroyed",
      "provider_args": {
        "operation_type": "action",
        "terraform_resource_type": "google_sql_database_instance"
      },
      "condition": { "type": "NotContains", "value": "delete" }
    },
    {
      "id": "deletion_protection_on",
      "provider_args": {
        "operation_type": "attribute",
        "terraform_resource_type": "google_sql_database_instance",
        "terraform_resource_attribute": "deletion_protection"
      },
      "condition": { "type": "Equals", "value": true }
    }
  ],
  "eval_expression": "db_not_destroyed && deletion_protection_on"
}

prod-workflow-guardrails.json Input: StackGuardian workflow

{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/sg_workflow",
    "name": "Production workflows need approval and drift checks"
  },
  "evaluators": [
    {
      "id": "approval_before_apply",
      "provider_args": {
        "operation_type": "attribute",
        "workflow_attribute": "approvalPreApply"
      },
      "condition": { "type": "Equals", "value": true }
    },
    {
      "id": "drift_check_on",
      "provider_args": {
        "operation_type": "attribute",
        "workflow_attribute": "driftCheck"
      },
      "condition": { "type": "Equals", "value": true }
    }
  ],
  "eval_expression": "approval_before_apply && drift_check_on"
}

k8s-probes-and-pinned-images.json Input: Kubernetes manifests

{
  "meta": {
    "version": "v1",
    "required_provider": "stackguardian/kubernetes",
    "name": "Pods declare liveness probes and pinned images"
  },
  "evaluators": [
    {
      "id": "has_liveness_probe",
      "provider_args": {
        "operation_type": "attribute",
        "kubernetes_kind": "Pod",
        "attribute_path": "spec.containers.*.livenessProbe"
      },
      "condition": { "type": "NotContains", "value": null }
    },
    {
      "id": "uses_latest_tag",
      "provider_args": {
        "operation_type": "attribute",
        "kubernetes_kind": "Pod",
        "attribute_path": "spec.containers.*.image"
      },
      "condition": { "type": "Contains", "value": ":latest" }
    }
  ],
  "eval_expression": "has_liveness_probe && !uses_latest_tag"
}