Let agents run ops. Without a shell.

How it works

One gateway between agents and hosts.

Agents, the CLI and the console connect only to the gateway. It authenticates each request, selects hosts by label, checks policy for every target and dispatches in batches. Hosts connect out to the gateway; no inbound host port is required.

Callers

Claude CodeMCP

CodexMCP

allowops CLIConnect

Web consoleHTTPS

CIsigned catalogs

→

allowops gateway

:443 · TLS + ALPN

Auth · OIDC / LDAP / service accounts

ABAC policy decisions

Batches and failure limits

Audit hash chain

←

Hosts

demo-1environment=demo

demo-2environment=demo

demo-3environment=demo

demo-4unlabeled

Outbound connection · mutual TLS

Signing

Hosts run only catalogs you signed.

Catalogs are validated and built in CI, signed with Ed25519 in a DSSE envelope, then published. You distribute the public keys to the gateway and each host. The gateway cannot add or revoke keys on a host.

allowops catalog validate ./catalog

allowops catalog sign --in catalog.json …

allowops catalog publish -f catalog.dsse.json

Policy

Every target host is checked.

The gateway embeds OPA. Rules are structured data, not arbitrary Rego. Deny wins; no match and evaluation errors deny. If any target is denied or the count does not match, the whole request is rejected before dispatch.

// tools/call → disk_usage
{
  "targets": { "selector": "environment=demo" },
  "expected_count": 3,
  "reason": "check demo disk usage"
}

rules:
  - name: readers-on-demo
    effect: allow
    roles: [ops-reader]
    operations: [execute_action]
    risks: [read]
    host_labels: { environment: demo }
  - name: deny-writes-on-demo
    effect: deny
    roles: ['*']
    operations: [execute_action]
    risks: [write, dangerous]
    host_labels: { environment: demo }

// tools/call → docker_stop
{
  "targets": { "selector": "environment=demo" },
  "expected_count": 3,
  "reason": "stop api container as requested",
  "params": { "container": "api" }
}

rules:
  - name: readers-on-demo
    effect: allow
    roles: [ops-reader]
    operations: [execute_action]
    risks: [read]
    host_labels: { environment: demo }
  - name: deny-writes-on-demo
    effect: deny
    roles: ['*']
    operations: [execute_action]
    risks: [write, dangerous]
    host_labels: { environment: demo }

// tools/call → disk_usage
{
  "targets": { "selector": "environment=demo" },
  "expected_count": 2,
  "reason": "check demo disk usage"
}

rules:
  - name: readers-on-demo
    effect: allow
    roles: [ops-reader]
    operations: [execute_action]
    risks: [read]
    host_labels: { environment: demo }
  - name: deny-writes-on-demo
    effect: deny
    roles: ['*']
    operations: [execute_action]
    risks: [write, dangerous]
    host_labels: { environment: demo }

// tools/call → disk_usage
{
  "targets": { "hosts": ["demo-4"] },
  "reason": "check demo disk usage"
}

rules:
  - name: readers-on-demo
    effect: allow
    roles: [ops-reader]
    operations: [execute_action]
    risks: [read]
    host_labels: { environment: demo }
  - name: deny-writes-on-demo
    effect: deny
    roles: ['*']
    operations: [execute_action]
    risks: [write, dangerous]
    host_labels: { environment: demo }

Console

Hosts, catalogs, jobs and audit in one console.

The console uses the same API and permissions as the CLI and MCP. These are real screenshots of the local demo environment.

OverviewHostsCatalogJob detailAudit

Online hosts, running jobs, and catalogs and tokens close to expiry.

Details

Boundaries after execution, too.

Quick start

Run a complete demo locally.

The Compose demo includes the gateway, PostgreSQL, SeaweedFS, an LDAPS directory and two hosts. The script generates credentials locally, publishes the example catalog and runs a read-only disk_usage job on both hosts.

Requires Linux amd64, Docker Compose, Go 1.27.3, OpenSSL, Git and Python 3 with PyYAML. Use the Helm chart for Kubernetes and .deb or .rpm packages for hosts; see installation.

# Define and publish a catalog
allowops catalog validate ./catalog
allowops catalog build --dir ./catalog --out catalog.json
allowops catalog sign --in catalog.json --out catalog.dsse.json --key "$KEY_FILE"
allowops catalog publish -f catalog.dsse.json

# Label hosts; unlabeled hosts reject execution
allowops hosts label demo-1 --set environment=demo

# Simulate the policy, then replace it
allowops policy test -f rules.yaml
allowops policy apply -f rules.yaml --reason 'allow read-only access to demo'

# Run the same action from a terminal
allowops run disk_usage --selector environment=demo --expected-count 3 --reason 'disk check'
allowops jobs output job-20261022-0010 --host demo-1 --stream stdout