AcornOps is an open-source, self-hosted platform for troubleshooting Kubernetes clusters and Linux/systemd VMs. It brings live target context, guided investigation, durable automation, and controlled tool use into one operator experience.

Try the live demo · Self-host AcornOps · Read the docs · Build an integration

AcornOps connects a central operations platform to your infrastructure through target agents that initiate outbound connections. Operators can inspect inventory, findings, resource state, metrics, and logs; start troubleshooting sessions; and follow each run as it reasons, calls tools, pauses for approval, and records its outcome.

The platform is designed for operational control:

• Outbound target connections: AgentK and AgentV connect to the control plane. You do not need to expose an inbound management port on every target.
• Read-only first: Linux/systemd built-in tools are read-only. Kubernetes writes require explicit RBAC, agent enablement, run permission, and tool access.
• Approval at the point of change: Write confirmation is required by default. A run pauses before a write-capable tool call so an authorized operator can approve or reject that specific action.
• Scoped model and tool access: The LLM gateway enforces run-scoped credentials, provider and model allow-lists, tool permissions, runtime limits, and budgets.
• Reviewed MCP connectivity: Remote MCP servers are target-scoped and discovery-first. Discovered tools stay disabled until an owner or admin reviews and enables them.
• Bounded evidence and auditability: Tool output is redacted and bounded before it reaches model context. Audit metadata is sanitized so secrets, raw message bodies, pod logs, and full tool arguments are not retained.

• Connect Kubernetes clusters and Linux/systemd VMs to a shared workspace.
• Investigate target inventory, durable findings, resources, metrics, logs, and recent activity.
• Run chat-based troubleshooting with streamed, replayable run events.
• Route model traffic through OpenAI, Anthropic, or Gemini with centrally governed access.
• Combine built-in target tools with reviewed remote MCP servers.
• Create durable Agents and sequential Workflows triggered manually, on schedules, by webhooks, or by target events.
• Integrate through the public control-plane API, webhooks, server-sent run events, and MCP.
• Deploy the central platform with Kubernetes Helm charts or Docker Compose on a VM.

flowchart LR
    Operator["Operator"] --> Console["Management console"]
    Console --> ControlPlane["Control plane"]
    ControlPlane --> ExecutionEngine["Execution engine"]
    ExecutionEngine --> Gateway["LLM gateway"]
    Gateway --> Providers["Model providers"]
    Gateway --> RemoteMCP["Remote MCP servers"]
    AgentK["AgentK"] -->|"Outbound WebSocket"| ControlPlane
    AgentV["AgentV"] -->|"Outbound WebSocket"| ControlPlane
    AgentK --> Kubernetes["Kubernetes clusters"]
    AgentV --> Linux["Linux/systemd VMs"]

The control plane owns authentication, workspaces, targets, run state, agent coordination, and the public API. The execution engine drives run lifecycles. The LLM gateway brokers models and MCP tools under policy. AgentK and AgentV provide target-local context and execute only the capabilities made available to a run.

AcornOps is split into independently versioned components with explicit contracts between them.

Start with the AcornOps contributor guide, then read the README.md and AGENTS.md in the component you want to change. Each product repository owns its tests, architecture, contracts, and validation commands.

Found a security issue? Please follow the security policy and do not open a public vulnerability report.

AcornOps is built in the open under the MIT License. If the project is useful to you, follow the organization and star the repositories you use. It helps other operators find the project.