Sycophant runs autonomous AI agents inside a Kubernetes cluster built on least privilege, zero knowledge, and defense in depth. Everything the agent produces is treated as adversarial.
Pre-release and under active development. The architecture below is the design the project is built around. Expect sharp edges.
Most agent frameworks are built for capability, not containment. Isolation is something you bolt on, if you remember to.
Hosted platforms take the other extreme. The model, your data, and the agent all run on their infrastructure. You get controls, but they are settings on machines you do not own, backed by promises you have to trust.
Sycophant is neither. Your data lives on infrastructure you choose. The agent answers only to devices you approve. Containment is the default, not an add-on.
Assume the agent is fully subverted: prompt injection, a poisoned tool, a bad model. It still cannot:
- Read a secret. Model keys and tool credentials exist only inside short-lived jobs, for the seconds a call needs them.
- Call the network freely. The agent has no direct egress. Every outbound route is a broker with an explicit allowlist.
- Break out of a tool. Each tool runs in its own throwaway sandbox with only the credentials and network access it declared.
- Rewrite its own history. The conversation log is owned by a separate component the agent can't write to.
- Reach another tenant. Every tenant has its own network, storage, and identity, with no route from one tenant into another.
Isolation comes from Kubernetes itself. Each tenant is a namespace. Each component is a pod. Every model or tool call runs in a short-lived throwaway pod. The agent's files live on one workspace volume that its tool pods share. That volume is the agent's own space. Secrets, tokens, and network access are not shared, and none outlive the pod that used them.
- Brokered credentials. The agent asks a broker by name. The broker gives each call its own throwaway pod, and only that pod ever holds the secret. Neither the agent nor the broker sees it.
- Scrubbed output. A tool sometimes needs credentials to run. Before its output returns to the agent, every appearance of those credential values is replaced with a redaction marker. The same scrub runs on model output. The agent gets results, never keys.
- A worthless identity. The agent's pod has no RBAC and mounts no token by default. And each token it does use only works with one service. No privilege escalation.
- Separation, not permission. The conversation log lives on a volume the agent's pod never mounts. The agent cannot rewrite history because it cannot touch the file.
- Closed by default. Cilium gives every pod a default-deny egress firewall. gVisor sandboxes the pods that run agent-written code, so a container escape stops at the sandbox and never reaches the host.
- Enforcement out of reach. Kyverno creates each tenant's RBAC when its namespace appears, and blocks edits to the security resources from inside that namespace. The agent cannot reach its own admission policies.
Sycophant uses Chainsaw integration tests against a live cluster to validate security rules. Each test tries a forbidden action and checks that the cluster refuses.
Sycophant ships as Helm charts. There are two ways in.
CLI — local, secure by default. The syco CLI stands up a local k3d cluster with the full capability stack (see Requirements) already wired in:
syco setupDevOps — your own cluster. Install the charts with Helm. The sycophant-quickstart chart bundles the gVisor RuntimeClass and Kyverno CRDs, so one command gives you a working cluster:
kubectl apply -f charts/sycophant-cluster/system-ns.yaml
helm install sycophant charts/sycophant-quickstart \
-n sycophant-system --set policyEngine=kyverno --waitAlready provide your own RuntimeClass and CRDs (see Requirements)? Skip the bundle and install the cluster layer alone:
helm install sycophant charts/sycophant-cluster \
-n sycophant-system --set policyEngine=kyverno --waitFour components, each with a single, well-defined job. The agent asks a broker by name. The broker holds the credentials and network access needed to answer. Neither secrets nor egress reach the agent.
| Component | Role |
|---|---|
| Harness | The agent runtime, one per workspace. Runs the agent loop, owns the conversation history, and reads its own kernel — the workspace's instructions, sub-agents, and skills — in-process from a read-only volume. |
| Relay | The client gateway. Registered devices dial in through it to reach their agent, and it relays messages to and from the harness. |
| Hangar | The model broker. Calls model-provider APIs on the agent's behalf. |
| Airlock | The tool broker. Runs each tool in an isolated, throwaway sandbox. |
Built as a Rust monorepo on gRPC (tonic/prost), Kubernetes CRDs (kube-rs), and Helm charts. The syco CLI drives it. Images target Linux arm64 and amd64.
Sycophant runs on any conformant Kubernetes cluster. It relies on three cluster capabilities. Each is a swappable role with a sensible default:
- Sandboxed container runtime: a
gvisorRuntimeClass by default (Kata is a supported alternative). Isolates the chambers that run agent-executed tool code. - Network egress control: Cilium (default-deny egress with an L7 DNS allowlist).
- Admission policy engine: Kyverno 3.5.x, with its CRDs.
syco setup installs this default set on a local k3d cluster for you. Running it needs a local toolchain: k3d, helm, kubectl, cargo (rustup), protoc, cmake, and a C compiler.
The local target is a k3d cluster. To exercise the full stack end to end:
OPENROUTER_API_KEY=... scripts/e2e.shThis spins up a clean k3d cluster, builds and loads all images, deploys the Helm charts, and runs the security assertions. Charts live under charts/ (sycophant-quickstart is the install bundle). Per-component design docs live under docs/: airlock, hangar, harness, relay, and secrets providers.
Security is structure, not configuration. Simplicity, not complexity. See SECURITY.md for reporting and THREAT_MODEL.md for the full model.
Contributions are welcome. Open an issue to discuss a change, or send a pull request. Start with the design docs under docs/ to get oriented.
Logo by Bullitt.